How Binance Was Hacked: The $6.3 Billion Attack Setup

On 28 and 29 October, ~1.48 ETH was transferred from a cluster of related addresses through two Tornado Cash pools, 0.1 ETH and 1 ETH. In the graph we are looking at there are a total of six withdrawals.

The wallet is of particular interest:
0x7c8601d4645b93cea45f71e118a729332e6b5ca0

It fetched about 1.3763 ETH. Some of the transfers came directly from Tornado Cash, while others passed through an intermediary address.

AML Crypto Graph: Funding and Preparation:

A further branch emerges in the diagram. One of the wallets gets ETH from Tornado Cash, interacts with MetaMask contracts, and then sends small amounts of ETH, USDT and USDC to several addresses. Then some of the tokens are merged into one wallet.

This seems to be a test of the addresses and token routing paths depending on the nature of the transfers. The amounts are small and the sequence of operations is quite characteristic: funding, distribution and reverse consolidation.

We cannot, however, yet factor these transactions as proof positive of a future exploit. The graph itself shows movement of funds not the intentions of the wallet owners.

But when we looked at the smart contract code, we found something far more interesting.

According to the timeline under investigation, the contract was deployed on October 29 at 15:59 UTC:

0x63e842B054Bd624a465454D533C33F573e9c6fAe

Contract Address Etherscan

The reconstructed Solidity code has a variable `authorizedCaller` set to the address:

0x7C8601d4645b93cea45F71e118A729332e6B5CA0

This is the same wallet that we tracked on the funding graph.

The contract has the onlyAuthorized modifier . It looks at who is calling the function. If the address is not the same as `msg.sender` execution is aborted with a `NotAuthorized()` error.

This was a direct connection: the address later turned out to be the only authorised operator of the fund withdrawal functions in this contract, pre-funded through Tornado Cash.

The second interesting piece of code is the function `sweep()`.

The function takes two parameters: recipient address `to` and an array of tokens `tokens`.

If array contains `address(0), code handles ETH. It checks the balance and sends the receiver anything above 1 ETH.

For ERC-20 tokens, the mechanism is different: the contract calls balanceOf() and gets the balance of tokens, then tries to transfer the whole amount with transfer().

Individual transfer errors are reported to the `SweepItemFailed` event. This allows other assets to continue to be processed even if one of the operations fails.

This function is not a vulnerability in Ethereum. The problem comes when a wallet that holds other people's assets is given the ability to execute it.

How EIP-7702 works

EIP-7702 allows a regular Ethereum address (EOA) to delegate code execution to another contract.
In this case the wallet address does not change and the funds are still on its balance. The logic it can run is what changes.

In our case, we are referring to the Binance 14 hot wallet.

0x28C6c06298d514Db089934071355E5743bf21d60

If this address calls contract 0x63e842…6fae to execute, the function sweep() is executed within Binance 14 itself.

`address(this)` in the code is referring to the balance of the Binance wallet and not the balance of the contract specified by the delegation. That is exactly why.

There is a single mandatory condition, though: such a delegation must have a valid signature of the wallet owner.

Deploying the contract and just putting in the Binance address is not enough.

Here we enter upon the most complicated part of the inquiry.

The initial version said attackers may have accessed a device of a DevOps engineer and related internal Binance services.

If this theory is right, it would explain how the attackers could make transactions for the hot wallets.
But it’s not clear what exactly was compromised, be it private keys, the transaction signing process or some other part of the infrastructure.

And this is a major distinction.

The blockchain allows you to check the validity of a signature and to see the result of a transaction. But it doesn’t tell you who actually started the signing , how it happened , or if the system owner allowed it to happen .

The transaction under investigation shows a type-4 transaction on the Ethereum at 20:20:59 UTC on October 29:

0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b

See transaction on Etherscan

It had 50 EIP-7702 authorisations. Based on the reconstruction of the submitted signatures, they were all made from the same address - Binance 14.

Their nonces were consecutive: 18,914,775 to 18,914,824.

So why do we need nonces ?

In Ethereum, a nonce is a counter of public accounts. It is used especially to establish the order of transactions and to avoid reuse of previously used signed transactions.

In EIP-7702 the nonce is part of the authorisation, along with the address of the delegated contract and the network identifier.

When Ethereum verifies an authorisation, the nonce value must equal the current counter of the respective account. If the authorisation has been accepted successfully, the counter is incremented.

So 50 consecutive nonces are not 50 different wallets or a 50 withdrawal authorisations for individual tokens.
It’s a bunch of signed authorisations for one account.

The reconstruction has it that the accepted authorisation was for nonce 18,914,809.

It’s easy to draw the wrong conclusion here: that the attackers guessed the nonce, and so got into the wallet.
The nonce is not a secret. It is obtainable from the block chain. A valid authorisation still requires a cryptographic signature from the corresponding address.

When delegation was applied, the operator could call the contract’s functions within the framework of Binance 14.

In the case under investigation the address of the addressee was:
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c

A draft reconstruction shows a large asset withdrawal from Binance 14 began at 20:24:23 UTC. These included around 167,500 ETH, 1.615 billion USDT and dozens of other tokens.

The transactions involving Binance 16 were separate. As opposed to Binance 14, withdrawals from this wallet are believed to have been done via normal signed transactions, rather than using EIP-7702 delegation.

While Ethereum was getting ready to implement EIP-7702, assets were already being withdrawn on other blockchains.

Here’s a tentative timeline of the big events on Oct. 29:

It took less than twenty minutes from the first major transfers on the XRP Ledger to the withdrawal of funds from Binance 14.

The interesting thing here is the difference in the technical mechanisms.

Ethereum elected code delegation (EIP-7702). This mechanism, however, does not exist in Bitcoin, Tron, Solana, or the XRP Ledger in the same way.

Each of these networks has its own signing permissions for its operations.

We therefore consider the incident to be a possible compromise of a larger hot wallet management framework, not just an Ethereum mistake.

The transactions were near simultaneous, indicating a predetermined course of action. But it has not yet said how the attackers breached each network.

The funds started being sent to new addresses after the withdrawal. Some of the assets went through exchanges, while others were consolidated into separate wallets.

The stablecoin case became particularly interesting. Centralised tokens like USDT and USDC, unlike BTC or ETH, can be frozen at the smart contract level by issuers.

Preliminary estimates indicate the volume of frozen stablecoins reached some $2.7 billion.
Some of the USDT was probably swapped before restrictions were imposed.

Two of Binance’s own addresses were also caught up in the freeze by Tether and Circle, intriguingly.
It seems that it was faster to freeze the funds at these addresses and Binance was unable to transfer the funds to secure wallets quickly enough.

It is probable that once the hack was detected, internal security procedures were triggered, which would have stopped the signing of transactions until the situation was clear: how exactly the attack happened and which devices and keys were compromised.

The freeze by Tether and Circle might have been the quickest way to preserve the funds in this case.

The addresses that Tether and Circle have blocked including two Binance addresses are marked in blue in the chart.

Blocking transaction messages:

• CryptoAlertReport — message 17654
• CryptoAlertReport -- msg 17651

The graph itself shows the links between wallets and the highlighted addresses. The assumption on Binance’s internal restrictions is just a theory. It can only be confirmed through further information on the exchange’s actions after the discovery of the incident.

After the withdrawal, funds were distributed to new addresses. Some of the assets went through exchanges, some were consolidated into separate wallets.