I went through the on-chain data on the $6.3B Binance hack. What most people are posting is WRONG, and the smartest part of this attack is getting no coverage…
The main drain took 24 SECONDS. Not 20 minutes. About $2.7B left two Binance Ethereum wallets in under half a minute.
How they got in:
Binance says a DevOps engineer's laptop "may" have been compromised. They also say there is no evidence a private key leaked. Both can be true, and that's the interesting part.
An EIP-7702 delegation needs a valid signature from the wallet. If you control a service container that is already authorised to request signatures, you never need the key. You just ask the signing service to sign for you. Same shape as Bybit, where attackers hit a developer machine at Safe.
The transaction itself:
A type-4 tx carrying 50 separate EIP-7702 authorizations, all for the Binance 14 hot wallet, all pointing at the same attacker contract.
Only ONE landed. Nonce range 18,914,775 to 18,914,824.
They didn't know the wallet's exact nonce, so they sprayed a range and let one hit. Blockaid caught this.
The part nobody is talking about:
Within 3 minutes the attacker supplied 60M USDT to Aave as collateral and borrowed 19,762 wETH against it. About $45M.
Tether froze the address right after. Aave froze the markets 46 minutes later.
TOO LATE. They had already turned freezable stablecoins into ETH nobody can touch. Marc Zeller confirmed the position is overcollateralised so Aave isn't out anything.
Where it stands:
Frozen, per ZachXBT: over $2.83B. Roughly 1,767M USDT, 823M USDC, 40.5M RLUSD, 27.8M USD1, 29,934 WBETH.
Still with the attacker: 197,460 ETH, about $436M, plus $122M across 15+ tokens including LINK, AAVE, WBTC and ONDO. Another $19.5M on Arbitrum and $24M on Avalanche.
The wallet was funded with 0.1 ETH out of Tornado Cash. The delegation was removed and the wallet's code was empty again by 01:20 UTC.
The number that actually matters:
$6.3B stolen, about $3B frozen. That's a $3.3B hole.
SAFU took in $1B of Bitcoin earlier this year. It covers less than a third. At least $2.3B comes out of Binance's own corporate balance sheet.
Withdrawals went down at 22:15 UTC, almost two hours after the drain started.
Watch for the updated Proof of Reserves. That's the only document that tells you what Binance actually has left.
#StrategySTRCReaches$99.95ForFirstTimeIn165Days #StrategySTRCReaches$99.95ForFirstTimeIn165Days #SwitzerlandFirstSpotBitcoinETFExpectedToTradeInNovember #StrategyReports$21BQ3OperatingProfit #StrategyReports$21BQ3OperatingProfit