Binance hack: when do the people behind it work? Part 3 of our profile.
We looked for a sleep window that would give away a time zone. There is none.
1. Preparation took about 36 hours. Gas came from Tornado Cash at 07:39 and 08:53 UTC Oct 28. On Oct 29: a first test contract at 02:28, tests on their own wallets from 13:51, the attack contract at 15:59, more gas at 18:20, the first theft at 20:04.
2. After the attack we logged 35 moves that look like human decisions: a first use of a new route, a test amount, a new recipient. Over 50 hours the longest pause between two of them was 4 hours.
3. They are not always quick. Tether froze their main hub at 21:01 UTC Oct 29. They still pushed $204M of USDT into it at 21:04 and 21:44, and switched to a new address only at 22:39.
So either a team in shifts or people who barely sleep. The chain gives no time zone, and we will not guess one.
Next: who they are.
We looked for a sleep window that would give away a time zone. There is none.
1. Preparation took about 36 hours. Gas came from Tornado Cash at 07:39 and 08:53 UTC Oct 28. On Oct 29: a first test contract at 02:28, tests on their own wallets from 13:51, the attack contract at 15:59, more gas at 18:20, the first theft at 20:04.
2. After the attack we logged 35 moves that look like human decisions: a first use of a new route, a test amount, a new recipient. Over 50 hours the longest pause between two of them was 4 hours.
3. They are not always quick. Tether froze their main hub at 21:01 UTC Oct 29. They still pushed $204M of USDT into it at 21:04 and 21:44, and switched to a new address only at 22:39.
So either a team in shifts or people who barely sleep. The chain gives no time zone, and we will not guess one.
Next: who they are.
