172959228

Binance hack: this is what happened when we tried to hand our live trace to Binance. All times UTC.

Oct 30
13:25 We email compliance@binance.com. An auto-reply arrives the same minute: "Mailbox No Longer Active".
13:35 A support agent picks up ticket #172959228. At 13:40 it is escalated.
20:48 At support's request we file the trace on Binance's bug-bounty program at Bugcrowd. Overnight we add 12 updates.

Oct 31
03:15 The support chat points us to Bugcrowd again. By 03:47 it replies: "Team is already aware of this".
05:37 The report is closed as Not applicable: the program covers vulnerabilities only. That is its rule.
06:55 The bug-bounty triager names the right inbox: security@binance.com.
Then the support chat tells us the case is with the Security team.
07:27 We send the full trace to security@binance.com. Three follow-ups go out by 09:31 UTC.
No reply as of 11:55 UTC.

Meanwhile the attacker kept moving funds. The 507 fresh addresses where it parks ETH held 14,976 ETH at 22:53 UTC Oct 30 and 29,651 ETH at 09:23 UTC Oct 31.

What we do now: publish the trace in the open. Five posts since 08:53 UTC today: NEAR, the hub's token sales, the parked ETH, Chainflip refunds, the BTC branch. Next update when funds move.