Binance hack, part 2 update: we checked TRM's count of ten chains, transaction by transaction. It holds.
Binance wallets that sent funds to the attacker on Oct 29, by first transfer (UTC):
XRP, five wallets, from 20:04
Solana, 20:10
Base, 20:16
Optimism, 20:18
Tron, 20:20
Bitcoin, 20:20
Ethereum, two wallets, 20:24
Arbitrum, four wallets, from 20:30
Avalanche, four wallets, from 20:33
Avalanche again and Polygon at 23:04 to 23:06
All of them were plain signed transfers, except Binance 14 on Ethereum, which used an EIP-7702 delegation. The second Ethereum wallet shows it was not needed to take money: it sent 28,006 ETH, 55.7M USDT and 25.9M RLUSD with ordinary transfers. What the delegation gave them was standing access: they pulled from Binance 14 again at 21:04, 21:44, 22:39 and 23:36 to 23:56, until Binance revoked it at 00:10 UTC Oct 30.
Part 2 counted six wallets on four chains. That was only what we had checked then.
Binance wallets that sent funds to the attacker on Oct 29, by first transfer (UTC):
XRP, five wallets, from 20:04
Solana, 20:10
Base, 20:16
Optimism, 20:18
Tron, 20:20
Bitcoin, 20:20
Ethereum, two wallets, 20:24
Arbitrum, four wallets, from 20:30
Avalanche, four wallets, from 20:33
Avalanche again and Polygon at 23:04 to 23:06
All of them were plain signed transfers, except Binance 14 on Ethereum, which used an EIP-7702 delegation. The second Ethereum wallet shows it was not needed to take money: it sent 28,006 ETH, 55.7M USDT and 25.9M RLUSD with ordinary transfers. What the delegation gave them was standing access: they pulled from Binance 14 again at 21:04, 21:44, 22:39 and 23:36 to 23:56, until Binance revoked it at 00:10 UTC Oct 30.
Part 2 counted six wallets on four chains. That was only what we had checked then.
