Binance Incident Full Review: Binance Hot Wallets on 8 Chains Hacked for $6.28 Billion

Author: Dickson (@DicksonWuML)
Compiled by: Deep Tide TechFlow

Deep Tide Guide: The theft of Binance's hot wallet is the biggest event in the crypto market today. CertiK engineer and SEAL member Dickson meticulously tracked the on-chain records, restoring the entire process from the attacker preparing to withdraw funds from Tornado Cash, authorizing the takeover of Binance's Ethereum hot wallet using EIP-7702, to freezing time with issuers like Tether and Circle. The amounts and times mentioned in the article are based on the author's on-chain statistics as of the posting time (approximately 8 AM Beijing time on October 30), with the time in UTC (+8 hours, which is Beijing time), and have not yet been confirmed by Binance.

Binance's hot wallet lost approximately $6.28 billion across 8 chains today. Of this, $6.07 billion was transferred within the first 55 minutes, after which the attacker repeatedly cleaned out one of the Ethereum wallets for over two hours.

Subsequently, Tether, Circle, Ripple, Paxos, World Liberty, and Binance have frozen approximately $2.8 billion. There remains about $3.27 billion that can be freely transferred, mainly in BTC and ETH.

I tracked the entire incident on-chain, including how the attacker transferred funds before the freeze 🧵

Source of the $6.28 billion (calculated at UTC 20:24 price):

• Ethereum $3.74 billion

• Bitcoin 18,270.2 BTC, $1.47 billion

• TRON 612.7 million USDT + 46.4 million TRX, $627.5 million

• XRP 233.5 million XRP, $296.5 million

• Solana 970,522 SOL, $96.1 million

• Arbitrum 8,426 ETH + 7.46 million ARB, $31.8 million

• Avalanche 1.81 million AVAX + 841,000 USDt, $24.3 million

• Optimism 44.2 million OP, $4.8 million

The $3.74 billion on Ethereum flowed out in five batches:

• 20:24:23, executed a sweep() on Binance 14: 167,464.25 ETH, 1.615 billion USDT, and 61 other tokens, totaling $2.53 billion

• 20:41 and 20:59, transferred 780 million + 43 million USDC from a Binance smart wallet trusted by Binance 14, totaling $822.6 million

• 20:24:47, Binance 16 signed 9 transfers directly to the attacker: 28,005.6 ETH, 57 million USDT, 25.9 million RLUSD, 84.5 WBTC, 820,000 UNI, 1,199 XAUt, 18.8 million ENA, 304,600 LINK, 583.6 billion PEPE, totaling $174.2 million

• 21:04 and 21:44, two additional sweeps on Binance 14: 2,070 ETH and 204.3 million USDT, totaling $209.6 million

• 22:39, the last sweep to a new wallet: 128.5 ETH and 122 small tokens, about $500,000

By asset: USDT $1.87 billion, USDC $822.6 million, ETH $457 million (197,668 ETH), RLUSD $88.5 million, wBETH $76.8 million, XAUt $50.5 million, UNI $49.6 million, ENA $44.7 million, PEPE $40.1 million, LINK $29.6 million, USD1 $27.8 million, plus about 50 smaller tokens.

Preparation began the day before. On October 28 at UTC 07:39, the attacker's main wallet 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 first withdrew 0.1 ETH from Tornado Cash, followed by two more withdrawals. Then a second wallet withdrew 1 ETH from Tornado and transferred it to the main wallet at 18:20 on October 29.

On October 29 at 02:28, they deployed a sweeper contract. From 13:51 to 16:47, they practiced on their own wallet: using EIP-7702 delegation, sweeping test USDT and USDC, then withdrawing. At 15:59, they launched a v2 version with a universal call function, which later transferred $822.6 million USDC.

At UTC 20:04:52, the first step failed. Binance's XRP wallet sent 42,750,000.1 RLUSD to the attacker, but the attacker's XRP account did not exist at that time, and the transfer was returned.

Eight seconds later, a transfer of 185,017,485.5 XRP was successful, creating the account. By 20:09, four other Binance XRP wallets were also emptied.

The chain reaction then unfolded:

20:10 Solana, a single transaction transferred 965,455.1 SOL

20:18 Optimism, 44.2 million OP

20:20 Bitcoin, 11 transactions transferred 18,270.2 BTC, splitting into 1,000 BTC each within the same block

20:20 to 20:22 TRON, 612.7 million USDT + 46.4 million TRX

20:30 to 20:35 Arbitrum and Avalanche

Ethereum revealed the attack method. At 20:20:59, the attacker issued a transaction carrying 50 EIP-7702 authorizations, all signed by Binance 14's private key, corresponding to nonce 18,914,775 to 18,914,824.

Binance 14 had just used 18,914,775 at 20:17:47, indicating that these authorizations were signed just minutes before use.

The authorization with nonce 18,914,809 matched. Binance 14 used 18,914,808 for its own transaction in the same block, meaning from this moment on, Binance 14 was running the attacker's code.

At 20:24:23, a sweep() transferred 167,464 ETH and 1.615 billion USDT. Twenty-four seconds later, Binance 16 signed 9 transfers directly to the attacker. At 20:41 and 20:59, the attacker used Binance 14 to transfer $822.6 million USDC from a trusted Binance smart wallet.

Next was a race against the freeze. The attacker quickly split USDT:

• 20:30, 500 million USDT transferred to 0x9749…c762. By 20:59, 325 million had been exchanged for ETH through RFQ market makers, and the remaining 175 million continued to be transferred out

• 20:33, 200 million USDT transferred to 0x0ddf…697e. About 10 million was sold on DEX, and 190 million transferred to 0x8d53…639a, which deposited 60 million into Aave and borrowed ETH with it

Tether's first blacklist took effect at 21:01:35: 0x5227, which contained 971 million USDT; and 0x9749, which had already been emptied. Circle froze the $822.6 million USDC at 21:04:59.

Some funds escaped in the final seconds:

• 21:01:59, 0x8d53 transferred 130 million USDT to 0x77ed…c3eb. Forty-eight seconds later, at 21:02:47, Tether froze 0x8d53

• 21:04 to 21:06, 0x77ed sold about 50 million USDT on DEX and transferred 80 million to 0x7aa4…bfd1

• 21:08 to 21:11, 0x7aa4 sold about 50 million and transferred the last 30 million out. When Tether froze 0x7aa4 at 21:12:35, it had already been emptied

• 21:16:11, 0xccbe…a263 transferred out the 30 million. Thirty-six seconds later, Tether froze 0xccbe and intercepted the 30 million at 21:18:59 at 0xb171…c8c3

• 175 million transferred from 0x9749 has been stuck at 0xaa24…54a0 until Tether froze it at 21:14:59.

In total, of the 1.875 billion USDT on Ethereum, about 435 million was sold before being blacklisted. 1.38 billion has been frozen, and 60 million is trapped as collateral on Aave.

Actions from other issuers, in chronological order:

• 20:57:47 World Liberty blacklisted 48.5 million WLFI from 0x5227.

• 21:07:55 Tether froze 8.41 million USDt on Avalanche. The attacker attempted to transfer at 21:40:47, transaction rolled back.

• 21:09 to 21:21 Tether froze 378.7 million USDT across three wallets on Tron. Previously, 234 million was swapped for TRX via SunSwap.

• 21:11:23 Tether froze 12,574 XAUt (approximately 50 million USD).

• 22:00:59 Ripple froze RLUSD. The attacker had transferred it to 0xe702…958d at 21:33 and sold 48 million for ETH, with the last sell order and freeze occurring in the same block. 40.5 million was intercepted.

• 22:10:35 World Liberty froze 27.8 million USD1.

• 22:30:47 Paxos froze 1,907 PAXG.

• 22:48:35 Binance blacklisted 29,934 wBETH (approximately 75 million USD), the attacker had previously transferred it to 0x7f9d…15e3 at 21:52.

345 million FDUSD from First Digital is still transferable.

Binance 14 has been in a state of being entrusted to the attacker's contract, leading to a tug-of-war:

• 21:04 and 21:44, the attacker swept again: first 1,700 ETH, then 370 ETH and 200.4 million USDT. This USDT fell into 0x5227, which has been frozen by Tether.

• 22:06:23, Tether blacklisted Binance 14 itself. USDT transfers sent from this address by Binance failed at both 22:15 and 23:01.

• 22:39, the attacker swept again, this time transferring to a new wallet: 128.5 ETH and 122 small tokens.

• 22:55 to 23:07, Binance emptied Binance 14: 46 token transfers to Binance 8, approximately one every 12 seconds.

• 23:36 to 23:38, the attacker called sweep() four more times, all four attempts failed.

Outside of Ethereum:

• Arbitrum, 21:35 to 21:38: All 8,426 ETH and 74.6 million ARB transferred to a new wallet 0x3e2b…32d5, which authorized ARB for trading at 21:41. Still in place as of 23:50.

• Avalanche, 21:45:34: 1,813,999 AVAX transferred to 0x8035…c397. Subsequently, 200,005 AVAX was transferred out from 0xc39e…9824, and at 23:27:35 the same address received 1,563,812.78 USDC via Circle's CCTP cross-chain bridge on Ethereum. Four minutes later, at 23:31:59, Circle blacklisted it.

• Funds on Bitcoin, XRP, Solana, and Optimism have not moved. BTC is distributed across 19 wallets, with 17 holding exactly 1,000 BTC each.

As of approximately 23:50 UTC, the status is:

Frozen, approximately 2.8 billion USD

• 1.38 billion USDT on Ethereum, 378.7 million on Tron, 8.41 million on Avalanche (Tether)

• 824.6 million USDC (Circle)

• 40.5 million RLUSD (Ripple), 27.8 million USD1 (World Liberty), 12,574 XAUt (Tether), 29,934 wBETH (Binance), 1,907 PAXG (Paxos), 48.5 million WLFI

Unfrozen, approximately 3.27 billion USD

• 18,270 BTC, 1.42 billion USD

• 458,770 ETH distributed across 9 wallets, 1.03 billion USD

• 233.5 million XRP, 289 million USD

• 684.6 million TRX, 243 million USD

• Approximately 136 million USD in other tokens on Ethereum

• 970,500 SOL, 93 million USD, plus ARB, AVAX, and OP, approximately 48 million USD

Additionally, 60 million USDT is trapped as collateral on Aave.

Note: Transfers on BTC, XRP, and Tron are linked through time and transaction fingerprints: same time period, brand new receiving addresses, and different fees and transaction formats compared to Binance's own withdrawals. The stolen amount is calculated based on the price at UTC 20:24; the current holdings are calculated based on the price at approximately UTC 23:50.

Each transaction and the on-chain proof of the freeze are attached in the post below. If you find anything I missed, feel free to let me know!