Key Takeaways
- Lookonchain tracked the attacker selling 7.02 million UNI for $39.63 million on Oct. 29 and 30.
- TRM Labs said wallets on nine non-Ethereum chains moved funds through ordinary signed transfers.
- Binance’s Nov. 1 proof-of-reserves snapshot will show whether the dumped tokens were replaced.
Seven Tokens Gone in Hours
The thief behind the Binance breach wasted little time turning stolen altcoins into ether. Onchain trackers reported the attacker finished dumping a host of alts including UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD, swapping them for 70,480 ETH worth about $158.25 million.
- 7.02 million UNI sold for $39.63 million at $5.65.
- 217.5 million ENA sold for $33.93 million at $0.16.
- 7.77 trillion PEPE sold for $31.66 million.
- 2.57 million LINK sold for $26.05 million at $10.14.
- 127,953 AAVE sold for $14.27 million at $111.55.
- 21.85 million ONDO and 17.32 million WLD sold for $6.62 million and $6.09 million.
The attacker paid heavily for their hastiness, with one analyst noting that the individual sold 7,018,792 UNI in 51 minutes, taking a 21% worse price on the last swap than the first. The PEPE exit was more careful, with a tracker counting 85 swaps over an hour and a half and no single trade being above $1.05 million.
The logic was simple, i.e. since Tether and Circle had already frozen large stablecoin balances, the hacker was willing to pay the premium so as to cash out in time.
TRM Labs said the attacker also sold about 325 million USDT to market makers for roughly 122,300 ETH at a discount of more than 10%.
Why Binance May Need to Buy Back
The sell-off leaves a hole on Binance’s books given that the stolen ENA, UNI, PEPE and AAVE positions represent 7% to 15% of Binance’s reported holdings of each token, because the drained wallet was counted in its proof of reserves. One trader argued Binance is essentially net short about $40 million in PEPE and will have to buy it back.
Binance has pledged to cover all losses from its user protection fund and company funds. Some market commentators are front-running that bid, with a newly created wallet opening a 3x long on 22.78 million ENA worth $4.09 million on Hyperliquid right after the ENA dump ended.
Binance Says No Keys Leaked
How the attacker got in is now in dispute. Binance said its initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop, which let an attacker access a service container and submit unauthorized withdrawals. The firm then clarified:
“We have found no evidence of any wallet private key leak.”
Several researchers read the comments differently, with some saying that the incident escalated from an EIP-7702 delegation exploit to a potential compromise of the Binance 16 signing key. EIP-7702 is an Ethereum feature that lets a regular wallet temporarily run smart contract code.
Security firm Blockaid found the attacker submitted 50 authorizations in one transaction to guess the hot wallet’s live nonce, a counter that orders its transactions, and only one matched.
The strongest point for the skeptics is that the theft wasn’t limited to Ethereum. In this regard, TRM said wallets on nine other chains sent funds through ordinary signed transfers, and assessed the attacker likely could make Binance’s hot wallet signing system “sign transactions of its choosing.”
One tally put outflows at $1.449 billion on bitcoin and $628 million on tron, where EIP-7702 doesn’t exist.
Misuse, Not Theft?
An attacker inside a service that can request signatures could use keys without ever extracting them. Onchain researcher 0xQuit noted the attacker used a relayer, which would have been unnecessary with direct key access, adding:
It seems likely that they [the attacker] didn’t have the private keys.
Bitcoin.com News has broken down what’s confirmed about the breach so far.
In any case, the fallout has spilled into decentralized finance (DeFi), with the attacker having borrowed about 19,760 ETH on Aave against 60 million USDT, and Aave froze its V3 markets on Ethereum. As a result, ether fell 5.2% to $2,190 early on Oct. 30.
