Hoskinson Shares Analysis of Binance Wallet Attack

Charles Hoskinson has shared a technical analysis of the attack on Binance’s Ethereum wallets, warning about dangerous code associated with the movement of crypto assets.

The Cardano founder responded to a post by CyberSatoshi, who examined reconstructed code linked to Binance 14, one of the exchange’s hot wallets. The analyst described a program used to transfer assets and argued that it was designed around the wallet’s operations.

“Careful, there is some seriously dangerous code out there,” Hoskinson wrote alongside the analysis.

Reconstructed Code Examines Binance 14 Transfers

CyberSatoshi analyzed a reconstructed version of a sweeper, a program designed to move assets from an account. The analyst argued that the code was tailored to Binance 14 and highlighted several functions involved in transferring ETH and tokens.

One part of the program left one ETH in the wallet when transferring its native balance. CyberSatoshi suggested that this could keep Binance’s automated transaction queue supplied with gas, preventing an insufficient-funds error from triggering an alert.

The post also described a loop that checked token balances and could continue processing assets if an individual transfer failed. CyberSatoshi identified another function that could call an external account through Binance 14.

Hoskinson shared the analysis without specifying which of its conclusions he endorsed. His message did not include a comparison between Cardano’s and Ethereum’s transaction models.

ADBREAK]

How EIP-7702 Delegation Was Used

The attack involved EIP-7702, an Ethereum mechanism that allows an account controlled by a private key to delegate execution to smart contract code. Delegation can give the account access to functions such as performing several operations within one transaction.

A valid authorization signed by the account is required to establish that delegation. Security firm Blockaid reported that Binance’s signing infrastructure, under the attacker’s control, signed an authorization directing Binance 14 to a sweeper deployed by the attacker.

CyberSatoshi argued that the mechanism accelerated the movement of assets after authorization was obtained. The analyst described a batch of 50 signed authorizations with consecutive nonce values. A nonce is a counter used in Ethereum’s transaction and authorization process.

Blockaid estimated that approximately $2.5 billion was transferred from Binance 14 in the initial transaction. The firm also traced outflows from other Binance wallets across multiple blockchain networks.

[NEWSBREAK]

Binance Investigation and the Second Account

Binance estimated that approximately $6.3 billion in assets was affected by the broader incident. The exchange reported that investigators were examining a potentially compromised employee laptop and additional points of breach.

Blockaid’s analysis traced another transfer to a separate Binance-owned smart account. According to the firm, the attacker reached that account through Binance 14, which remained delegated to the attacker’s code after the initial transfer.