Shenyu Reviews Binance Theft Incident: Attackers Conducted 2 Rehearsals in Advance and Prepared a Transfer List Covering 64 Tokens

According to TechFlow, on October 30, Cobo co-founder Shenyu released a video reviewing the Binance theft incident from the perspective of on-chain transactions. The attackers broadcast a transaction containing 50 authorization requests at 4:20 a.m., signed with a Binance hot wallet private key, and began bulk asset transfers about 3 minutes later.

Shenyu pointed out that the attack involved the EIP-7702 authorization mechanism. The attackers had prepared a transfer list covering 64 tokens in advance and conducted 2 rehearsals using test wallets, with the last rehearsal about 3.5 hours before the actual attack. They then transferred assets through multiple wallets and smart contract wallets, converting some stablecoins such as USDT into ETH to evade issuer freezes.

Regarding freezes, Tether has frozen 1.38 billion USDT, Circle has frozen 823 million USDC, and Ripple has frozen 40.54 million RLUSD and other tokens. Shenyu said that, based on on-chain data, the core issue points to the signing process; no smart contract vulnerability has been found so far, and Binance has not disclosed the specific cause of the private key leak or the exploitation of its signing system.

Source: TechFlow