Guys, I woke up and the sky had fallen—Binance’s hot wallets were hacked, with losses exceeding $5.8 billion.
Last night (early this morning Beijing time), Binance’s hot wallets were drained. After funding through Tornado Cash, the hacker used the new EIP-7702 mechanism to obtain signatures from the private key of Binance 14’s hot wallet, delegate it to their own contract, and then sweep out between $3.3 billion and $5.8 billion in assets in about 40 minutes. ETH, USDT, USDC, and BTC were involved, across multiple chains.
This wasn’t a smart contract vulnerability. Binance’s underlying signing infrastructure (the HSM/MPC setup) was most likely compromised. The hacker didn’t obtain the plaintext private key; instead, they broke into the policy engine or signing interface and gained the ability to “sign on demand.”
• They submitted 50 consecutive-nonce EIP-7702 signatures all at once, essentially “taking blind shots.” If they’d actually stolen the private key, they wouldn’t have needed to do that.
• Just 24 seconds after Binance 14 was drained, hot wallets on different chains using different signing algorithms—including Binance 16, Bitcoin (over 18,000 BTC), and Tron—were almost simultaneously compromised. That would only be possible by breaching the centralized top-level orchestration system.
Even more troubling, the hacker had been lurking for at least 37 hours. They first withdrew gas from Tornado Cash, then used $7 million in stablecoins to conduct a “live-fire rehearsal” of the EIP-7702 sweep. Only after the rehearsal did they make their move. In the main attack, Bitcoin was hit first, then Ethereum used EIP-7702 to drain Binance 14 in a single transaction (167,000 ETH + $1.6 billion in USDT, among other assets), and also drained Binance 34, which Binance 14 administered.
Tether and Circle moved pretty quickly on the stablecoin front and have already frozen around $1.8–2.5 billion.
The timing makes it even worse. U.S. tech stocks have already been struggling these past few days, with AI concerns, middling earnings, and a hawkish Fed weighing heavily on risk appetite. BTC was already hovering around $80,000; this news sent it straight down to around $78,000–$79,000. BNB also fell 7–9%, and liquidations intensified.
I’d recommend not buying the dip right now.
This hasn’t been fully resolved yet. Deposits and withdrawals are still suspended, funds are still moving, and the macro picture hasn’t stabilized either. Trying to catch a falling knife now could easily leave you exposed to another sell-off. There’s no harm in waiting until the official post-mortem is out, deposits and withdrawals resume, and the market genuinely stabilizes.
Don’t rush into anything. Keep your powder dry. I’ll post an update if there’s any news.
#BTC
Last night (early this morning Beijing time), Binance’s hot wallets were drained. After funding through Tornado Cash, the hacker used the new EIP-7702 mechanism to obtain signatures from the private key of Binance 14’s hot wallet, delegate it to their own contract, and then sweep out between $3.3 billion and $5.8 billion in assets in about 40 minutes. ETH, USDT, USDC, and BTC were involved, across multiple chains.
This wasn’t a smart contract vulnerability. Binance’s underlying signing infrastructure (the HSM/MPC setup) was most likely compromised. The hacker didn’t obtain the plaintext private key; instead, they broke into the policy engine or signing interface and gained the ability to “sign on demand.”
• They submitted 50 consecutive-nonce EIP-7702 signatures all at once, essentially “taking blind shots.” If they’d actually stolen the private key, they wouldn’t have needed to do that.
• Just 24 seconds after Binance 14 was drained, hot wallets on different chains using different signing algorithms—including Binance 16, Bitcoin (over 18,000 BTC), and Tron—were almost simultaneously compromised. That would only be possible by breaching the centralized top-level orchestration system.
Even more troubling, the hacker had been lurking for at least 37 hours. They first withdrew gas from Tornado Cash, then used $7 million in stablecoins to conduct a “live-fire rehearsal” of the EIP-7702 sweep. Only after the rehearsal did they make their move. In the main attack, Bitcoin was hit first, then Ethereum used EIP-7702 to drain Binance 14 in a single transaction (167,000 ETH + $1.6 billion in USDT, among other assets), and also drained Binance 34, which Binance 14 administered.
Tether and Circle moved pretty quickly on the stablecoin front and have already frozen around $1.8–2.5 billion.
The timing makes it even worse. U.S. tech stocks have already been struggling these past few days, with AI concerns, middling earnings, and a hawkish Fed weighing heavily on risk appetite. BTC was already hovering around $80,000; this news sent it straight down to around $78,000–$79,000. BNB also fell 7–9%, and liquidations intensified.
I’d recommend not buying the dip right now.
This hasn’t been fully resolved yet. Deposits and withdrawals are still suspended, funds are still moving, and the macro picture hasn’t stabilized either. Trying to catch a falling knife now could easily leave you exposed to another sell-off. There’s no harm in waiting until the official post-mortem is out, deposits and withdrawals resume, and the market genuinely stabilizes.
Don’t rush into anything. Keep your powder dry. I’ll post an update if there’s any news.
#BTC
