Shenyu Discloses Details of Binance Hack: Attackers Rehearsed Hours in Advance, Moved Massive Assets in 3 Minutes
Odaily — Cobo co-founder Shenyu released a video analyzing the suspected Binance hack from an on-chain perspective. Shenyu stated that at 4:20 AM on October 30, the attacker broadcast a transaction containing 50 authorization requests, and approximately 3 minutes later began transferring assets in bulk across multiple chains including Ethereum and Tron. Based on token prices at the time, the total value of transferred assets was approximately $5.8 billion.
The attacker exploited the EIP-7702 authorization mechanism to execute the asset transfers. A transfer list covering 64 types of tokens had been prepared in advance, and two rehearsals were conducted using test wallets, with the final rehearsal taking place approximately 3.5 hours before the actual attack. During the attack, the attacker also converted some freezeable assets such as USDT into ETH to circumvent issuer freeze measures.
Shenyu disclosed that as of now, Tether has frozen 1.38 billion USDT, Circle has frozen 823 million USDC, and Ripple has frozen 40.54 million RLUSD and other tokens. Of the approximately $3.75 billion in assets transferred on the Ethereum chain, about $2.4 billion has been frozen; of the approximately $630 million in assets transferred on the Tron chain, about $380 million has been frozen.
Shenyu believes that based on on-chain data, the core issue in this incident may lie in the signing process, and no contract vulnerabilities have been found so far. Whether it was private key leakage or exploitation of the signing system remains to be further confirmed by Binance. He also reminded that all trading platforms should investigate whether their signing systems carry the risk of signing unexpected authorizations.
Note: The approximately $5.8 billion mentioned in the original text is the estimated total value of multi-chain transferred assets based on token prices at the time, and is not the confirmed final loss from the hack.
