The complete attack chain behind the Binance hack, all based on raw on-chain data.
At 20:21 UTC, a transaction handed control of Hot Wallet 14 to the attacker’s contract.
The attacker had obtained 50 sets of EIP-7702 authorizations signed with Binance’s private key in advance, covering consecutive nonces from 18,914,775 to 18,914,824.
Unable to predict the wallet’s current nonce, he broadcast them all in a batch. One happened to match, and the authorization took effect.
The key question: How did the attacker get these signatures?
The initiating address, 0x7c86…5ca0, is now labeled “Binance Hot Wallet Exploiter” on Etherscan. It sent all three sweeping transfers.
Gas funds had been prepared via Tornado Cash well in advance: three withdrawals from the 0.1 ETH pool. The first was at 07:39 UTC on October 28—37 hours before the attack—laying the groundwork ahead of time.
So far, 94% of the stolen ETH remains locked in the attacker’s address. We’ll keep a close eye on updates from Binance’s tracking team.
At 20:21 UTC, a transaction handed control of Hot Wallet 14 to the attacker’s contract.
The attacker had obtained 50 sets of EIP-7702 authorizations signed with Binance’s private key in advance, covering consecutive nonces from 18,914,775 to 18,914,824.
Unable to predict the wallet’s current nonce, he broadcast them all in a batch. One happened to match, and the authorization took effect.
The key question: How did the attacker get these signatures?
The initiating address, 0x7c86…5ca0, is now labeled “Binance Hot Wallet Exploiter” on Etherscan. It sent all three sweeping transfers.
Gas funds had been prepared via Tornado Cash well in advance: three withdrawals from the 0.1 ETH pool. The first was at 07:39 UTC on October 28—37 hours before the attack—laying the groundwork ahead of time.
So far, 94% of the stolen ETH remains locked in the attacker’s address. We’ll keep a close eye on updates from Binance’s tracking team.
