Binance遭63亿美元盗窃：黑客利用EIP-7702与自动化洗钱链

It's a standard Thursday evening, and all of a sudden, the biggest hot wallets in crypto begin to empty. 11 blockchains and about 20 minutes later, the biggest crypto theft in history was complete. By the time Binance understood what it was looking at, the money was already gone. $6.3 billion just walked out of the industry's biggest exchange. But taking it was only the first task. [music] The theft took minutes, but turning that money into something the thieves can actually spend takes far, far longer, and every step happens on public blockchains that anyone can watch.

Tether and Circle were watching, so were the FBI and every major blockchain analytics firm. [music] And yet, as I make this video, more than $3 billion of it is still out there and still moving. So how do you actually clean billions of dollars in stolen crypto when the whole world can see your wallets? Well, in this video, we're going to look at the race to move the money before it could be frozen, the automated laundering system that was set up before the theft even started, and the company best placed to follow the money being breached itself.

My name is DC, and you're watching The Coin Bureau. Okay, first off, how does that much money actually get stolen? Well, it was stolen from what are known as hot wallets. These are wallets that stay connected to the internet so they can send and receive funds automatically. And of course, that makes them faster to use, and it makes them the obvious target. On the 29th of October, Binance's hot wallets gave up Ethereum, Bitcoin, USDT, USDC, about 233 million XRP, and a long tail of smaller tokens.

The total was about $6.3 billion worth. Now, the speed came from an Ethereum feature called EIP-7702. It lets an ordinary wallet address run smart contract code. So that basically means a wallet can pack many actions into one transaction and accept instructions that were signed in advance. So the attacker abused access to an internal wallet signing service and attached their own contract to Binance's wallets. From there, withdrawals went in batches, completely outside the normal approval flow.

But how does an attacker get that kind of access? Well, for Binance, the groundwork started months earlier. The first foothold came in June when a wallet engineer downloaded a tampered installer of Homebrew, a common developer tool, while searching for an AI coding tool. Binance caught the infected device, replaced it, and rotated credentials. But by then, the attacker had already mapped out the engineer's role and the team.

So in October, they reached two more team members' machines, and on the day of the theft, they used the first engineer's stolen credentials to run a malicious script inside a Binance service container. But if all of that went off without a hitch and the money was then safe in the thieves' wallets, why couldn't they just sit on it? Well, because a big part of it could be switched off, namely the portion that was USDT and USDC.

The code behind those stable coins contains a blacklist function that only the issuer can use. Once an address is on that list, the tokens inside it can't move. Stable coins are the most recoverable asset class in crypto because Tether and Circle can freeze, burn, and reissue. But Ether's different. There's no issuer and no blacklist. So every single dollar of USDT and USDC was on a countdown, and the only way to keep it was to swap it into something without a blacklist before the freeze came.

And the thieves knew about that. So in a window of about three minutes, one wallet deposited $60 million of USDT into the lending protocol Aave and borrowed 19,762 wrapped ETH. Wrapped ETH being Ethereum in token form, but we'll just call it ETH for simplicity. Now, step by step, it works like this. First, the USDT goes into Aave's lending pool and goes inside the protocol's contract. Second, the wallet borrows ETH against that deposit.

Third, the ETH goes to a wallet that no issuer can freeze. And fourth, the USDT stays behind as collateral. So the value has left the token that can be frozen, and the debt with a borrower who has no reason to ever repay it. The same move was run on Tron through lending pools such as JustLend, where depositors receive a receipt token that has no freeze function. So the thieves didn't hide the stablecoins. Instead, they turned them into assets that nobody could control.

But lending pools only absorb so much, and for the rest, one wallet went straight to the open market. So between 21:09 and 21:34 UTC, a single wallet pushed about $500 million of stablecoins to decentralized exchanges using aggregators like Uniswap and 1inch. But the bigger your trade compared to DEX liquidity pools, the worse the price you get on every extra dollar. That's what's known as slippage. And on one batch of orders, the slippage was ugly, very, very ugly.

About $325 million went in, about $285 million came out. That's $40 million gone in about 20 minutes of trading, or about 12 cents on every dollar. Now across the wider push, one estimate put slippage as high as 26%. And that money didn't disappear. Bitquery estimates the thieves lost about $119 million against market prices across their rush trades. Roughly half of that, around $60 million, went to arbitrage bots and fast traders, and about $30 million went to block builders.

Not a bad Thursday evening for whoever was running those bots. And just to be clear, this wasn't a careless trade. It was a $40 million fee for getting out before the blacklist came. And the blacklist did come in the end. Tether's first major freeze hit 37 minutes after the funds reached the main Ethereum wallet. Aave's Guardian, the role that can pause the protocol in an emergency, froze the V3 reserves, but only after the Ethereum was already gone.

Tether CEO Paolo Ardoino confirmed more than $1.5 billion frozen, Circle CEO Jeremy Allaire confirmed more than $800 million frozen, and Ripple froze about $200 million of its RLUSD stablecoin. By the 31st of October, about $3 billion had been locked up. So, Tether and Circle acted fast, very fast. Close to half the haul got frozen, but the other half did get out of reach. Now, with that other half splitting across 11 blockchains and thousands of wallets, keeping up with it is close to impossible for any one person to do alone.

So, if you don't have 16 hours a day to spend glued to a screen, we've made it a lot easier. Our Coin Bureau newsletter breaks down major market events that actually impact you and your holdings, cutting through all that noise across both crypto and the wider market. And the best part, it's absolutely free. You can sign up using the link in the description below or by scanning the QR code on screen right now. Okay, back to the money.

So, once the haul was in assets nobody could freeze, where did it actually go? Well, into a machine that was built before the theft even occurred. On the 28th of October, the thieves' operator wallets were funded through three small withdrawals from Tornado Cash. Tornado Cash is an Ethereum smart contract where users deposit crypto and later withdraw it to a different address. That breaks the public link between the address that sent the money and the address that received it.

Now, every wallet needs a little crypto to pay transaction fees. So, funding the operators that way meant even the fee money came with no visible history. So, the laundering didn't start after the theft. It actually began at least 36 hours before it. And once the theft happened, everything kicked into gear. The stolen funds moved through about 12,000 wallets across 11 blockchains in under four days in more than 40,000 transactions.

Now, for a sense of scale, that's roughly 10,000 transactions a day or about seven every single minute around the clock. So, the laundering was running on autopilot. On Tron, many wallets were pre-funded with exactly one TRX, just enough to cover fees, and then forwarded larger bala