Binance Hacker Dumps $158M in Alts as Sleuths Question Exchange’s Key Story

Seven Tokens Gone successful Hours

The thief down the Binance breach wasted small clip turning stolen altcoins into ether. Onchain trackers reported the attacker finished dumping a big of alts including UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD, swapping them for 70,480 ETH worthy astir $158.25 million.

• 7.02 cardinal UNI sold for $39.63 cardinal astatine $5.65.
• 217.5 cardinal ENA sold for $33.93 cardinal astatine $0.16.
• 7.77 trillion PEPE sold for $31.66 million.
• 2.57 cardinal LINK sold for $26.05 cardinal astatine $10.14.
• 127,953 AAVE sold for $14.27 cardinal astatine $111.55.
• 21.85 cardinal ONDO and 17.32 cardinal WLD sold for $6.62 cardinal and $6.09 million.

The attacker paid heavy for their hastiness, with 1 expert noting that the idiosyncratic sold 7,018,792 UNI successful 51 minutes, taking a 21% worse terms connected the past swap than the first. The PEPE exit was much careful, with a tracker counting 85 swaps implicit an hr and a half and nary azygous commercialized being supra $1.05 million.

The logic was simple, i.e. since Tether and Circle had already frozen ample stablecoin balances, the hacker was consenting to pay the premium truthful arsenic to currency retired successful time.

TRM Labs said the attacker besides sold astir 325 cardinal USDT to marketplace makers for astir 122,300 ETH astatine a discount of much than 10%.

Why Binance May Need to Buy Back

The sell-off leaves a spread connected Binance’s books fixed that the stolen ENA, UNI, PEPE and AAVE positions correspond 7% to 15% of Binance’s reported holdings of each token, due to the fact that the drained wallet was counted successful its impervious of reserves. One trader argued Binance is essentially nett abbreviated astir $40 million successful PEPE and volition person to bargain it back.

Binance has pledged to cover each losses from its idiosyncratic extortion money and institution funds. Some marketplace commentators are front-running that bid, with a recently created wallet opening a 3x long connected 22.78 cardinal ENA worthy $4.09 cardinal connected Hyperliquid close aft the ENA dump ended.

Binance Says No Keys Leaked

How the attacker got successful is present successful dispute. Binance said its archetypal probe suggests the incidental may impact a compromised DevOps engineer’s laptop, which fto an attacker entree a work instrumentality and taxable unauthorized withdrawals. The steadfast past clarified:

“We person recovered nary grounds of immoderate wallet backstage cardinal leak.”

Several researchers work the comments differently, with immoderate saying that the incidental escalated from an EIP-7702 delegation exploit to a imaginable compromise of the Binance 16 signing key. EIP-7702 is an Ethereum diagnostic that lets a regular wallet temporarily tally astute declaration code.

Security steadfast Blockaid recovered the attacker submitted 50 authorizations successful 1 transaction to conjecture the blistery wallet’s unrecorded nonce, a antagonistic that orders its transactions, and lone 1 matched.

The strongest constituent for the skeptics is that the theft wasn’t constricted to Ethereum. In this regard, TRM said wallets connected nine different chains sent funds done mean signed transfers, and assessed the attacker apt could marque Binance’s blistery wallet signing strategy “sign transactions of its choosing.”

One tally enactment outflows astatine $1.449 cardinal connected bitcoin and $628 cardinal connected tron, wherever EIP-7702 doesn’t exist.

Misuse, Not Theft?

An attacker wrong a work that tin petition signatures could usage keys without ever extracting them. Onchain researcher 0xQuit noted the attacker utilized a relayer, which would person been unnecessary with nonstop cardinal access, adding:

It seems apt that they [the attacker] didn’t person the backstage keys.

Bitcoin.com News has broken down what’s confirmed astir the breach truthful far.

In immoderate case, the fallout has spilled into decentralized concern (DeFi), with the attacker having borrowed astir 19,760 ETH connected Aave against 60 cardinal USDT, and Aave froze its V3 markets connected Ethereum. As a result, ether fell 5.2% to $2,190 aboriginal connected Oct. 30.