Rezo🛡₿RRR

Play-by-play breakdown of how the Binance hack progressed and what assets were hit

The $6.3b Binance Hack: A Step-by-Step Breakdown TL;DR > Hot wallets drained ACROSS TEN BLOCKCHAINS > A DevOps laptop was the entry point > No evidence of a private key leak According to Binance’s preliminary account, it all started with a compromised DevOps engineer’s laptop. The attacker used it to access an internal service container and gained the ability to initiate withdrawals. So far, the exchange has found no evidence of a private key leak. The first transfers began around 20:05 UTC. According to TRM Labs, the attack affected 10 networks: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. @banteg and @0xQuit analyzed the Ethereum side of the attack. It used EIP-7702, a mechanism introduced in the Pectra upgrade that allows a regular wallet to execute smart contract code. This requires a valid signature from the wallet. The attacker obtained 50 signed authorizations with sequential nonces - the values of the wallet’s transaction counter. This allowed the attacker to match the required nonce while Binance’s hot wallet continued processing withdrawals. At 20:20, delegation to a malicious contract was activated on Binance 14. Three minutes and 24 seconds later, 167,464 ETH and 63 different ERC-20 tokens were withdrawn from it, including 1.615b USDT. The main collection address was 0x5227…2f8c. It also received funds from other Binance wallets. Through a linked smart account, the attacker also withdrew 823m USDC. Meanwhile, ordinary transactions with valid signatures were used on the other nine networks. This is why TRM links the incident to a compromise of the shared signing system. Conversion came next. Tokens were sent from the main address to additional wallets and sold, with the resulting ETH transferred onward. According to TRM, around 325m USDT was swapped for 122,300 ETH through UniswapX and other order execution systems. That works out to roughly $2,650 per ETH, against a market price of $2,300–$2,350. In other words, the hacker was buying ETH well above market price. This created an arbitrage opportunity: buy ETH more cheaply and use it to fill one of those orders. For the attacker, the premium may have been the price of speed: USDT can be frozen by its issuer. Around 21:00, one of the linked wallets also deposited 60m USDT into Aave and borrowed 19,762 WETH. Here, lending was involved; we’ll break that down in more detail in part two. The freezes began at 21:01. Tether froze approximately 971m USDT at the main address. A few minutes later, Circle froze the 823m USDC held there. But Binance 14’s delegation remained active. What’s more, around 21:43, the wallet received another 200m USDT. A minute later, the attacker transferred those funds to their already blacklisted address, where they too were frozen. By 22:22, Binance had announced a halt to withdrawals. Soon afterward, @elonmusk also commented on the news: “Everyday is Zeroday.” Binance 14’s delegation was only revoked at 00:10 - almost four hours after it had been activated. At 00:18, an emergency action by the Arbitrum Security Council was executed: around 8,426 ETH and 74.56m ARB were moved from wallet 0x3E2b…32d5 to a blacklisted address. By morning, the publicly reported breakdown of frozen assets was as follows: - Tether: approximately 1.768b USDT and 12,574 XAUT. - Circle: approximately 825m USDC. - Ripple: 40.54m RLUSD. - World Liberty Financial: 27.82m USD1 and, according to Yi He, 48m WLFI. - Binance: 29,934 wBETH. - Paxos: approximately 1,907 PAXG and 215,658 USDP. - First Digital: approximately 3.5m FDUSD. - Also: 6.186m USDT0 and 819,821 XUSD. - Arbitrum: the ETH and ARB mentioned above. These figures were recorded at different times and do not provide a complete reconciliation with the official $3b figure. The frozen funds have yet to be returned, so it is too early to calculate the final loss. Binance has pledged to cover losses through SAFU and its own funds. The effects were also visible on the exchange itself. According to GSR, during the morning, the spread between the best bid and ask on Binance widened to five times its usual level for BTC and 2.5 times for ETH. Spreads later began to narrow. And there was even more to the token sales themselves: sandwich attacks, execution losses, lending, and strange movements between wallets. More on that, with links, in the full article.

I will be moderating a talk on Cross-Border Financial Innovation: Defining What the Region Can Test Together at GFTN @gftn_official on October 27 in Tbilisi with: - Akhundov Sadig, Executive Director, Central Bank of the Republic of Azerbaijan (@Central_Bank_AZ) - Davit Kikvidze, Chairman, FinTech Association of Georgia - Kyrylo Khomiakov (@KhomiakovKyrylo), Regional Head of CIS, Central Asia and Africa, @binance - Larisa Manastirli, Director of Financial Institutions, @BSTDB - Lucas Yang (@LuuuucasY), Head of Sales & Solutions, @Cobo_Global - Nika Kiladze, CEO, Keepzme - Uyasakh Jargalsaikhan, Director of the Payment Systems and Technology Department, Bank of Mongolia (@Mongolbank_mn) - Tamta Ivanishvili, Partner & CEO, BLC Law Office Dr. Vin Pheakdey, Deputy Director General, Securities and Exchange Regulator of Cambodia Good to have regulators, development banks, and operators in the same room. Let's figure out together what can actually move across the corridor.