Cobo co-founder Shenyu says suspected Binance exploit was rehearsed hours earlier, with assets moved in about three minutes

Cobo co-founder Shenyu says suspected Binance exploit was rehearsed hours earlier, with assets moved in about three minutes

N
News Editor
2026-10-30 00:22:52
Cobo co-founder Shenyu has shared an on-chain reconstruction of the suspected Binance theft, saying the attacker broadcast a transaction containing 50 authorization requests at 4:20 a.m. on Oct. 30 and began moving assets in bulk roughly three minutes later. The transfers spanned multiple chains, including Ethereum and Tron, with the total value estimated at about $5.8 billion based on token prices at the time. According to Shenyu, the attacker used the EIP-7702 authorization mechanism, prepared a transfer list covering 64 tokens in advance, and ran two drills with test wallets before the incident. The last rehearsal took place about three and a half hours before the live attack. During the operation, some freezeable assets such as USDT were swapped into ETH in an apparent attempt to avoid issuer freezes. Shenyu also disclosed the latest freeze figures: Tether has frozen 1.38 billion USDT, Circle has frozen 823 million USDC, and Ripple has frozen 40.54 million RLUSD and other tokens. On Ethereum, about $2.4 billion of the roughly $3.75 billion moved has been frozen. On Tron, about $380 million of the roughly $630 million moved has been frozen. He said on-chain data has not shown a smart contract flaw so far, and that the core issue may lie in the signing process.

Odaily reported that Cobo co-founder Shenyu released a video reconstructing the suspected Binance theft from an on-chain perspective.

Shenyu said the attacker broadcast a transaction containing 50 authorization requests at 4:20 a.m. on Oct. 30. Roughly three minutes later, assets began moving in batches across multiple chains, including Ethereum and Tron. Based on token prices at the time, the total value of the transferred assets was estimated at about $5.8 billion.

Transfer list covered 64 tokens and test runs were carried out before the attack

According to Shenyu, the attacker used the EIP-7702 authorization mechanism to move the assets. A transfer list covering 64 tokens had been prepared in advance, and two rehearsals were conducted with test wallets. The last drill took place about three and a half hours before the actual attack.

During the operation, the attacker also swapped some freezeable assets, including USDT, into ETH to avoid issuer freezing measures.

Issuers have frozen part of the funds

Shenyu said the latest freeze figures are as follows:

  • Tether has frozen 1.38 billion USDT;
  • Circle has frozen 823 million USDC;
  • Ripple has frozen 40.54 million RLUSD and other tokens.

By chain, about $2.4 billion has been frozen out of the roughly $3.75 billion moved on Ethereum. On Tron, about $380 million has been frozen out of the roughly $630 million moved.

No smart contract vulnerability has been identified on-chain so far

Shenyu said on-chain data suggests the core issue may lie in the signing process, and that no smart contract vulnerability has been found at this stage. Whether the incident was caused by a private key leak or abuse of the signing system still needs to be confirmed by Binance.

He also warned that trading platforms should check whether their signing systems carry a risk of approving unintended authorizations.

The original note added that the roughly $5.8 billion figure refers to the estimated total value of assets moved across multiple chains at the time, rather than a confirmed final theft loss.

This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan.
1200

Disclaimer:

The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.

Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.