mothy.eth

ok safe to say binance is pwned The biggest assets were approximately: • 1.615B USDT • 62.6M RLUSD • 29,934 wBETH • 11,372 XAUt • 6.19M UNI • 198.4M ENA • 7.175T PEPE • 27.8M USD1 • 2.26M LINK • 127,853 AAVE about $2.5B at the explorer’s prices. 1. The attacker deployed a delegate contract, 0x63e842b0...73e9c6fAe, from the relayer at 15:59 UTC. 2. About four hours later, the relayer submitted an EIP-7702 authorization transaction That installed the malicious 7702 delegate code on Binance 14. 3. The relayer then made a call to Binance 14, executing the delegate code, and transferring Binance 14’s ETH and token balances. 4. The calldata is labeled sweep(address, address[]). The second argument is a list of recognizable token-contract addresses plus the zero-address (eth). 5. The same relayer later used the same delegate to move 780M USDC from Binance Hot Wallet 34 into the same pool • The relayer 0x7C... was funded by three Tornado Cash 0.1 ETH withdrawals over the prior two days. • The same pool also received 28,005.6 ETH from Binance 16 24 seconds after the main sweep. • The pool then forwarded 195,460 ETH to a fresh, unlabeled EOA • That EOA has only one transaction and currently holds the 195,460 ETH. What's a bit unclear is why the relayer was needed in the first place. If they had the private keys to the Binance wallets, they could have just sent the assets out in an atomic bundle without needing a relayer at all. So it seems likely that they didn't have the private keys and instead just had the 7702 auth signatures, which must have been phished somehow. I think we can go ahead and assume DPRK.

Last month, the contracts powering Magic Eden were exploited to the tune of millions of dollars. I was lucky enough to be in a position to rescue a good portion of that, but it highlighted the danger of leaving approvals open as adversaries get access to better and better tools for finding holes in contract logic. Today, Blur announced that they will be deprecating their frontend. I've investigated Blur and found no exploits within the current contracts. However, the Blur contracts are upgradable, meaning that they could turn malicious at any time. They currently have eight figures worth of NFTs approved to them. The safety of those NFTs effectively hinges on the opssec of the Blur team, which appears to be disbanding at this time. If you have open approvals to Blur, I recommend you remove them immediately. Use revoke.cash or similar to ensure that you are protected in case of a contract exploit or later upgrade. Don't wait. The time is now.