.eth

I don’t exist online (don’t worry)

[Zarv @zarvxbt]

binance lost billions in one night

first, what got hacked?

binance keeps crypto in big online wallets that send out money when users withdraw. one of the biggest is called "binance 14". it held billions

step 1: the hacker got ready (oct 28-29)

- he took money from tornado cash (a mixer that hides where money came from), so no one can see who he is
- he used it to pay fees for his transactions
- he practiced the attack on 3 of his own wallets first, to make sure it worked
- at 15:59 he deployed his "sweeper", a small program built to empty wallets

step 2: the attack (oct 29)

20:18 > the first theft wasn't even on ethereum. a binance wallet on op chain sent him 44.23M $OP (~$4.5M)

20:20 > the big one. he took control of binance 14 using a new ethereum feature called 7702. it lets a wallet run outside code. he made binance's wallet run his sweeper

how? he sent 50 approvals signed with binance 14's own key. only 1 worked, and 1 was enough

step 3: he emptied it

20:24 > 167,464 eth + 1.615B usdt
20:41 > 780M usdc
20:59 > 43M usdc
21:04 > 1,699.9 eth
21:44 > 369.8 eth + 200.4M usdt
22:39 > 128.5 eth

everything went to his main wallet

step 4: more binance wallets paid him

this is the scary part. 3 other binance wallets also sent him money with normal transactions, no trick needed:

- 20:24 > binance 16 sent 28,005.6 eth
- 20:18 > binance wallet on op sent 44.23M $OP
- 23:05 > binance wallet on polygon sent 6.19M usdt0 + 46

a normal transaction needs binance's own approval. so the hacker likely had access to binance's signing system, not just one wallet

step 5: binance kept feeding the hacked wallet

binance didn't notice for hours. money kept landing in binance 14 and he took it right away:

- 21:42 > binance 124 sent 200M usdt into it. he took it 72 seconds later
- 23:55 > a 2,961.99 eth deposit landed. he took it 60 seconds later

step 6: binance fights back

- 21:01 > tether froze the hacker's main wallet
- 22:06 > tether also froze binance 14
- 23:07 > binance started moving tokens out to safety (45 transfers)
- 00:10 (oct 30) > binance finally cut his access, 3h49m after the hack started
- circle also froze the usdc in his wallet

step 7: where the money is now

- ~$2B stuck in his main wallet, frozen (1.175B usdt + 823M usdc). he can't move it
- 197,460 eth sitting in one wallet, untouched
- 40,601 eth in another. he sold stolen tokens like aave, wld, rsr and morpho for eth and collected it here
- 17,260 eth in a third wallet

in total he still holds 255,000+ eth, which can't be frozen

check it yourself

hacker :
0x7C8601d4645b93cea45F71e118A729332e6B5CA0

fee wallet (tornado funded) :
0xe4F9070e1316de2988fc6f869feaD8fb99cC74cd

sweeper program :
0x63e842B054Bd624a465454D533C33F573e9c6fAe

hacker main wallet (frozen ~$2B) :
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c

hacker eth wallets :
0x8532FA14ACAf483729C449b8458aedDb900543D4 (197,460 eth)
0x54401f80Da97893a15D43566184635B6674BC942 (40,601 eth)
0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea (17,260 eth)

binance wallets that lost funds :
binance 14 : 0x28C6c06298d514Db089934071355E5743bf21d60
binance 16 : 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d
binance (op) : 0xacD03D601e5bB1B275Bb94076fF46ED9D753435A
binance (polygon) : 0xe7804c37c13166fF0b37F5aE0BB07A3aEbb6e245

all tracked by zarvium

[.eth @annoyminus]

@Chinaluemmanuel You see why citizens would rather call on likes of VDM than officers of the court? Because y’all think like the government agencies that violate human rights daily.

It’s a shame.

[.eth @annoyminus]

@Chinaluemmanuel Suspects they’ve already investigated and have enough evidence against before making an arrest? It’s still strange to me that they don’t investigate anyone they just raid and then check your phone to find evidence.

As a lawyer, is that what you’re defending?

[.eth @annoyminus]

@scothyll Damn man.. who tf are you ?

It’s beautiful

[.eth @annoyminus]

@ChuksEricE lol

[.eth @annoyminus]

@geartchibuzor23 @GossipMillNaija Even if something must have happened so that means the police have right to take money from citizens? You’re a very stupid human

[.eth @annoyminus]

@TropangHarozeku @AluyaPov Reasonable suspicion! Are you stupid?

[.eth @annoyminus]

@mIvnqt This is so stupid

[.eth @annoyminus]

@timmosion stfu

[.eth @annoyminus]

@WallStreetApes Choose Crypto you’ll never have these issues

[.eth @annoyminus]

@AluyaPov No uniform?

[.eth @annoyminus]

@chiiomanaledii Your Dad?

[.eth @annoyminus]

@Mazi_Chinonso1 Multi sig wallet.. that’s a lame way to get scammed if you’re a vendor!

You just trade you know nothing about crypto

[.eth @annoyminus]

@VOICE_OF_NAIJA1 Castrate all four of them!! Life in prison

[.eth @annoyminus]

@hodgetwins She’s wins the award for the most stupid human on Earth

[.eth @annoyminus]

@realyobarnub Not standing your ground simply means you’re encouraging the behavior.

Some Nigeria youths just act like slaves

[.eth @annoyminus]

@coaster_web @BayuzTv @BayusTv Again, are you stupid?