Kage 🟦🟥

Monitoring The Situation: Binance 14 owned another wallet Binance 14 was the owner of Hot Wallet 34. once the sweeper could run as Binance 14, it could use that existing permission to pull another $823m USDC out of wallet 34. the owner check still accepted the same owner address. cutoff for these numbers is October 29, 2:30 p.m. PDT / 21:30 UTC. still a developing incident; this is the snapshot through that point. the trace covers 13 Binance-labelled source wallets across Ethereum, Arbitrum, Avalanche, Optimism and Base. about $3.57bn at the captured prices: roughly $3.51bn on Ethereum and $62m elsewhere. that's the value moved. final losses and recoveries are still unresolved. the 50 EIP-7702 authorizations all recovered to Binance 14. one matched its current nonce and took effect. fifty signatures from one wallet. the delegation persisted, and the sweeper only accepted calls from its hardcoded caller. running that code as Binance 14 let it transfer the account's balances. the first sweep moved about 167,464 ETH and 63 token balances. a later sweep collected fresh balances. wallet 34's $823m USDC came out in two calls using Binance 14's existing owner permission. other source wallets made ordinary signed transfers. the Base and Optimism movements happened before the Ethereum delegation, so that one authorization doesn't explain the whole incident. we have valid signatures. how someone got access to them is still an open question. then there's what happened to the proceeds. 435m USDT was swapped for about 160,451 ETH across the traced Ethereum wallets. another 60m USDT went into Aave as collateral, with about 19,762 ETH borrowed against it. that ETH comes with a debt. counting both the collateral and the borrowed ETH as freely available proceeds would overstate the position. roughly $2.003bn in USDT and USDC was sitting in blacklisted Ethereum addresses at the cutoff. the entire stolen BEAM balance, about 984.25m tokens, had also been burned through a separate multisig transaction. frozen or burned tells us what happened to those holdings; it doesn't tell us how much Binance gets back. there was preparation too. six Tornado Cash withdrawals supplied 1.5 ETH gross, and three small delegated accounts look like rehearsals. that's the withdrawal side of the funding trail. it doesn't identify the original depositors or whoever is behind this. no exchange cash-out, bridge exit or Tornado deposit of the stolen Ethereum proceeds was established in this trace before the cutoff. what we can follow is swaps, borrowing and transfers between wallets. claims about funds having “exited” need to say where and when. the exposure includes whatever else that address is allowed to control. Binance 14's owner permission is why wallet 34 belongs in the same accounting. credit to @banteg for reconstructing the sweeper and @spreekaway for flagging the funding trail. the wallet names are explorer labels; the amounts and permission path were checked against receipts, signatures and execution traces. hackmd.io/@kethcode/B1KBzrWT…