ChainCatcher reported that Cobo co-founder Shenyu has released a video reviewing the suspected Binance theft from an on-chain perspective.
Shenyu said the attacker broadcast a transaction containing 50 authorization requests at 4:20 a.m. on Oct. 30. About three minutes later, assets began moving in bulk across multiple chains, including Ethereum and Tron. Based on token prices at the time, the total value of the transferred assets was estimated at about $5.8 billion.
How the transfers were carried out
According to Shenyu, the attacker used the EIP-7702 authorization mechanism to move assets. A transfer list covering 64 tokens had been prepared in advance, and two rehearsals were conducted with test wallets. The last rehearsal took place about three and a half hours before the attack.
During the operation, the attacker also swapped part of the freezeable assets, including USDT, into ETH in an apparent effort to avoid issuer freezes.
Assets frozen so far
Shenyu disclosed that, as of now, Tether has frozen 1.38 billion USDT, Circle has frozen 823 million USDC, and Ripple has frozen 40.54 million RLUSD and other tokens.
On Ethereum, about $2.4 billion has been frozen out of roughly $3.75 billion in transferred assets. On Tron, about $380 million has been frozen out of roughly $630 million moved on-chain.
Focus on the signing process
Shenyu said the core issue may lie in the signing process, adding that no contract vulnerability has been found so far. Whether the incident was caused by private key leakage or exploitation of a signing system remains to be confirmed by Binance.
He also warned trading platforms to check for risks tied to signing unintended authorizations.
Shenyu added that the roughly $5.8 billion figure refers to the estimated total value of assets moved across chains at the time, not a confirmed final theft loss.
