offthechain.eth 🛸 @_Off_The_Chain - Twitter Profile

offthechain.eth 🛸 @_Off_The_Chain

2 days ago

@HawleyMO God wants you out, Josh. Daddy’s disappointed

0

7

_Off_The_Chain retweeted

Dickson

@DicksonWuML

13 days ago

Binance hot wallets lost ~$6.28B across 8 chains today. $6.07B went in the first 55 minutes, and the attacker kept re-sweeping one Ethereum wallet for two more hours. Since then Tether, Circle, Ripple, Paxos, World Liberty and Binance have frozen ~$2.80B. About $3.27B can still move, mostly BTC and ETH. I traced it all on-chain, including how the attacker raced the freezes 🧵

DicksonWuML's tweet photo. Binance hot wallets lost ~$6.28B across 8 chains today. $6.07B went in the first 55 minutes, and the attacker kept re-sweeping one Ethereum wallet for two more hours.

Since then Tether, Circle, Ripple, Paxos, World Liberty and Binance have frozen ~$2.80B. About $3.27B can still move, mostly BTC and ETH.

I traced it all on-chain, including how the attacker raced the freezes 🧵

77

812

199

423

281K

_Off_The_Chain retweeted

Quit

@0xQuit

13 days ago

ok safe to say binance is pwned The biggest assets were approximately: • 1.615B USDT • 62.6M RLUSD • 29,934 wBETH • 11,372 XAUt • 6.19M UNI • 198.4M ENA • 7.175T PEPE • 27.8M USD1 • 2.26M LINK • 127,853 AAVE about $2.5B at the explorer’s prices. 1. The attacker deployed a delegate contract, 0x63e842b0...73e9c6fAe, from the relayer at 15:59 UTC. 2. About four hours later, the relayer submitted an EIP-7702 authorization transaction That installed the malicious 7702 delegate code on Binance 14. 3. The relayer then made a call to Binance 14, executing the delegate code, and transferring Binance 14’s ETH and token balances. 4. The calldata is labeled sweep(address, address[]). The second argument is a list of recognizable token-contract addresses plus the zero-address (eth). 5. The same relayer later used the same delegate to move 780M USDC from Binance Hot Wallet 34 into the same pool • The relayer 0x7C... was funded by three Tornado Cash 0.1 ETH withdrawals over the prior two days. • The same pool also received 28,005.6 ETH from Binance 16 24 seconds after the main sweep. • The pool then forwarded 195,460 ETH to a fresh, unlabeled EOA • That EOA has only one transaction and currently holds the 195,460 ETH. What's a bit unclear is why the relayer was needed in the first place. If they had the private keys to the Binance wallets, they could have just sent the assets out in an atomic bundle without needing a relayer at all. So it seems likely that they didn't have the private keys and instead just had the 7702 auth signatures, which must have been phished somehow. I think we can go ahead and assume DPRK.

227

3K

413

717

616K