How the Binance hack unfolded — preliminary timeline
Binance replenished 200 million USDT, and hackers swept it away in just 72 seconds
At 5:42 a.m. on October 30 (Beijing time), Binance transferred 200 million USDT from its own wallet, Binance 124, to the hot wallet Binance 14. But that wallet was already under the attackers’ control, and 72 seconds later, all 200 million had been transferred out.
Here’s what on-chain records show:
04:20, The attackers used EIP-7702 to set up delegation for Binance 14 and pre-signed 50 authorizations, one of which took effect
04:24, Binance 16 signed a transaction itself, transferring 55.74 million USDT to the attackers
05:42, Binance deposited 200 million USDT into the already-compromised Binance 14
05:44, The attackers swept away all 200 million, but Tether had already frozen the address
06:22 Binance suspended withdrawals; 17 minutes later, another 128 ETH and more than 50 types of tokens were swept from Binance 14
06:55 Binance began moving the remaining coins into cold wallets, but at 06:57, the attackers’ delegation was still active and had not been revoked
After the hack, 2,199 ETH were transferred into Binance 14, and 2,198 ETH were swept away; 206 million USDT came in, and 204 million was swept away.
The biggest question is that every authorization had to be signed with Binance 14’s private key, and Binance 16 also used its own private key to sign the outgoing transfer. This doesn’t look like someone was tricked into signing once; it looks more like the entire signing system was compromised.
Information compiled from on-chain data. Please refer to Binance’s official announcements.
Binance replenished 200 million USDT, and hackers swept it away in just 72 seconds
At 5:42 a.m. on October 30 (Beijing time), Binance transferred 200 million USDT from its own wallet, Binance 124, to the hot wallet Binance 14. But that wallet was already under the attackers’ control, and 72 seconds later, all 200 million had been transferred out.
Here’s what on-chain records show:
04:20, The attackers used EIP-7702 to set up delegation for Binance 14 and pre-signed 50 authorizations, one of which took effect
04:24, Binance 16 signed a transaction itself, transferring 55.74 million USDT to the attackers
05:42, Binance deposited 200 million USDT into the already-compromised Binance 14
05:44, The attackers swept away all 200 million, but Tether had already frozen the address
06:22 Binance suspended withdrawals; 17 minutes later, another 128 ETH and more than 50 types of tokens were swept from Binance 14
06:55 Binance began moving the remaining coins into cold wallets, but at 06:57, the attackers’ delegation was still active and had not been revoked
After the hack, 2,199 ETH were transferred into Binance 14, and 2,198 ETH were swept away; 206 million USDT came in, and 204 million was swept away.
The biggest question is that every authorization had to be signed with Binance 14’s private key, and Binance 16 also used its own private key to sign the outgoing transfer. This doesn’t look like someone was tricked into signing once; it looks more like the entire signing system was compromised.
Information compiled from on-chain data. Please refer to Binance’s official announcements.