Binance Hack Update Today (October 29th) a huge amount of Binance hotvolts have been removed. Estimates range from $3.5 billion to around $5.8 billion in the number of blockchains. Binding has frozen more than 1.5 billion USDT and Circle has frozen about 823 million USDC. CZ said it appears to be a hack and expects full refunds. Binance also announced that it is under investigation and users' funds are safe, but withdrawals have been temporarily suspended. The final number of casualties has not yet been confirmed, but this is one of the biggest security incidents in the history of the exchanges. How the Binance hack happened: How the attack was carried out (according to Anakin data and technical analysis): The attacker used Ethereum's EIP-7702 feature. This feature, enabled after a Pectra update, allows an ordinary wallet (EOA) to transfer execution control to a smart contract with a valid signature from its private key. What you see in the chain: the attacker's address (funded by Tornado Cash) deployed a malicious "sweeper" contract.

Binance Hack Update Today (October 29th) a huge amount of Binance hotvolts have been removed. Estimates range from $3.5 billion to around $5.8 billion in the number of blockchains. Binding has frozen more than 1.5 billion USDT and Circle has frozen about 823 million USDC. CZ said it appears to be a hack and expects full refunds. Binance also announced that it is under investigation and users' funds are safe, but withdrawals have been temporarily suspended. The final number of casualties has not yet been confirmed, but this is one of the biggest security incidents in the history of the exchanges. How the Binance hack happened: How the attack was carried out (according to Anakin data and technical analysis): The attacker used Ethereum's EIP-7702 feature. This feature, enabled after a Pectra update, allows an ordinary wallet (EOA) to transfer execution control to a smart contract with a valid signature from its private key. What you see in the chain: the attacker's address (funded by Tornado Cash) deployed a malicious "sweeper" contract.

At 20:20 UTC, a transaction containing 50 signatures EIP-7702 was registered on the popular hotspot "Binance 14". According to the analysis, all these signatures were made with Binance's private key 14. About 3 minutes later, the attacker called the sweep function on the same contract and drained about 167,000 ETH + 1.6 billion USDT and dozens more tokens in one transaction.

With this approach, it also took over another smart wallet (Hot Wallet 34) and pulled in about 780-823 million USDC. Important Note: The Ethereum protocol itself has no bugs. To enable this delegation, there must be a valid signature of the wallet's own private key. This means that the Hotvolt private key has been leaked, or that Binance's signature system (which signs the transactions) has taken over the attacker's control and signed this malicious shipment. It is not yet clear which country it is. Simply put: the attacker was able to temporarily convert the wallet into his own contract with a valid Binance signature and then withdraw the entire balance in a few transactions.