miss nothing. whitehat @Immunefi https://nitter.cf/t.co/ZltAlN8JB1
web3
Joined July 2025
- Tweets565
- Following365
- Followers401
- Likes1K
webrainsec retweeted
JUST IN: 🇰🇵 North Korea's $6,300,000,000 Binance crypto hack is the largest heist in human history.
webrainsec retweeted
cachemoney.io is up.
Wrote down how private payments on Solana work and what stays public 👇
Devnet only. Test funds. View article
Update 10:30 UTC, 30 Oct: Binance has confirmed the incident. Preliminary cause: a compromised DevOps laptop reached a service container that submitted unauthorized withdrawals. They say no private key leaked. Estimated total impact $6.3B, about $3B frozen so far.
Note: Binance's "no key leak" is their framing. An EIP-7702 authorization only validates if its signature recovers to the signer, and Binance 14's 50 did. That fits a compromised signing service producing valid signatures without the raw key leaving custody, not a contradiction.
$6.3B is far above the ~$920M we traced from Binance 14 and 16 alone. Other wallets, maybe other chains, were hit. SAFU and company funds cover it, withdrawals paused, deposits fine, resume estimate about 45h from their 08:47 UTC post.
webrainsec retweeted
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.
Thanks to all other signers involved.
Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5
Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6
webrainsec retweeted
1/ Binance 14 (0x28C6c06298d514Db089934071355E5743bf21d60) was drained at 20:24 UTC today: 167,464 ETH plus 63 tokens, 1.6B USDT among them, in one transaction.
No smart contract was exploited. The entry point was a valid EIP-7702 authorization signed with Binance 14's own key.
Update 00:00 UTC: Binance 14 is still being refilled. Around 23:56 an unlabelled address with 256k transactions sent it 2,962 ETH ($6.8M); the attacker swept it to 0xa97b…8d10 within a minute or two.
Every refill so far has gone the same way, 3.5 hours after the first sweep.
Update 22:41 UTC: a fourth sweep at 22:39 took 128 ETH and 122 token transfers from Binance 14, to a fresh receiver, 0xa97bf7836f8a08f9ed91d41453d371493fae8d10, not the blacklisted one.
@Binance 14 is still delegated to the sweeper, 2h15m after the first sweep.
webrainsec retweeted
The attacker didn't know Binance 14's live nonce.
So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx.
Only 1 of 50 was a hit.
A 7702 auth is valid only for the current nonce at inclusion. The hot wallet was still firing. One nonce in that window landed.
webrainsec retweeted
i decompiled the contract that drained binance wallet 14
gist.wavey.info/Ta3FgAxastgj…
Update 21:53 UTC: a third sweep at 21:44 took 200.4M USDT and 353 ETH from Binance 14. An address holding 800M USDT had sent it the 200M 72 s earlier. That USDT is stuck at the blacklisted receiver: 1.38B USDT blacklisted in total. Binance 14 is still delegated.
The ETH keeps moving to fresh addresses. At 21:53 UTC:
195,460 at 0x8532FA14ACAf483729C449b8458aedDb900543D4
122,310 at 0xc887af690e0301cd4edbbce8f8d31b4ec65b286a
57,892 at 0x897c80d1a9729e94460e2bd93178bd5215158df3
Same pattern every 30 to 60 minutes.
@cz_binance @binance
On chain analysis so far for the ongoing @binance incident
1/ Binance 14 (0x28C6c06298d514Db089934071355E5743bf21d60) was drained at 20:24 UTC today: 167,464 ETH plus 63 tokens, 1.6B USDT among them, in one transaction.
No smart contract was exploited. The entry point was a valid EIP-7702 authorization signed with Binance 14's own key.
11/ Still open at 21:41 UTC: Binance 14 is still delegated to the sweeper, and funds keep arriving. A second sweep at 21:04 took what had come in after the first; 354 ETH has landed since. Anything new is at risk until the delegation is revoked.