In short, the attacker spent some time openly preparing on-chain, then used a single EIP-7702 delegation to turn Binance hot wallet Binance 14 into their own contract and began sweeping in the early hours. By dawn, addresses associated with the Binance hot wallet had seen outflows of approximately $5.643 billion across Ethereum, Bitcoin, Tron, and multiple L2s; issuers including Tether, Circle, Ripple, and World Liberty jointly froze approximately $2.54 billion, about 45% of the outflows. As of now, that malicious delegation still has not been revoked.
Binance's official line remains that it is investigating potential security issues and that user funds are completely safe.
Outflowed assets (as of October 30, 05:22):
Ethereum: $3.528 billion
Bitcoin: $1.449 billion
Tron: $628 million
Arbitrum + Optimism + Base: approximately $38 million combined
Currently frozen assets:
Tether approximately $1.567 billion USDT, Circle approximately $823 million USDC (combined $2.316 billion), plus Ripple approximately $200 million RLUSD, World Liberty Financial approximately $27.8 million USD1 + $2 million WLFI, totaling $2.54 billion.
Timeline
The night before: 18 hours of preparation (October 28 – 29)
From October 28: The attacker's originating address 0x7C86…5CA0 successively received 3 Tornado Cash withdrawals of approximately 0.1 ETH each, specifically to pay for gas. This address had no prior connection to Binance.
October 29, 10:29: Deployed the first sweep contract 0x19be…f2bf. It was later abandoned.
October 29, 21:51: Wrote EIP-7702 delegations to two test wallets. Neither of these wallets belonged to Binance; they were external wallets the attacker found themselves.
October 29, 22:20 and 22:24: The 1st and 2nd drills, invoking the sweep to drain these two test wallets. The first may have had some issues, and a second attempt followed four minutes later.
October 29, 23:59: Deploy the revised contract 0x63e8…6fAe. It ultimately takes effect on Binance
October 30, 00:21 to 00:30: The 3rd drill, switching to a third wallet, with two delegations plus one sweep.
Then silence for 3 hours 51 minutes. Until the strike.
Main attack: 40 minutes (October 30, 04:21 – 06:02)
04:21:00: Submit an EIP-7702 type transaction, delegating the code of 0x63e8…6fAe to Binance 14, at address 0x28C6…1d60. 50 authorizations were packed into the same transaction, and only 1 hit the nonce.
04:24:23: The main sweep occurs. Binance 14 itself initiates the call, transferring 167,464 ETH plus 63 types of tokens to 0x5227…2f8c, including about $1.615 billion USDT. The fee was 0.0004 ETH, less than $1.
04:24:47: Binance 16 adds 28,005.6 ETH to the same address, almost seamlessly.
04:30 to 04:33: Begins splitting the USDT, sending $500 million to 0x9749…C762 and $200 million to 0x0Ddf…697e.
04:38: 195,460 ETH is transferred in one go to 0x8532…43D4. This is the largest single transfer.
04:41 and 04:59: The attacker calls another function, 0x043ff9d2, on Binance 14; in the same minute, Hot Wallet 34 transfers out $780 million and $43 million USDC respectively. The attacker borrowed Binance 14's permission over that contract.
05:04: Another sweep, taking 1,699.92 ETH.
05:22 to 06:02: Breaking it into pieces. $88.5 million RLUSD, 7.02 million UNI, 7.77 trillion PEPE, 29,934 wBETH, 217.5 million ENA, sent one by one to brand-new addresses, each preloaded with 0.5 to 1 ETH for gas.
05:44: During this process, another successful sweep was executed on Binance 14, clearing out newly deposited funds that had just arrived.
Only 3 minutes and 24 seconds passed between the delegation and the first sweep. But Binance's risk control system took no blocking action.
Subsequently, starting from 5 o'clock, Binance and various project teams began freezing assets: approximately $1.567 billion in USDT from Tether, approximately $823 million in USDC from Circle (totaling $2.316 billion combined), plus approximately $200 million in RLUSD from Ripple and approximately $27.8 million in USD1 + $2 million in WLFI from World Liberty Financial, amounting to $2.54 billion.
Attack cause: A single signature turned a hot wallet into someone else's contract
EIP-7702 is a capability introduced by Ethereum's Pectra upgrade: it allows an ordinary wallet (EOA) to temporarily rent the code of a smart contract. The wallet owner signs an authorization, and from then on, any call to that address executes that external code.
The attacker's approach was:
Deploy contract 0x63e8...6fAe, which contains only one function sweep(address pool, address[] depositors) — transferring all ETH and a specified list of tokens to a designated address.
Obtain the authorization signature for Binance 14 and "install" this code onto Binance's hot wallet.
3 minutes and 24 seconds after installation, directly call the sweep contract on the Binance hot wallet address.
So from the outside, it appeared as though Binance's hot wallet itself transferred the funds out. Nothing on-chain showed any "external address transferring assets away" — it looked like Binance 14 was making a normal outgoing transaction.
The attacker did not know Binance 14's real-time nonce (that wallet was still continuously sending transactions). So he packed 50 authorizations into a single transaction, with nonces ranging from N to N+49, betting that one of them would hit. In the end, only one took effect.
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
