The Binance hack was rehearsed. Twice, on mainnet, in public, hours before it happened.
At 13:51 UTC on October 29, a wallet funded only through Tornado Cash delegated two fresh wallets of its own to an unverified sweeper contract, seeded them with a few dollars of stablecoins and emptied them. At 16:20 it ran the full sequence with its production contract: delegate, sweep, leave 1 ETH, withdraw. Its first sweeper had been on-chain since 02:28. Six hours and 29 minutes after the first rehearsal, it ran the same play on Binance 14, one of the exchange's main Ethereum hot wallets.
We rebuilt the whole attack from the Ethereum record, live balance reads on six chains, and 53,181 posts across X, TikTok, YouTube, Instagram, Reddit and news. Here is what happened, how fast the public pieced it together, and where the money sits now.
The attack in six acts
I. The setup. About 1.49 ETH of Tornado Cash withdrawals, starting at 07:39 on October 28, funded the operator. That was the operation's entire budget. It paid for two sweeper contracts and two rehearsals, the second a full dress run of what came that night.
II. The drain. At 20:20:59, one transaction delivered 50 EIP-7702 authorizations to Binance 14. All 50 were signed by Binance 14's own key. Exactly one, matching the wallet's live nonce, applied, and the wallet started running the attacker's code. At 20:24:23 a single sweep moved 167,464 ETH and 63 tokens to the attacker's receiver for $0.93 in gas. The attacker then used that code to call Hot Wallet 34, a second Binance wallet that accepted Binance 14 as its owner, and pulled 823M USDC through it in two calls at 20:41 and 20:59.
III. The open door. The attacker's code stayed on Binance 14 for 3 hours 49 minutes, until the wallet signed its own revocation at 00:10:35. Each sweep left exactly 1 ETH behind, so the wallet kept paying for its own transactions and kept looking normal. It took in 533 incoming transfers in that window, and the re-sweep at 21:44 alone took 200.4M USDT.
IV. The response. The issuers moved first. Tether's $971M freeze was on the feed at 21:05. Binance's first word came at 21:15, from CZ and the company in the same minute. Circle froze 823M USDC, Tether raised its freeze to 1.567B USDT at 21:25, Aave froze its USDT market at 21:52, and World Liberty froze $27M of USD1. Binance put its verified frozen total at $2.54B at 23:22. At 00:13 it said it would cover all losses and paused all deposits and withdrawals. At 00:52 it said about $3B was frozen.
V. The money. Where every traced dollar sits, read live the next morning. More below.
VI. The public record. How the crowd rebuilt each step, and how fast.
Social rebuilt every step
The first public post calling it a hack landed 8 minutes after the sweep: @spreekaway at 20:32 UTC. The 780M USDC pull through Hot Wallet 34 was described in 7 minutes by @0xfoobar. The delegation was public in 33 minutes via @odysseas_eth, and the fifty authorizations in an hour via @0xQuit. By 21:25, posts had the mechanism, the contract, the hardcoded operator and the fifty signatures, and every one of those claims checks out against the chain. Tether's freeze reached the feed ten minutes before Binance said anything.
The setup was a different story. The first sweeper sat on-chain for 19 hours before anyone wrote about it. Both rehearsals were found at 21:31 by @MetaFinancialAI, after the money had moved. The Tornado Cash funding waited 37 hours for its first mention.
What varied across posts was never the sequence. It was the total. Public outflow estimates ran from $2.53B at 20:39 to $5.57B by 21:12 and $5.7B by 21:58, depending on which chains and which freezes each poster counted.
That is the part of an incident social data captures best. Every step in our timeline is matched to the first public post that described it, and in a live event that record moves faster than any official statement.
Where the money is
LunarCrush re-read every traced balance live between 03:20 and 03:27 UTC on October 30, on Ethereum, Bitcoin, Tron, XRP Ledger, Solana and Arbitrum, priced at CoinGecko spot.
- Frozen or recovered, about $2.66B by our read. That is $2.63B blacklisted at the token contracts (1.73B USDT across four addresses on two chains, 823M USDC, 27.8M USD1 and $50M of XAUt) plus $30.2M moved out on Arbitrum, which @zachxbt reported as the Arbitrum Security Council's recovery.
- Unfrozen in traced addresses, about $2.83B by our read. BTC $1.41B, ETH $950M, XRP $287M, SOL $93M, wBETH $73M, and $16.3M of Aave collateral net of debt.
- Gross traced, about $5.49B.
Bitcoin is the largest unfrozen position: 18,270.2 BTC across 19 addresses, none of which has spent an output. About 430,000 ETH sits downstream of the sweep, much of it in addresses that have never sent a transaction. The Bitcoin, Tron, XRP and Solana legs carry Whale Alert's Binance label; Binance has confirmed none of them and has not confirmed a loss total. Its own figure is about $3B frozen, as of 00:52.
The pattern is simple. Freezes worked where the asset had an issuer, and nowhere else.
Five signals that could have flagged it
1. The rehearsal, 13:51. A mixer-funded fresh address, a type-4 delegation to unverified code with a sweep selector, dust wallets seeded and swept. A rule for that pattern fires at 13:51:35. It would not have named the target, but it would have put the operator on a watchlist that hit again at 20:20:59, six and a half hours later.
2. The cross-chain start, 20:05 to 20:11. Whale Alert posted 185,017,485 XRP ($236M) and 965,455 SOL ($95M) leaving Binance-labeled wallets for brand-new addresses at 20:06 and 20:11. A rule for "hot wallet to never-seen address, above $50M, on two chains, within ten minutes" fires ten minutes before the Ethereum delegation. Binance has not said whether those transfers were its own.
3. The delegation, 20:20:59. Seventeen blocks, 3 minutes 24 seconds, separated delegation from sweep. A monitor that decodes type-4 transactions in new blocks and matches authorization signers against an exchange's own wallets fires at inclusion. The first public mention came 30 minutes after the sweep.
4. The open delegation, 20:24 to 00:10. Etherscan showed a "Delegate to" label on Binance 14 from 20:21. Clearing it before 20:41 blocks about $1.03B of the later outflows on explorer-visible lines; clearing it by 20:59 still blocks about $255M.
5. The mood of the day, 17:47 to 18:56. In the two hours before the delegation, X was full of signing-attack news: warnings of a malicious script on Polymarket's front end, CZ on a Ledger supply-chain compromise, and at 18:56 CZ describing "an injection attack on the front end" to 640K engagements. A different class of attack, on the same day, about the same thing: what gets signed.
Read the full report
The full reconstruction runs 77 pages, with every transaction, every live read and every first post laid out step by step. The data and code are open, and every on-chain read can be replayed.
Top comments (0)