Anatomy of the Binance 14 drain: 50 signatures, one sweep

On 29 October at 20:24 UTC, one transaction moved ETH and 64 tokens out of Binance's hot wallet "Binance 14" into an address created the same day. We traced it on DeepGyre's Wallet Flow Visualizer.

How it worked

The attacker never needed Binance to send anything. At 20:20 UTC they submitted an EIP-7702 transaction carrying 50 authorizations for Binance 14, one for each of its next 50 nonces. An EIP-7702 authorization is only valid if it is signed by the account's own key, so whoever produced them could sign as Binance 14.

The authorizations pointed the wallet at a "sweeper" contract the attacker had deployed that afternoon. Four minutes later a single sweep() call emptied it into 0x5227…2f8c. Twenty-four seconds after that, a second hot wallet, Binance 16, sent 28,005.6 ETH to the same address.

The timeline (UTC)

• 28 Oct 07:39 onward: the attacker 0x7c86…5ca0 is funded by three withdrawals from the Tornado Cash 0.1 ETH pool
• 29 Oct 02:29: deploys the first sweeper, with the attacker's address hard-coded as owner
• Afternoon: rehearses the sweep on three other wallets (USDT, USDC, DAI), then deploys a second version at 15:59
• 20:20:59: the type-4 transaction with 50 authorizations for Binance 14
• 20:24:23: sweep() moves native ETH and 64 tokens
• 20:24:47: Binance 16 sends 28,005.6 ETH to the same address
• 20:38:47: 195,460 ETH forwarded to 0x8532…43d4
• 20:41 and 21:00: 780M and 43M USDC pulled through the sweeper's call function

What left

Received by 0x5227…2f8c: 1.875B USDT, 823M USDC, 195,470 ETH, and more than 60 other tokens, including 88.5M RLUSD, 217.5M ENA, 29,934 wBETH, 12,574 XAUt and 167 WBTC.

Within 15 minutes 195,460 ETH had moved on to a new address, and 700M USDT had been split across two more (500M and 200M). Tether and Circle have reportedly frozen part of the stablecoins, and Binance's former CEO said user funds are safe. Binance has not published its own figures.

Beware of copies

Address-poisoning bots are already sending fake "USDT" and "ETH" tokens, spelled with invisible characters, from look-alike addresses. Copying an address out of an explorer's token list is how people lose money this week.

Trace it yourself

Open the address in the Wallet Flow Visualizer. Click any node to follow the money to its next hop.

All amounts above are read from the chain, not from Binance's accounting.