Shridlock

How Binance's hot wallet 14 was emptied, straight from the chain. At 20:21 UTC, about three minutes before the drain, an EIP-7702 delegation was set on the wallet, and only the wallet's own key can sign one. From then on the plain hot wallet ran someone else's code: a 1,674-byte contract at 0x63e8…6fae. It still does. At 20:24 an outside address, 0x7c86…5ca0, called the wallet once and took 63 tokens in that one transaction. It came back at 21:04 for 23 more, and at 21:44 for 14, including 200.4M USDT that landed in an already frozen wallet. Until the delegation is revoked, the door stays open. 94% of the Ethereum dollars are still pinned to wallets we can name. Follow for updates on the Binance trace.

Binance hack: the stuck bridge reopened at 15:38 UTC, and the attacker's 206K USDT landed straight in a frozen wallet. The USDT0 bridge from Tron to Ethereum had delivered nothing for 5.9 hours. Since it restarted, 56 transfers worth 7.47M USDT have landed. One of them was the attacker's 206,065.61 USDT, sent to an address Tether had blacklisted at 13:36 UTC, two hours before the money arrived. Follow for updates on the Binance trace.

Binance hack: 349 ETH that went into the attacker's wallets were bought by a Bitcoin wallet that had been moving money through Zcash since Oct 23. Before the hack that wallet made 31 swaps of BTC into Zcash, 56.5 BTC in net. Its Zcash address swapped with no one else and passed the coins to a relay that put them into Zcash's shielded pool. Since Oct 17 that relay has moved 6,528 ZEC into the pool from at least three such lanes. On Oct 29 at 16:10 UTC, about four hours before the hack, 127.95 ZEC came back out of the shielded pool and almost all of it was swapped into BTC. Those coins helped buy 151.6 ETH that reached the attacker's hub at 00:39 UTC. Follow for updates on the Binance trace.

Binance hack: the bridge the attacker used to move USDT off Tron has been stuck since 09:44 UTC. Not one USDT0 transfer from Tron to Ethereum has landed since then. 32 transfers worth 6.55M USDT wait in flight, the oldest for 4 hours, and 206K of them belong to the attacker. The other direction still works: 59 transfers from Ethereum to Tron went through. Before the stall the attacker got 4.12M USDT across and turned it into 1,884 ETH within minutes. Follow for updates on the Binance trace.

Binance hack: the attacker has sold all of its AVAX and parked the money in one fresh wallet. Between 11:41 and 12:36 UTC it sold 2.06M AVAX in 8 sales for 16.28M USDC. Each batch crossed to Ethereum on Circle's own bridge and was swapped into ETH within minutes. By 12:44 all 7,243 ETH sat in one wallet that has never sent a transaction. Circle froze none of it. Same habit as with its 511,854 ETH, which still sit untouched in eight wallets. Follow for updates on the Binance trace.

Binance hack: the attacker is selling its AVAX right now and turning it into ETH within minutes, through Circle's own bridge. Since 11:41 UTC it sold 1,608,876 AVAX for 12.80M USDC in 6 batches. Each batch crossed to Ethereum on Circle's bridge in under 18 seconds and was swapped into ETH less than 5 minutes after it landed. 5,697 ETH so far. Yesterday Circle froze 1.56M USDC on this same route 4 minutes after it landed. None of today's wallets is frozen. 0.44M AVAX are still waiting, now on two fresh wallets. Follow for updates on the Binance trace.

Binance hack: the attacker rehearsed on its own wallets for 18 hours before it touched Binance. On Oct-29 at 02:28 UTC it deployed a first draft of its tool. At 13:51 it tested the EIP-7702 trick on two of its own wallets, at 15:59 it deployed the final tool and at 16:20 it ran a dress rehearsal on a third wallet. At 20:21 it used the same trick on Binance's hot wallet 14. Every step was paid for with ETH out of Tornado Cash. Two details fit. In the rehearsal the tool's sweep left exactly 1 ETH behind, and wallet 14 was left with 1.0 ETH after its last drain. And at 21:42:59 a Binance wallet topped wallet 14 up with 200M USDT. The attacker sent it on 72 seconds later. Follow for updates on the Binance trace.

Binance hack: the attacker has already sold 80% of the TRX it took straight from Binance's Tron wallet, and it did it on Tron itself. 37.2M of the 46.4M TRX went through 730 swaps: 22.7M through an unlabeled swap router, 12.0M through SunSwap and 2.6M through the Symbiosis cross-chain router. Part of the USDT then crossed to Ethereum through the USDT0 bridge and was swapped into ETH within minutes of landing. One trade end to end: 600,000 TRX became 206,127 USDT at 09:42 UTC and left through the bridge at 09:44. Next in line: 518.2M TRX from its swapped stash sit in four fresh wallets, and the splitting wallet has already sent out 3.12M of the next 120M. Follow for updates on the Binance trace.

Binance hack: where the money is right now, across all 10 chains. Frozen, about $2.76B: $2.21B in USDT and USDC on Ethereum, $379M in USDT on Tron, $89.0M in tokenized gold, USD1 and FDUSD, $40.5M in RLUSD, $30.9M pulled back on Arbitrum and $14.6M in stablecoins on Avalanche and Polygon. Still with the attacker, about $3.09B: 18,270 BTC ($1.42B), 511,859 ETH ($1.14B) almost all in 8 wallets that never sent a transaction, 233.5M XRP ($292M), 637.2M TRX ($213M) and $29.1M on Base, Optimism, Avalanche and Polygon. Moving right now: between 10:15 and 10:20 UTC the attacker emptied its parked Tron stash, 638.2M TRX ($213M), into 5 wallets each created 3 seconds earlier. At 10:20 the first 120M went on to TRBdWq…2PRki, the wallet that has been splitting 46.4M stolen TRX across fresh wallets since 02:19. Solana's 970,554 SOL hasn't moved, and nothing on chain ties it to the hack. Follow for updates on the Binance trace.

Binance hack: the attacker hit nine chains in 28 minutes, then came back for more. The first move we can find was on the XRP Ledger at 20:05 UTC. Then Solana at 20:10, Base at 20:16, Optimism at 20:18, Bitcoin at 20:20, Ethereum and Tron at 20:21, Arbitrum at 20:30 and Avalanche at 20:33. Polygon came only at 23:05, in a second wave with Avalanche at 23:04 and Ethereum at 22:39 and 23:56. Also new: on the Ethereum hub, about $89M more is frozen in four other tokens. 12,574 XAUt (Tether Gold, about $50M) at 21:11, 27.8M USD1 (World Liberty) at 22:10, 1,907 PAXG (Paxos, about $7.6M) at 22:30 and 3.45M FDUSD (First Digital) at 00:46. Follow for updates on the Binance trace.

Binance hack: the attacker's hub took about $45M more on Base, Optimism, Avalanche and Polygon. Same address, 0x5227…2f8c. Base and Optimism were hit before Ethereum: at 20:16 UTC 4.74M VIRTUAL came from a wallet tagged Binance 73, at 20:18 44.2M OP from Binance 55. Neither has moved. On Avalanche it received 2.26M AVAX and 8.41M USDt from five wallets tagged Binance, drained to dust at 20:33–20:35 and 23:04. Tether blocked the USDt at 21:07, and the attacker's attempt to move it at 21:40 failed. 200,000 AVAX were swapped into 1.56M USDC and bridged to Ethereum. The USDC landed at 23:27 in a wallet with no ETH for gas, and Circle froze it at 23:31. On Polygon, 46.6M POL and 6.19M USDT0 arrived at 23:05 from Binance 48. The USDT0 is blocked too. Not frozen: 2.06M AVAX, 46.6M POL, 44.2M OP and 4.74M VIRTUAL, about $29M. Nothing has left these wallets since 22:00 UTC. Follow for updates on the Binance trace.

Binance hack: the attacker is moving 46.4M stolen TRX on Tron right now. At 20:21 UTC on Oct-29, 93 seconds before the 612.7M USDT, Binance's Tron hot wallet sent 46,384,098 TRX to the same attacker address. Tether froze 312.7M USDT there. It can't freeze TRX. At 00:06 the TRX went to a fresh wallet, TRBdWq…2PRki. Since 02:19 it has sent 21.4M TRX in 63 transfers to 17 wallets created today, and 16 of them have already passed it on. The latest transfer was at 07:41. 25.0M TRX are still on TRBdWq. The other Tron stash, 638.2M TRX from the USDT swaps, still hasn't moved. Follow for updates on the Binance trace.

Binance hack: the XRP Ledger was hit 16 minutes before Ethereum. A correction to our timeline: the earliest move we can find was not on Solana. At 20:05:00 UTC a wallet XRPScan labels Binance 6 opened a fresh account, rK21t6nG…gfzMx, with 185.0M XRP. By 20:09 four more Binance-labeled wallets had been emptied into it: 233,461,943 XRP, about $295M. It hasn't sent a single payment since. Then came Solana at 20:10 (link still unproven), Bitcoin at 20:20, Ethereum's hot wallet 14 at 20:21 and Tron at 20:22. Every first move was authorized by the Binance wallet itself. TRM Labs counts the same 233.46M XRP as stolen, and no issuer can freeze XRP. Follow for updates on the Binance trace.

Binance hack: the attacker has swept its sales into eight wallets. Since 05:15 UTC the hub and the last sellers have handed over their proceeds: 17,260 ETH from the hub to a fresh wallet, then 11,561 ETH from the LINK seller and 2,857 ETH from the WBTC seller into 0x79e7…544a. Eight wallets now hold 503,933 ETH, about $1.13B, and not one of them has ever sent a transaction. On Bitcoin, Binance now sweeps new deposits on its drained hot wallet into its known cold wallet 3M219…xRP6: 1,770 BTC since 23:16 UTC. Follow for updates on the Binance trace.

Binance hack: the attacker's hub is selling the rest of the bag. Since 01:14 UTC the hub 0x5227…2f8c has sent 31 coins into exchange pools in 558 transfers, among them SHIB, FET, 1INCH, EIGEN, CRV, IMX, LDO, PENDLE, APE and AXS. At 05:15 it moved the proceeds, 17,260 ETH, to a fresh wallet. The second-sweep wallet sold its own tokens for about 4,900 ETH more. This time some prices gave way while it sold. Against ETH since 01:14, CRV is down 10.9%, IMX 8.5%, OGN 7.5% and 1INCH 5.4%, while SHIB and FET held up. Meanwhile scammers spam the hub with lookalike addresses and fake ETH, hoping the attacker copies the wrong one. Follow for updates on the Binance trace.

Binance hack: Tether froze the attacker's Tron swap wallet 81 seconds after it emptied. 612.7M USDT left Binance's Tron hot wallet at 20:22 UTC. 300M of it moved on by 20:56, and Tether froze the first wallet at 21:09:12 with 312.7M still on it. The second wallet swapped about 232M USDT into TRX on Tron's exchange pools, sent its last 66M away at 21:16:18 and was frozen at 21:17:39. The 66M was caught at the next wallet at 21:21. The swap left 638.2M TRX, about $220M, in one wallet. No issuer can freeze TRX, and it hasn't moved. Follow for updates on the Binance trace.

Binance hack: where the money is right now, chain by chain. Frozen, about $2.65B: $2.2B in USDT and USDC on Ethereum, $379M in USDT on Tron, $40.5M in RLUSD, and $30M pulled by Arbitrum's Security Council. Still with the attacker, about $2.76B: 18,270 BTC (~$1.42B) in 19 wallets that never moved, 505,473 ETH (~$1.12B) in 12 wallets, and 638.2M TRX (~$223M) in one wallet, swapped from about 232M USDT on Tron. Solana's 970,545 SOL sits untouched, and nothing on chain ties it to the hack yet. Follow for updates on the Binance trace.

Binance hack: we traced the $1.4B in Bitcoin. Binance's hot BTC wallet bc1qm34l…j77s3h sent 18,270 BTC to a fresh address between 20:20 and 20:48 UTC and was left with 0.37 BTC. The first transfer sits in the block stamped 20:20, the same minute the Ethereum wallet's door opened. In the same blocks the coins were split across 19 new wallets: 17 got exactly 1,000 BTC, two got 832 and 438. None is on our map of exchange wallets, and not one has moved since 20:48 UTC. All 18,270 BTC is still pinned to wallets we can name. Follow for updates on the Binance trace.

Binance hack: how the attacker cashes out, one coin per wallet. The attacker's hub 0x5227…2f8c gives a fresh wallet about 0.5 ETH for gas and one stolen coin. The wallet sells it on Uniswap and PancakeSwap in small trades, then passes the ETH to a wallet that has never sent anything. Eleven coins are gone in full: UNI, ENA, PEPE, LINK, AAVE, WBTC, ONDO, WLD, ZRO, RSR and MORPHO. Add 48M RLUSD sold before its freeze and it comes to about 102,000 ETH, ~$225M. Most prices barely moved against ETH. RSR fell 8.6%. The ETH sits in eight wallets, 472,685 in all, about $1.04B. Only one has moved: the second-sweep wallet sent 3,000 ETH to a fresh address at 01:17 UTC and is now selling its 122 tokens. 97% of the Ethereum dollars are still pinned. Follow for updates on the Binance trace.

Binance hack: two doors shut on the attacker within two minutes. At 00:08:35 UTC Arbitrum's Security Council sent an emergency transaction against the attacker's wallet there, 0x3e2b…32d5. At 00:18:20 it landed: the wallet's 74.56M ARB, which left Binance at 20:30, and its 8,426 ETH, about $30M, were moved out to 0x0000…0da0. At 00:10:35 Binance's hot wallet 14 wiped the attacker's EIP-7702 delegation itself, signed with its own key. That came 14 minutes after one more grab: 2,962 ETH, about $6.6M, at 23:56:47. The door on wallet 14 stood open 3 hours 50 minutes, with five drains: 20:24, 21:04, 21:44, 22:39 and 23:56 UTC. 97% of the Ethereum dollars are still pinned. Follow for updates on the Binance trace.

Binance hack: the attacker holds a third of all SOPH in circulation. The tokens taken from Binance's hot wallet 14 include big slices of small coins. As of 23:58 UTC they sit unsold on 0x5227…2f8c and 0xa97b…8d10: SOPH 34% of all coins in circulation, $2.4M ERA 22%, $2.7M GTC 16.5%, $3.2M DENT 10%, $0.5M One stack is already on sale. At 23:28 UTC the attacker moved 715M FUN, 6.5% of all FUN, to a fresh wallet. Since 23:31 it has sold 1.5% of that stack in 42 small trades, for about 30 ETH. 97% of the Ethereum dollars are still pinned. Follow for updates on the Binance trace.