The Binance hot-wallet drain, traced live

This was not a bug in a smart contract. Someone was able to make Binance's own keys sign. Binance 14 (0x28C6…1d60), one of the exchange's largest Ethereum hot wallets, signed fifty EIP-7702 authorizations, one for each nonce from 18,914,775 to 18,914,824. Each one says: this account now runs the code at 0x63e8…6fAe, a contract the attacker wrote.

An EIP-7702 authorization is not a transaction. It is a signature over a short message that hands an ordinary account a program to run. Binance 14 sends several transactions a minute, so its next nonce was a moving target. The attacker submitted all fifty at 20:20:59 UTC and the one for nonce 18,914,809 matched. From then on, anything the attacker sent to Binance 14 ran the attacker's code as Binance 14.

Three and a half minutes later one call, sweep, sent everything Binance 14 held to the attacker's receiving wallet, leaving exactly 1 ETH behind: 167,464 ETH and 63 tokens, about $2.5 billion. A second function, callExecute, made Binance 14 instruct a Circle smart account it owns, which then paid out 823 million USDC.

The attacker rehearsed all of it on mainnet first. Hours before, two test wallets were delegated with the same many-nonces trick and swept, and a third was used to check that the sweep leaves exactly 1 ETH behind. The first version of the contract had no callExecute; it was added at 15:59 UTC, which means the attacker already knew which accounts Binance 14 controls.

Inference, labelled as such.

• The signatures were made live. The lowest nonce in the signed range was Binance 14's own nonce at about 20:17:40 UTC, three minutes before the authorizations landed. They were not an old leak.
• A transaction policy may not have recognised what it signed. Rules that watch transactions (who receives, how much, how often) look at transactions. An authorization is a different message, and one of them hands over the whole account.
• It reached more than one key. Binance 16 on Ethereum and four high-volume wallets on Avalanche sent ordinary, signed withdrawals to the same attacker address within eleven minutes. A delegation on Binance 14 cannot produce those, so the reach was into the shared signing or withdrawal system.
• It was prepared. The attacker's wallets were funded through Tornado Cash from 28 October, 07:39 UTC, about 37 hours before the drain.

• "1.2 billion USDT to three addresses" was 700 million to two. The third "500 million USDT" was a fake token named USDΤ, with invisible characters and a Greek letter, emitted by address-poisoning bots that targeted the thief.
• The 780 million USDC "from Hot Wallet 34" came from a Circle smart account owned by Binance 14, drained through it. A second pull of 43 million followed at 20:59 UTC.
• Circle froze 823 million USDC at 21:04:59 UTC, which early coverage did not report.

• Bitcoin: about 16,700 BTC were reported leaving Binance for new wallets. No addresses were published, so this page does not trace them.
• Arbitrum: 8,426 ETH reached the attacker's address there. The sender has not been identified.
• Avalanche: the four sending wallets are taken to be Binance's from how many transactions they have sent (892,000 to 5.1 million). No explorer label was checked.
• The labels "Binance 14" and "Binance 16" come from block-explorer tags. This page checks what those wallets did, not who owns them.