Binance hack: The attacker rehearsed on their own wallets for 18 hours before going after Binance.

On October 29 at 02:28 UTC, they deployed the first version of their tool. At 13:51, they tested the EIP-7702 trick on two of their own wallets; at 15:59, they deployed the final version of the tool; and at 16:20, they did a full rehearsal on a third wallet. At 20:21, they used the same trick on Binance hot wallet No. 14. Every step was paid for with ETH from Tornado Cash.

Two details fit together to form the bigger picture. During the rehearsal, the tool left exactly 1 ETH after the withdrawal, and after the final drain, wallet #14 had 1.0 ETH left. Then, at 21:42:59, the Binance wallet funded wallet #14 with 200 million USDT. The attacker transferred the funds out 72 seconds later.