Used jpeg dealer \ Solidity dev & auditing \ VP Blockchain @yugalabs \ Founder @oSnipeNFT
The swamp
Joined June 2014
- Tweets27.4K
- Following3.8K
- Followers113K
- Likes62.6K
Pinned Tweet
I owe everyone a proper technical breakdown of the exploit of PaymentProcessorV2 and the rescue that followed.
The short version: Payment Processor trusted an ERC-2771 style “original sender” supplied through a trusted forwarder.
That sender could be forged.
1/🧵
if this is true binance got some 'splainin to do.
one engineer should be able to affect $6B, compromised or not.
need answers.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
ok safe to say binance is pwned
The biggest assets were approximately:
• 1.615B USDT
• 62.6M RLUSD
• 29,934 wBETH
• 11,372 XAUt
• 6.19M UNI
• 198.4M ENA
• 7.175T PEPE
• 27.8M USD1
• 2.26M LINK
• 127,853 AAVE
about $2.5B at the explorer’s prices.
1. The attacker deployed a delegate contract, 0x63e842b0...73e9c6fAe, from the relayer at 15:59 UTC.
2. About four hours later, the relayer submitted an EIP-7702 authorization transaction
That installed the malicious 7702 delegate code on Binance 14.
3. The relayer then made a call to Binance 14, executing the delegate code, and transferring Binance 14’s ETH and token balances.
4. The calldata is labeled sweep(address, address[]). The second argument is a list of recognizable token-contract addresses plus the zero-address (eth).
5. The same relayer later used the same delegate to move 780M USDC from Binance Hot Wallet 34 into the same pool
• The relayer 0x7C... was funded by three Tornado Cash 0.1 ETH withdrawals over the prior two days.
• The same pool also received 28,005.6 ETH from Binance 16 24 seconds after the main sweep.
• The pool then forwarded 195,460 ETH to a fresh, unlabeled EOA
• That EOA has only one transaction and currently holds the 195,460 ETH.
What's a bit unclear is why the relayer was needed in the first place. If they had the private keys to the Binance wallets, they could have just sent the assets out in an atomic bundle without needing a relayer at all.
So it seems likely that they didn't have the private keys and instead just had the 7702 auth signatures, which must have been phished somehow.
I think we can go ahead and assume DPRK.
status update
ok so looks like the largest crypto hack of all time, here's where we're at:
Stolen:
• ~$5.57B across Ethereum, Bitcoin, and Tron: ~$3.51B ETH, ~$1.44B BTC, ~$630M Tron.
Frozen:
• ~$2.39B in stablecoins: ~$1.567B USDT, ~$823M USDC
• Aave froze V3 and V4 on eth mainnet, precautionary but prevents the attacker from causing bad debt with illicit funds
leaves residual exposure at ~$2.6–$3.2B, beating out Feb 2025's $1.5B Bybit hack for the largest crypto heist of all time.
arb froze another $30.5M
Quit retweeted
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.
Thanks to all other signers involved.
Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5
Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6
One interesting note on the binance hack: the drain tx submitted 50 EIP7702 auths, each with a sequential nonce.
Only one is the correct, valid nonce for a tx.
Likely the attacker collected all 50 over some period of time, not knowing what the correct nonce would be at the time of execution, and then submitted them all. Eth only accepts the valid one and the invalid ones get discarded
On further inspection this may just be laziness on the attacker's part. Since they were also able to steal Bitcoin and Tron using normal transactions, it would seem logical that they do have enough access to Binance infrastructure to steal private keys directly or at least sign transactions. So the use of 7702 was strictly for convenience and the 50 sequential nonces just a fail-safe.
ok so looks like the largest crypto hack of all time, here's where we're at:
Stolen:
• ~$5.57B across Ethereum, Bitcoin, and Tron: ~$3.51B ETH, ~$1.44B BTC, ~$630M Tron.
Frozen:
• ~$2.39B in stablecoins: ~$1.567B USDT, ~$823M USDC
• Aave froze V3 and V4 on eth mainnet, precautionary but prevents the attacker from causing bad debt with illicit funds
leaves residual exposure at ~$2.6–$3.2B, beating out Feb 2025's $1.5B Bybit hack for the largest crypto heist of all time.
Quit retweeted
to the chickens, we've got a fix coming so you can verify with that abstract wallet whatever
gg
Quit retweeted
Back to Orange! New PFP @BoredApeYC
I am switching between apes rotating until I can get my hands on an amazing Forever Tequila Ape 😍
This one is like a Tequila Maestro!
Txs @0xQuit for building the amazing SWAP tool making the @token_works APESTER vulnerability be more of an opportunity to get other APES, imagine this using BAYC treasury!
Txs @Rhynotic for making the 1 on 1 trade possible!
Link to the swap website on the first comment.
Always DYOR and make sure you have the right links!
Quit retweeted
when life gives you lemons, etc.
we bought an nft from each collection and sent them to Quit's contract to allow users to swap out their NFTs easier. Half of the small swap fee buy-and-burns the Strategy token.
and I accidentally bought 2 apes, so I guess this is mine now
PoolSwapper is live
osnipe.app/pool-swap
Swap your ape, pudgy, CDB, toad, birb, or meeb for another from the pool
50% of swap fees buy and burn the collection's Strategy token
Thanks @token_works for providing one of each collection to use as bait so users don't have to
PoolSwapper is live
osnipe.app/pool-swap
Swap your ape, pudgy, CDB, toad, birb, or meeb for another from the pool
50% of swap fees buy and burn the collection's Strategy token
Thanks @token_works for providing one of each collection to use as bait so users don't have to
live:
Now that ApeSTR is effectively bricked and can't resell apes, people have been asking if they can swap for apes in the pool, so I built a tool to do just that.
Live now at osnipe.app/pool-swap
Works for apes, pudgys, CDBs, meebits, moonbirds and cryptoadz. Squigs are there too but that contract does not hold any squigs anymore, so no real opportunities to swap.
Note that you'll need 2 of a given NFT to swap for a new one. One is used as the "bait" and returned to you after the swap.
Tomorrow, @Rhynotic will gift bait NFTs to the contract so that swappers do not need to provide one themselves. It will also be added to the NFTStrategy frontend (I think).
There is a small fee, half of which goes towards buying and burning the strategy tokens.
Note: the tool also supports the 10 BAYC that are in the BAYCExchange contract by @machibigbrother, and those do not require bait NFTs at all.
Happy swapping.
Quit retweeted
Coop status update 🐔
Floor is sitting around 0.034 ETH, with less than 6% listed. And the Ethereum chapter hasn't even begun yet.
Despite broken bridges, @0xQuit managed to move ~1 ETH onto Abstract and placed the highest bids across every trait category.
Exits begin on Dec 8. The later you exit, the more you can earn, but miss the shutdown and you're cooked. Plus, the Ethereum reveal is still ahead.
Fun fact: While gold is one of the rarest traits in most NFT collections, it's actually the most common feather color in Chickens. Rarity follows Abstract tiers:
Ethereal → Obsidian → Diamond → None (F&F) → Platinum → Gold
Turning a chain shutdown into a game this interesting deserves some credit.
My only regret? Not owning an Obsidian or Diamond egg heading into the reveal. 🥚
