Binance hack: $6.3 billion siphoned to a blank address

Coin Encyclopedia Improve your knowledge of cryptos

Updates 11:50 p.m.: Binance confirms user funds are safe and cuts withdrawals until the issue is resolved.

The alert comes from Spreek, an on-chain researcher. A function call swept, around 9 p.m., the wallet labeled “Binance 14”, a hot wallet connected to the internet from which Binance moves its customers’ funds.

Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash pic.twitter.com/DAHksHY8p7

Around sixty tokens and 167,464 ether then joined an address never used, a total of around 3.5 billion dollars at the prices at the time.

The entry point becomes clearer. According to Odysseus, from the Phylax team, the wallet first received an EIP-7702 delegation. This Ethereum standard lets a classic wallet execute delegated code and authorize transfers without a new signature. The drain started three minutes later.

1/4 EIP-7702 can turn the wallet itself into the sweeper. A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed. This is bad. https://t.co/GrvUiya16D pic.twitter.com/zONu8cwW63

In other words, the wallet found itself obeying a foreign code, like a lock reprogrammed remotely.

The sweep operator was hardcoded into this delegate, previously populated via Tornado Cash. This Ethereum mixer mixes the funds of many users to confuse their traceability, so that the money that comes out no longer bears an original label.

How the attacker obtained these signatures remains unknown. Odysseus mentions, without deciding, a possible compromise of the signature key of the “Binance 16” wallet.

Nearly 40 minutes after the first sweep, a second sweep picked up the crumbs remaining on the wallet, approximately $4 million more. Its author therefore still held control of the contract.

The authority of the delegated wallet went further. Shortly after, he used his role as owner of another smart wallet to extract $780 million in USDC.

The perimeter extends beyond Ethereum: Arkham estimates the hacker's collection of addresses at up to $5.7 billion, from bitcoin to TRX. A gross perimeter, not a definitive loss count. At this level, it would be the biggest hack in crypto history, ahead of the $1.5 billion suffered by Bybit.

On Thursday evening, a Binance spokesperson told Cointelegraph that its security teams were looking into the suspicious activity, without the platform confirming any impact on user funds.

Machine-translated from French