Binance Hack Analysis: Attacker Turned a Hot Wallet Into a Sweeper With Just 130 Lines of Code

On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper under their control. They prepared 50 pre-signed authorizations so that at least one would stay valid when executed. TRM said coordinated transfers across nine other blockchains point to a compromise of Binance’s wider hot wallet signing infrastructure. A second Ethereum hot wallet also sent $174 million straight to the attacker.

Why Signing Infrastructure Is the Real Weak Point

The sweeper contract was only about 130 lines, and the hard part is getting access that makes simple code devastating. She added that people, infrastructure and workflows able to instruct keys are part of the security perimeter, and that access controls deserve the same protection as the keys themselves.

North Korea Links and Laundering Tactics

Chainalysis found onchain links to last month’s Bitget exploit, though Elliptic cautioned that the overlap covered only a small share of the funds and does not prove the same attackers. Thousands of transactions moved funds between addresses in a short time. The attacker converted $325 million in stablecoins into $285 million in ETH over nearly 20 minutes, accepting losses of up to 26% to reach assets issuers cannot freeze. Elliptic also said $59.9 million in stolen USDT went into Aave as collateral to borrow 19,762 ETH, a loan that was close to liquidation at the last update. Aave has unfrozen all V3 and V4 markets and says its contracts were unaffected.

Binance’s Financial Position and Withdrawal Timeline

Binance holds about $5 billion in affected assets, with another $1.3 billion being bought through market and OTC channels. CEO Richard Teng said the exchange targets Monday for its initial proof of reserves report and is hopeful users can withdraw before the Sunday deadline, within 40 hours. TD Cowen analysts said the breach shows custody risks at centralized exchanges but not a failure of Bitcoin, adding that we do not stop using dollars when a bank is robbed, just as car theft does not invalidate the automobile.