←News detail

AYi AI NotesUpdated Oct 31 01:36

The Full Story of the $6.3 Billion Binance Hot Wallet Hack: How Hackers Used EIP-7702 Delegation Authorization to Bypass Signatures

AI summary

AYi AI Notes used Claude Opus 5.5 to generate a retrospective video laying out the on-chain process by which $6.3 billion was moved out of Binance's hot wallet. The author argues that the key point is that the hackers did not steal private keys; instead, they exploited Ethereum's EIP-7702 delegation authorization to make Binance's signing system sign for the hackers' contract. The authorization contained no amount or recipient address, making it hard for traditional risk controls to detect. The article states that the hackers signed 50 authorizations in succession, with the 16th taking effect after matching the nonce, and then a single call moved out 167,000 ETH, 1.62 billion USDT and more than 60 other tokens, leaving only 1 ETH in the wallet.

Why read this

AI score 51

The original article uses on-chain details to reconstruct how EIP-7702 delegation authorization was abused and the signing system was bypassed, serving as a case study for understanding this type of attack path.

Topics

Tags

Quoted post

AYi

@AYi_AInotes

In the entire history of the crypto business, OKX was originally dealt the lowest-odds "hell-mode opening hand." Back when competitors were pushing their profile to legendary heights through silver-tongued global PR, lavish Super Bowl ads, and even buying the naming rights to NBA arenas, OKX was mired in the darkest moment of a withdrawal crisis, being talked down by the entire internet and pronounced dead. But if you look back over the past five years, the only answer to who pulled off the most incredible strategic turnaround in the entire industry is OKX. The cruelest yet fairest underlying law of the business world is this: The clamor on the bandwagon and the god-making campaigns ultimately cannot withstand the gravitational hash-rate reckoning; and for those who, while everyone else was frantically chasing quick money, went against conventional wisdom and stubbornly devoted themselves to hardcore product strength—time will ultimately return the entire kingdom to them. They accomplished three "heavy-lifting jobs" that ran almost entirely against the industry consensus: First, when everyone was rushing to fake data and pump air coins, they locked hundreds of top engineers in a small dark room and relentlessly built the industry's first "Unified Trading Account (Portfolio Margin)." They fully connected the underlying mathematical models of cross-currency margin and spot-derivatives hedging, and literally turned an exchange's underlying risk control into a financial-grade armored vehicle that even extreme black-swan market conditions cannot penetrate. Second, when all CEXs (centralized platforms) were desperately building higher walls, trying to lock users' private keys and assets firmly inside their own servers, they took the lead in spending heavily to revolutionize themselves: building the self-custodial OKX Web3 wallet. Not only did they open-source it and not only did they hand asset control back to users with both hands, they even polished the complex operations of hundreds of public chains, inscription indexing, and DEX aggregation into the industry's smoothest "on-chain Swiss Army knife." Others thought they were digging their own grave, but in the end they relied on product strength to turn the Web3 wallet into a super traffic floodgate more than ten times that of traditional exchanges across the entire network. Third, in the year FTX collapsed and the entire industry suffered a trust avalanche, they did not hire PR firms to issue press releases; instead, they were the first to make 100%+ Merkle tree Proof of Reserves (PoR) a regular practice. Every month they publicly disclosed all on-chain asset reserves to the whole world on schedule, refusing to retreat even under line-by-line scrutiny under a microscope, and used the clumsiest yet most hardcore code transparency to stitch the shattered industry trust back together inch by inch. Many people like to take shortcuts in business, superstitiously believing in capital operations and traffic miracles. But OKX's ten-year comeback proved one extremely plain thing: In a swamp full of speculation and deception, the sharpest weapon has never been silver-tongued narrative, but rather the pure hard strength of withstanding all cold stares and cyclical pain and welding every line of code, every set of risk controls, and every hidden card thoroughly into users' minds.

View original

在整个加密商业史里,OKX 拿到的原本是一张胜算最低的“地狱级开局牌”。 当年友商靠着巧舌如簧的全球公关、挥金如土的超级碗广告、甚至买下 NBA 球馆冠名权把声量推向神坛的时候,他们却深陷提币风波的至暗时刻,被全网唱衰、判定死刑。 但如果你复盘过去这五年,谁完成了整个行业最不可思议的战略大逆转,答案只能是 OKX。 商业世界最残酷但也最公平的底层法则是: 风口上的喧嚣和造神运动,终究敌不过地心引力的算力清算; 而那些在所有人都在浮躁捞金时,反常识死磕硬核产品力的人,时间终究会把整座江山还给他们。 他们干成了三件几乎逆着全行业共识走的“重体力活”: 第一,当大家都在抢着造假数据、发空气币拉盘时,他们把几百名顶级工程师关在小黑屋里,死磕业内第一套“统一交易账户(Portfolio Margin)”。 把跨币种保证金、现货衍生品对冲的底层数学模型全部打通,硬生生把一家交易所的底层风控,做成了连极端黑天鹅行情都击不穿的金融级装甲车。 第二,当所有 CEX(中心化平台)都在拼命筑高围墙、想把用户的私钥和资产死死锁在自己服务器里时,他们却带头砸重金去革自己的命: 做自托管的 OKX Web3 钱包。 不仅开源、不仅把资产控制权双手奉还给用户,甚至把几百条公链的复杂操作、铭文索引、DEX 聚合,打磨成了全行业体验最丝滑的“链上瑞士军刀”。 别人以为他们在自掘坟墓,结果他们直接靠产品力把 Web3 钱包做成了全网十数倍于传统交易所的超级流量总闸门。 第三,在 FTX 轰然崩塌、全行业遭遇信任雪崩的那一年,他们没有找公关发通稿,而是第一个把 100%+ 默克尔树储备证明(PoR)常态化。 每月按时向全世界公开所有链上资产储备,哪怕被显微镜逐行审查也不退缩,硬生生用最笨拙但也最硬核的代码透明度,把破碎的行业信任一寸一寸拼接了回来。 很多人做商业喜欢走捷径,迷信资本运作和流量奇迹。 但 OKX 用十年逆袭证明了一件极度朴素的事: 在充满投机和欺骗的沼泽里,最锋利的武器从来不是舌灿莲花的叙事, 而是顶住所有冷眼与周期阵痛,把一行行代码、一套套风控、一张张底牌,彻底焊进用户心智里的纯粹硬实力。

View original post

Body · AI translation

The Full Story of Binance Being Hacked for $6.3 Billion:

A complete recap video made in one sentence with the god of video, Claude Opus 5.5,

It dug up the entire on-chain record of Binance's hot wallet being emptied of $6.3 billion. What chills me the most is not how large the amount was, but that the hacker, without stealing any private keys, got Binance's own signing system to sign on his behalf.

Everyone assumes that when an exchange gets hacked, either the front end was phished, or an insider ran off with the funds. But the operation reconstructed on-chain this time was essentially a dimensional-downgrade harvest targeting Ethereum's new protocol EIP-7702.

Many people don't understand what EIP-7702 is. In plain terms, it's like issuing the wallet a power-of-attorney notarization with full authority.

Once the delegation takes effect, the contract deployed by the hacker can freely move assets in the wallet's name.

What's even more fatal is that this authorization has no transfer amount, no receiving address, only a string of delegation instructions.

Traditional risk-control engines checking amounts and blacklists can't find anything at all.

The on-chain traces of the entire heist are as precise as a Hollywood movie:

1️⃣ Signing 50 blind-guess sequence numbers in a row. Binance's No. 14 hot wallet sends a transaction every 6 seconds. The hacker couldn't calculate the current transaction sequence number, so he simply had the system sign 50 consecutive authorizations in one go. As it turned out, the 16th one happened to match, and the delegation took effect instantly.

2️⃣ Zeroed out in 3 minutes 24 seconds. After the delegation took effect, the contract needed only one call to sweep away 167,000 ETH, 1.62 billion USDT and more than 60 other tokens from the wallet in a single transaction. $2.5 billion was emptied in 4 minutes, leaving only 1 ETH in the wallet.

3️⃣ Automated systems blindly feeding the fire. After the wallet was emptied, the internal automatic sweeping program kept running mechanically. After 5 a.m., another 200 million USDT was automatically topped up by the system into this controlled wallet, and 72 seconds later it was intercepted by the hacker at light speed.

During the same period, hot wallets on Bitcoin, Tron, Solana and several other chains also fell one after another.

Although centralized institutions urgently froze about $3 billion in stablecoins, no one could press pause on the nearly 200,000 ETH in the hacker's hands.

Source

AYi AI Notes