Binance hack explained: how $3.3B was stolen and what we know

About $3.3B left Binance hot wallets on Ethereum in 40 minutes on the afternoon of Oct. 29 (ET), in ETH, USDT, USDC and some sixty other tokens. Etherscan has labeled the receiving addresses "Binance Hot Wallet Exploiter." Binance founder Changpeng Zhao (CZ) wrote: "User funds are safe! It looks like Binance was indeed hacked." Binance itself has not yet confirmed a breach. Tether and Circle have already frozen roughly $1.8B in stablecoins.

What we know now

• Between 4:24 and 5:04 PM ET, about $3.3B left the Binance 14, Binance 16 and Hot Wallet 34 addresses: 195K ETH, 1.615B USDT, 780M USDC and 60-plus other tokens (PANews, FinanceFeeds).
• FinanceFeeds counts up to $3.55B across six blockchains once other networks are included. No other source has confirmed that figure yet.
• Tether froze about $971M in USDT and Circle about $823M in USDC, roughly $1.8B in total (Cointelegraph). About $1.1B is held in ETH and other tokens that can't be frozen.
• Binance says it is investigating a possible security issue and has not confirmed that customer funds were affected.
• The attacker is unknown. Binance has not announced a bounty, a withdrawal halt or a post-mortem.

How it happened

Binance hasn't published a technical report. On-chain data shows the following (FinanceFeeds, Blockchain Reporter):

1. Setup. The attacker's address was funded only through the Tornado Cash mixer, with three deposits of about 0.1 ETH each on Oct. 28⁠–⁠29. At 11:59 AM ET on Oct. 29 it deployed the smart contract that later pulled the funds.
2. Delegation. At 4:20 PM ET, the Binance 14 wallet was switched to an EIP-7702 delegation. This feature arrived with Ethereum's Pectra upgrade and lets an ordinary wallet temporarily run a smart contract's code. Setting a delegation requires a signature from that wallet's own private key.
3. Drain. Four minutes later, the contract emptied Binance 14 in a single transaction.

In other words, the attacker was able to sign on behalf of a Binance hot wallet. Nobody has explained how yet, whether through a stolen key, a compromised signing system or insider access. Neither Binance nor security firms have commented on that so far.

Timeline

Oct. 28⁠–⁠29. The future attacker address receives about 0.3 ETH from Tornado Cash in three transfers (Blockchain Reporter).

Oct. 29, 11:59 AM ET. The address deploys a smart contract for the withdrawal (FinanceFeeds).

Oct. 29, 4:20 PM ET. An EIP-7702 delegation to that contract is set on the Binance 14 wallet.

Oct. 29, 4:24 PM ET. In one transaction, Binance 14 sends 167,464 ETH (about $380⁠–⁠388M), 1.615B USDT and more than 60 other tokens, including RLUSD, wBETH, XAUt, UNI and USD1, to a new address. The transfer is worth about $2.5B in total. Twenty-four seconds later, Binance 16 sends 28,005 ETH to the same address (Blockchain Reporter).

Oct. 29, around 4:40 PM ET. Within 15 minutes, the recipient forwards about 195,460 ETH (around $450M) to another fresh address.

Oct. 29, 4:41 PM ET. Binance Hot Wallet 34 sends 780M USDC to the same receiving address, bringing the total to about $3.3B (PANews).

Oct. 29, around 5 PM ET. The market reacts: $629M in positions are liquidated within an hour, $607M of them longs (PANews). BTC dips below $79,000, ETH below $2,240, and BNB falls as much as 9%.

Oct. 29, 5:04 PM ET. The main drain ends 40 minutes after the first transaction.

Oct. 29, 5:13 PM ET. Circle freezes the address holding the 780M USDC (TechFlow). Tether freezes about $971M in USDT.

Oct. 29, evening ET. Binance says it is investigating reports of a possible security issue. CZ says Binance appears to have been hacked and user funds are safe, and he thanks Tether and Circle.

Where the money went

All funds first landed at an address created on the day of the attack. About 195K ETH moved almost immediately to another fresh address (PANews). Cointelegraph reports that linked wallets began selling USDT on decentralized exchanges before the freeze.

Stablecoins were the largest part of the haul, and their issuers blocked most of them in time. TechFlow reports another $175M in USDT frozen at a separate address and total freezes above $2.1B. Tether hasn't confirmed those numbers. The FinancialJuice feed also carried a figure of "more than $1.567B USDT" attributed to Tether's CEO, but we could not find a primary source for it.

ETH and other tokens that can't be frozen remain with the attacker, worth about $1.1B by FinanceFeeds' estimate. We'll track which bridges and mixers are used to move them.

What the team and exchanges did

• Binance: "We are aware of reports of a possible security issue with Binance. Our teams are actively investigating. At this time we have not confirmed that user funds have been affected" (Blockchain Reporter).
• CZ noted that he no longer runs Binance.com but, as a shareholder, expects all user funds to be fully compensated (TechFlow).
• Tether and Circle froze about $971M in USDT and $823M in USDC.
• Etherscan labeled the sender and recipient "Binance Hot Wallet Exploiter."

Binance keeps its SAFU insurance fund for cases like this, but it hasn't said whether it will use the fund this time.

What it means for holders

Hot wallets are an exchange's working float for withdrawals. Most reserves are usually kept in cold storage, but Binance hasn't said anything about its reserves since the attack. Until Binance confirms that customer funds are unaffected, its only official position is that it is investigating.

A freeze doesn't return stablecoins automatically. To do that, the issuer has to burn the blocked tokens and reissue them to the victim's address. How and when Tether and Circle will do this is not yet known. For live bitcoin and market prices, see the daily brief. Our first report on the hack is here.

This is not investment advice.

This story is developing: we are following events and adding new data as it comes in. Last updated Oct. 29, 5:45 PM ET.