727 FinanceAuthor: Nancy, PANews
On October 30, a sudden security incident shattered the calm of the crypto market.
Binance, the world's largest crypto exchange, saw large-scale abnormal fund outflows involving nearly $5.8 billion. Affected by this, market panic spread rapidly, and crypto asset prices fell in response. At present, as emergency response continues to advance, more than half of the involved funds have been frozen, and the scale of net fund outflows has significantly narrowed. PANews has launched "Binance Hot Wallet Theft Incident Tracker: Real-Time Data on Asset Flows, Freezes and Attacker Holdings," allowing real-time access to the latest developments of the incident.
This sudden "black swan" not only tests Binance's emergency response and risk management capabilities, but also once again pushes the asset security and risk control systems of crypto exchanges into the industry spotlight.
About $3 billion has been frozen, and the platform promises to bear the losses
At around 4 a.m. today, multiple Binance hot wallets are suspected to have suffered a large-scale attack, with large abnormal fund outflows.
According to on-chain data statistics, Binance-labeled wallets had assets outflowing at that time of about $5.643 billion. Among them, the Ethereum network accounted for about $3.528 billion, the Bitcoin network about $1.449 billion, the Tron network about $628 million, and networks such as Arbitrum, Optimism and Base totaled about $38 million. The abnormal transactions involved multiple hot wallets including Binance 14, Binance 16 and Binance Hot Wallet 34, and the related funds were subsequently transferred to multiple newly created addresses.
The latest Arkham data shows that the hacker cluster addresses related to this incident currently hold assets with a total value of about $5.76 billion, involving 65 tokens.
Facing the sudden security incident, Binance quickly activated emergency response measures, suspended withdrawals and some trading services, and joined forces with stablecoin issuers, law enforcement agencies and on-chain security teams to carry out fund tracking and freezing work.
In this incident, multiple stablecoin issuers including Tether and Circle assisted in the handling of related funds. According to public information, Tether has frozen about $1.5667 billion in USDT, Circle assisted in freezing about $823 million in USDC, and related parties such as Ripple and WLFI also participated in the fund handling.
With multi-party collaboration, the fund freezing work has made further progress. According to Binance's latest disclosure, as of now, the cumulative frozen funds involved in the incident have reached about $3 billion. Binance also stated that it is maintaining close cooperation with all parties to continue tracking the related assets, and the frozen amount is expected to increase further.
In terms of asset scale, Binance's custodial assets are about $144 billion, and the scale of the related abnormal fund outflows accounts for a relatively limited proportion of its custodial assets. Binance also emphasized that user funds are safe, the platform will bear all losses caused by this attack, and the incident will not affect user assets.
Binance co-founder Yi He stated that the platform is currently conducting a comprehensive security check and cooperating with relevant institutions to track and freeze the funds involved. During this period, deposit and withdrawal services will be temporarily suspended. After the investigation and security check are completed, Binance will publish a complete post-mortem analysis report and remind users to rely only on official channels for updates.
Attacker reportedly rehearsed in advance and left tracking clues due to operational errors
In addition to the scale of fund outflows, the attack path behind this incident is also worth attention.
Blockaid CEO Ido Ben-Natan said that the attack on Binance this time may not have stemmed from stolen private keys, but from exploitation of the signing system. The attacker is said to have packed 50 EIP-7702 authorization requests into the same transaction, hijacking Binance wallets through malicious authorization and then transferring assets.
Cosine, founder of the security firm SlowMist, also posted that the attacker chose EIP-7702 on Ethereum mainly to facilitate the batch sweeping of tokens in Binance-related hot wallets. On-chain, the operation was relatively crude, and the attacker also conducted several hours of rehearsal preparation before the actual theft, as can be seen from the first 5 transaction records of the relevant addresses. However, the EIP-7702 mechanism itself has no problem; even without this protocol, there are still other ways to achieve similar effects.
Shenyu, co-founder of Cobo, also reviewed the attack process based on on-chain data and likewise pointed out that this incident involved the EIP-7702 authorization mechanism and was not an impromptu action.
According to his analysis, the attacker broadcast a transaction containing 50 authorization requests at around 4:20 a.m. that day and used Binance hot wallet private keys to complete the signature. About 3 minutes later, the related assets began to be transferred in batches. The attacker had prepared in advance a transfer list covering 64 tokens and used test wallets for two rehearsals, with the last rehearsal about 3.5 hours before the formal attack. After the formal operation began, the attacker transferred assets in batches through multiple wallets and contract wallets, and converted some stablecoins such as USDT into ETH to reduce the risk of being frozen by issuers. Based on current on-chain data, the core issue points to the signing process; no contract vulnerability has been found so far, and Binance has not yet announced the specific reason for private key leakage or exploitation of the signing system.
23pds, Chief Information Security Officer of SlowMist, believes that, based on historical forensic experience, the attacker was able to bypass the risk control system, and whether the intrusion path was private key leakage or the signing machine being compromised still needs to be confirmed. Personally, he leans toward the hypothesis of private key leakage. In addition, the attacker most likely used customized withdrawal tools. It is recommended that the security department focus on in-depth investigation of the private key leakage chain and the characteristics of abnormal withdrawal tools during traceability and forensics.
It is worth mentioning that, according to protocol engineer Justin Kalland, the suspected Binance attacker may have made an operational error when using MetaMask to pay gas fees, thereby leaving potential tracking clues.
According to the transaction records he disclosed, the attacker once transferred 175 million USDT to a newly created wallet. About 2.5 minutes later, the wallet received 2 ETH for gas payment, consistent with the pattern of other attack wallets. About two minutes after that, the wallet called MetaMask's Gas Station function, even though it had already obtained enough ETH to pay gas fees. Three consecutive transactions were packed into the same block, involving ETH top-up for Gas Station, an unlimited USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. Most notably, the ETH top-up amount was exactly equal to the sum of the maximum gas budgets of the latter two transactions, precise to the wei.
Kalland speculated that the attacker was using a MetaMask wallet at the time and mistakenly selected USDT as the gas payment method in a hurried operation. MetaMask sometimes defaults to this, and the top-up order in the same block also matches its implementation. He pointed out that using Gas Station requires going through MetaMask Sentinel, and transactions pass through MetaMask rather than ordinary RPC, and this interaction may leave off-chain records in MetaMask, including IP metadata. Among all the attacker wallets he checked, this was the only one that showed use of Gas Station.
Crypto market falls in panic, Bitcoin selling pressure may be lower than expected
As one of the world's largest crypto exchanges, the attack on Binance this time is not only a major security crisis it has faced since its founding, but may also become one of the largest theft incidents in the crypto industry, quickly triggering market panic.
Affected by this, the crypto market has seen significant declines. CoinGecko data shows that Bitcoin once fell below $77,000, with an intraday drop of 5.1%; Ethereum fell to about $2,200, with an intraday drop of 5.9%; BNB fell to $693, with an intraday drop of 8.5%, and other crypto assets also came under broad pressure.
The market decline also triggered large-scale leveraged liquidations. CoinGlass data shows that in the past 24 hours, total liquidations in the crypto market exceeded $1.55 billion, of which Bitcoin liquidations exceeded $480 million and Ethereum liquidations exceeded $370 million, with long positions becoming the main affected party.
However, regarding the potential subsequent selling pressure brought by this incident, industry insiders believe the market may not need to be overly pessimistic.Benson Sun, founder of Coinkarma, wrote in an analysis that the stolen Bitcoin involved in this incident is worth about more than $1 billion, but BTC lacks a large-scale mixing pool similar to Tornado Cash, and the related addresses are easily flagged by trading platforms and on-chain analysis firms, making subsequent monetization significantly harder than for ETH. He cited cases such as the Bitcoin stolen from Bitfinex in 2016 remaining untouched for years, and about 1,800 BTC stolen from Coldcard in July this year, of which 90% had still not been moved as of early September, and noted that the BTC involved this time is larger in scale, so attackers may need to gradually process it by splitting addresses, mixing coins, and discounted OTC trading, a process that could last for years. Therefore, the possibility of these BTC forming large-scale market selling pressure in the short term is relatively limited. If Binance uses SAFU to compensate and replenish Bitcoin, it may instead create buying pressure.
By contrast, a large number of ERC20 tokens converted into ETH and then sent into Tornado are harder to trace, and the scale that could truly turn into market selling pressure may be in the range of more than $1 billion. Benson Sun believes that market confidence will be hit, but the direct selling pressure on Bitcoin is not as large as imagined, and called on the industry to squarely address security arrangements such as hot wallet management, signature authorization, and quantum resistance in the post-AI era.
Judging from current on-chain dynamics, the attackers have not yet moved on a large scale the BTC, which is the largest portion of the assets involved in this incident, while some other altcoins are being gradually converted into ETH. According to on-chain monitoring, addresses associated with the attackers are converting tokens such as UNI, PEPE, and RLUSD, as well as some transferable stablecoins, into ETH to reduce the risk of assets being frozen by issuers. At present, the hackers' ETH holdings have increased to about 467,000 coins, worth about $1.06 billion.
Overall, this security incident at Binance has once again sounded the security alarm for the crypto industry, especially as AI technology accelerates and attack methods continue to escalate, the security challenges facing crypto platforms are becoming increasingly complex. For Binance, the most important task right now is not only to recover the involved assets as much as possible and restore platform services as soon as possible, but also to prove to the market through transparent investigation results and effective rectification measures that its security system can withstand increasingly complex attack methods.
In the long run, security is not only the bottom line of platform operations, but also the foundation for the crypto industry to build long-term trust.