Binance hack: the attacker rehearsed on its own wallets for 18 hours before it touched Binance.
On Oct-29 at 02:28 UTC it deployed a first draft of its tool. At 13:51 it tested the EIP-7702 trick on two of its own wallets, at 15:59 it deployed the final tool and at 16:20 it ran a dress rehearsal on a third wallet. At 20:21 it used the same trick on Binance's hot wallet 14. Every step was paid for with ETH out of Tornado Cash.
Two details fit. In the rehearsal the tool's sweep left exactly 1 ETH behind, and wallet 14 was left with 1.0 ETH after its last drain. And at 21:42:59 a Binance wallet topped wallet 14 up with 200M USDT. The attacker sent it on 72 seconds later.
Follow for updates on the Binance trace.
On Oct-29 at 02:28 UTC it deployed a first draft of its tool. At 13:51 it tested the EIP-7702 trick on two of its own wallets, at 15:59 it deployed the final tool and at 16:20 it ran a dress rehearsal on a third wallet. At 20:21 it used the same trick on Binance's hot wallet 14. Every step was paid for with ETH out of Tornado Cash.
Two details fit. In the rehearsal the tool's sweep left exactly 1 ETH behind, and wallet 14 was left with 1.0 ETH after its last drain. And at 21:42:59 a Binance wallet topped wallet 14 up with 200M USDT. The attacker sent it on 72 seconds later.
Follow for updates on the Binance trace.
