On-chain data shows that one of 50 authorisations submitted in a single transaction was approved by Binance's own wallet and installed a contract that drained $1.6bn in USDT and 167,464 ether in four minutes. At least $5.57bn left Binance-linked addresses in total.
Kaupr has reported on how Binance, in a separate article, was hit by a suspected theft in the billions on 29 October, and on how both Binance itself and stablecoin issuers Tether and Circle responded in the hours that followed. In the hours since, independent on-chain analysts have gone through the transaction data and reconstructed exactly how the money left Binance's wallets, and where it went next. Central to the explanation is EIP-7702, a 2025 Ethereum upgrade that lets an ordinary wallet temporarily attach code to itself and behave like a smart contract. The feature is meant to make transactions cheaper and simpler, but it requires a signature from the wallet's own private key – exactly the kind of signature that was used to drain it in this case.
According to an analysis from the account International Cyber Digest, based on on-chain data and findings from security firm Blockaid, whoever drained one of Binance's Ethereum wallets had 50 authorisations signed with the wallet's own private key. Under EIP-7702, such an authorisation is only valid for the wallet's next transaction number, known as its nonce. Because Binance's wallet was still sending transactions during the same period, that number kept moving. The sender didn't know which nonce would be live, so all 50 authorisations were submitted in a single transaction. One of them matched.
The authorisation that was accepted installed a contract on the wallet that, according to Blockaid, could only be operated by the sender's address – an address funded through the mixing service Tornado Cash. Minutes later, the contract drained the wallet of $1.6bn in USDT, 167,464 ether and more than 60 other tokens. How the sender obtained signatures from Binance's own key remains unknown; only that key, or the system holding it, can produce them.
On-chain data reported by, among others, The Defiant and International Cyber Digest shows that preparations began nearly two days before the sweep itself. The sender's address was funded with a withdrawal from Tornado Cash's 0.1 ETH pool on 28 October at 07:39 US Eastern time, followed by two similar withdrawals the same day and the following morning. On 29 October at 15:59, the sender deployed the contract that would later drain the wallet.
At 20:20:59 the same evening, the transaction carrying the 50 authorisations was sent, and one was accepted. Four minutes later, at 20:24, the contract pulled USDT, ether and the remaining tokens out of the Binance wallet. The attack didn't stop there: at 20:41, further calls through the same authorisation pulled $780 million in USDC from another Binance wallet, and at 21:44 a further $200 million in USDT was withdrawn from the original wallet.
The sweep wasn't confined to one wallet or one blockchain. Another Binance wallet on Ethereum sent 28,006 ether to the same recipient address during the same period, signed with its own key. At the same time, 18,270 bitcoin moved out of a Binance wallet on the Bitcoin network, and roughly $613 million in USDT on the Tron network was sent to new wallets. International Cyber Digest estimates that at least $5.57bn in total left Binance-linked addresses across Ethereum, Bitcoin and Tron, while the account Kairos_Res, which has tracked the fund flows address by address, puts the figure at around $5.0bn leaving Binance's hot wallets in under an hour.
In the hours after the sweep, Binance followed a set sequence of posts on X: at 17:16 US Eastern time, the company said it was investigating a possible security issue without confirming any impact on user funds; at 17:41, Binance.US said its own operations were unaffected; at 18:33, Binance said withdrawals would resume once the security issue was fully resolved and user funds were safe; and at 19:06, trading in its Alpha product was temporarily suspended pending the same resolution. The company has described user funds as "completely safe" without explaining how.
The stablecoin issuers have since frozen parts of the amount. According to Kairos_Res, Tether and Circle have together frozen around $2.1bn, including $313 million in USDT on Tron, while nothing has reached Tornado Cash. The Defiant reports that Circle has disclosed more than $800 million in frozen USDC and Tether more than $1.567bn in frozen USDT. Kairos_Res also puts roughly $718 million in ether and $500 million in USDT as still free to move, with 17,270 of the stolen bitcoin untouched.
Sources: International Cyber Digest, Kairos_Res, The Defiant, Blockaid, Blockscout
You have read what you can read for free. With an account you get unlimited access to all news and articles on kaupr.io — and become part of the network of investors, professionals and builders following onchain finance.