# Review of the Binance theft: 50 EIP-7702 authorizations transferred about $5.8 billion in 3 minutes; suspected North Korean ties remain unconfirmed
- How it happened: According to an on-chain review by Cobo co-founder Shenyu, the attacker broadcast a transaction containing 50 authorization requests at 4:20 a.m. Beijing time on October 30. About 3 minutes later, they began transferring assets in batches across multiple chains, including Ethereum and Tron. Based on prices at the time, the total amount transferred was approximately $5.8 billion. A transfer list covering 64 tokens had been prepared in advance, and rehearsals were conducted twice using test wallets; the final rehearsal took place about 3.5 hours before the actual attack. The attacker also converted some USDT and other freezeable assets into ETH to evade freezes by issuers.
- The signing process is in focus: Based on an initial assessment by Blockaid CEO, the attack appears to have exploited signing infrastructure rather than directly stealing private keys. The 50 EIP-7702 authorizations were bundled into a single transaction targeting Binance's “14” hot wallet, delegating control to a sweeping contract. The method is highly similar to the February 2025 Bybit incident, and the tactics are linked to North Korean cyber operations. However, Binance has not officially confirmed the specific attack mechanism, and the attribution has not been officially verified.
- Funds are still moving: According to Arkham data, the attacker's wallet is moving assets through Uniswap and has borrowed at least 20,000 WETH (about $44 million) on Aave, using stolen USDT as collateral. Aave has frozen its lending market, saying the contracts themselves were unaffected and the position remains overcollateralized. Bybit clarified that it was not affected by this incident and that its systems, deposits, and withdrawals are operating normally.
- Current status and reminders: Binance deposits, withdrawals, and Alpha trading remain suspended, with no resumption time announced. BTC is around $78,000, and BNB around $699. The incident is still unfolding; figures for freezes and losses vary by source, so rely on Binance's official verified statements. Use only official channels and beware of scams claiming to “unlock funds.”
$BNB $BTC
#币安 #黑客攻击 #EIP7702
My assessment: I have a short-term bearish view on BNB, as the review of the attack points to unresolved risks in the signing process, and no timeline has been announced for restoring deposits and withdrawals. Sentiment will likely need an official post-incident report to recover.
Sources: ChainCatcher, citing Shenyu / Cobo's on-chain review; CoinDesk, citing Blockaid and Arkham data; CoinDesk live updates. The attack mechanism and attribution are preliminary assessments and have not been confirmed by Binance. For reference only; not investment advice.
What do you think the exchange should fix first: the signing process or hot-wallet permissions? Tap the tag to see real-time market data, and share your thoughts in the comments.
- How it happened: According to an on-chain review by Cobo co-founder Shenyu, the attacker broadcast a transaction containing 50 authorization requests at 4:20 a.m. Beijing time on October 30. About 3 minutes later, they began transferring assets in batches across multiple chains, including Ethereum and Tron. Based on prices at the time, the total amount transferred was approximately $5.8 billion. A transfer list covering 64 tokens had been prepared in advance, and rehearsals were conducted twice using test wallets; the final rehearsal took place about 3.5 hours before the actual attack. The attacker also converted some USDT and other freezeable assets into ETH to evade freezes by issuers.
- The signing process is in focus: Based on an initial assessment by Blockaid CEO, the attack appears to have exploited signing infrastructure rather than directly stealing private keys. The 50 EIP-7702 authorizations were bundled into a single transaction targeting Binance's “14” hot wallet, delegating control to a sweeping contract. The method is highly similar to the February 2025 Bybit incident, and the tactics are linked to North Korean cyber operations. However, Binance has not officially confirmed the specific attack mechanism, and the attribution has not been officially verified.
- Funds are still moving: According to Arkham data, the attacker's wallet is moving assets through Uniswap and has borrowed at least 20,000 WETH (about $44 million) on Aave, using stolen USDT as collateral. Aave has frozen its lending market, saying the contracts themselves were unaffected and the position remains overcollateralized. Bybit clarified that it was not affected by this incident and that its systems, deposits, and withdrawals are operating normally.
- Current status and reminders: Binance deposits, withdrawals, and Alpha trading remain suspended, with no resumption time announced. BTC is around $78,000, and BNB around $699. The incident is still unfolding; figures for freezes and losses vary by source, so rely on Binance's official verified statements. Use only official channels and beware of scams claiming to “unlock funds.”
$BNB $BTC
#币安 #黑客攻击 #EIP7702
My assessment: I have a short-term bearish view on BNB, as the review of the attack points to unresolved risks in the signing process, and no timeline has been announced for restoring deposits and withdrawals. Sentiment will likely need an official post-incident report to recover.
Sources: ChainCatcher, citing Shenyu / Cobo's on-chain review; CoinDesk, citing Blockaid and Arkham data; CoinDesk live updates. The attack mechanism and attribution are preliminary assessments and have not been confirmed by Binance. For reference only; not investment advice.
What do you think the exchange should fix first: the signing process or hot-wallet permissions? Tap the tag to see real-time market data, and share your thoughts in the comments.
