The Binance hacker overpaid $45M just to turn stolen $USDT into $ETH
Racing the freezes, they sold 325M USDT at an average of $2,657 per ETH while Binance traded near $2,300. For one block, ETH in Uniswap's USDT pool hit $3,487.
So who got the money?
Reading the reconstructed bytecode of the Binance EIP-7702 sweeper (`0x63e8...6fae`) is wild.
This wasn't a generic drainer. It was custom-engineered for Binance 14's architecture:
- Leaves exactly 1 ether behind (`bal - 1 ether`) when sweeping ETH so Binance's automated hot wallet queue wouldn't error on gas and trip alarms.
- Uses raw `staticcall` + `continue` loops with custom error codes (`SweepItemFailed`) so one bricked or blacklisted ERC-20 wouldn't revert the $6B batch.
- Includes a custom `callExecute` function to impersonate Binance 14 as controller of an external vault holding $823M in USDC.
They leave a comment: "robberies could be prevented if getaway cars were slower."
You can't fully blame EIP-7702, but it sped up the attack. Without 7702, draining 64 tokens plus an external $823M vault from a live exchange hot wallet meant fighting moving nonces across 70+ transactions. Defense systems would've killed it after tx #3.
With 7702, Lazarus sprayed 50 consecutive nonces in one type-4 payload, turned an EOA into a custom proxy, and atomically swept billions in a single block.
Ethereum core devs built the ultimate getaway car. Surgical state-sponsored engineering.
This could be etched onchain:
`if (bal > 1 ether) { https://t.co/ou2j9VqGvv{value: bal - 1 ether}(""); }`
binance lost billions in one night
first, what got hacked?
binance keeps crypto in big online wallets that send out money when users withdraw. one of the biggest is called "binance 14". it held billions
step 1: the hacker got ready (oct 28-29)
- he took money from tornado cash (a mixer that hides where money came from), so no one can see who he is
- he used it to pay fees for his transactions
- he practiced the attack on 3 of his own wallets first, to make sure it worked
- at 15:59 he deployed his "sweeper", a small program built to empty wallets
step 2: the attack (oct 29)
20:18 > the first theft wasn't even on ethereum. a binance wallet on op chain sent him 44.23M $OP (~$4.5M)
20:20 > the big one. he took control of binance 14 using a new ethereum feature called 7702. it lets a wallet run outside code. he made binance's wallet run his sweeper
how? he sent 50 approvals signed with binance 14's own key. only 1 worked, and 1 was enough
step 3: he emptied it
20:24 > 167,464 eth + 1.615B usdt
20:41 > 780M usdc
20:59 > 43M usdc
21:04 > 1,699.9 eth
21:44 > 369.8 eth + 200.4M usdt
22:39 > 128.5 eth
everything went to his main wallet
step 4: more binance wallets paid him
this is the scary part. 3 other binance wallets also sent him money with normal transactions, no trick needed:
- 20:24 > binance 16 sent 28,005.6 eth
- 20:18 > binance wallet on op sent 44.23M $OP
- 23:05 > binance wallet on polygon sent 6.19M usdt0 + 46
a normal transaction needs binance's own approval. so the hacker likely had access to binance's signing system, not just one wallet
step 5: binance kept feeding the hacked wallet
binance didn't notice for hours. money kept landing in binance 14 and he took it right away:
- 21:42 > binance 124 sent 200M usdt into it. he took it 72 seconds later
- 23:55 > a 2,961.99 eth deposit landed. he took it 60 seconds later
step 6: binance fights back
- 21:01 > tether froze the hacker's main wallet
- 22:06 > tether also froze binance 14
- 23:07 > binance started moving tokens out to safety (45 transfers)
- 00:10 (oct 30) > binance finally cut his access, 3h49m after the hack started
- circle also froze the usdc in his wallet
step 7: where the money is now
- ~$2B stuck in his main wallet, frozen (1.175B usdt + 823M usdc). he can't move it
- 197,460 eth sitting in one wallet, untouched
- 40,601 eth in another. he sold stolen tokens like aave, wld, rsr and morpho for eth and collected it here
- 17,260 eth in a third wallet
in total he still holds 255,000+ eth, which can't be frozen
check it yourself
hacker :
0x7C8601d4645b93cea45F71e118A729332e6B5CA0
fee wallet (tornado funded) :
0xe4F9070e1316de2988fc6f869feaD8fb99cC74cd
sweeper program :
0x63e842B054Bd624a465454D533C33F573e9c6fAe
hacker main wallet (frozen ~$2B) :
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
hacker eth wallets :
0x8532FA14ACAf483729C449b8458aedDb900543D4 (197,460 eth)
0x54401f80Da97893a15D43566184635B6674BC942 (40,601 eth)
0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea (17,260 eth)
binance wallets that lost funds :
binance 14 : 0x28C6c06298d514Db089934071355E5743bf21d60
binance 16 : 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d
binance (op) : 0xacD03D601e5bB1B275Bb94076fF46ED9D753435A
binance (polygon) : 0xe7804c37c13166fF0b37F5aE0BB07A3aEbb6e245
all tracked by zarvium
Call me crazy, but the @binance hacker stole BTC, ETH, USDT etc worth $6 BILLION, but ZERO $ worth of binancecoin:native
Okay. Do with that what you want.
https://t.co/7ObYsJ0b6e
The Binance hacker might have just executed one of the most brilliant moves in crypto.
First, Tether froze $1.5 billion worth of USDT.
Then Circle followed by freezing another $800 million in USDC.
At that point, it seemed like the hacker’s funds were completely trapped.
But apparently, he had already thought several steps ahead.
Rather than keeping the stolen USDT in a wallet, he allegedly deposited it into Aave and used it as collateral to borrow ETH.
Then he walked away.
And this is where things get really interesting.
Tether can freeze the USDT sitting in that wallet.
But it can’t freeze the ETH that was already borrowed.
So now, Aave is left with frozen collateral, while the hacker is holding liquid ETH.
And unless the protocol finds a way to recover those funds, he might not even have to repay the loan.
Two companies froze billions of dollars in seconds.
Yet someone who understood how DeFi works may have found a way to bypass both restrictions.
Pretty wild when you think about it.