GodFish Reviews Binance Hack Incident: Attackers Conducted Two Rehearsals in Advance and Pre-Established a Transfer List for 64 Types of Tokens

on October 30, Cobo co-founder Shen Yu released a video reviewing the Binance theft from an on-chain transaction perspective. At 4:20 AM, the attacker broadcasted a transaction containing 50 authorization requests, signed with the private key of Binance's hot wallet, and began batch transferring assets approximately 3 minutes later.

Shen Yu noted that the attack involved the EIP-7702 authorization mechanism. The attacker prepared a transfer list covering 64 tokens in advance, conducted two drills using test wallets, with the final drill occurring approximately three and a half hours before the main operation. The attacker subsequently transferred assets via multiple wallets and smart contract wallets, exchanging some USDT and other stablecoins for ETH to evade issuer freezes.

Regarding asset freezes, Tether has frozen 1.38 billion USDT, Circle has frozen 823 million USDC, and Ripple has frozen 40.54 million RLUSD along with other tokens. Shen Yu stated that on-chain data indicates the signing process as the core issue. No contract vulnerabilities have been found to date, and Binance has not yet disclosed the specific cause behind the private key leak or the exploitation of the signature system.