POPA ReconOn Oct 29 around 20:20 UTC a Tornado Cash-funded caller installed an EIP-7702 delegation on Binance hot wallet "Binance 14", letting it run attacker contract code. About 3m24s later it called sweep(), moving 167,464 ETH plus 63 tokens including 1.615B USDT, per @odysseas_eth.
The same cluster then pulled another ~28,005 ETH and 780M USDC from other Binance wallets, plus outflows traced on Bitcoin, Tron, Avalanche, Arbitrum, Optimism and Base. Onchain tallies rose from $5.57B to $5.72B, then $6.17B, with Binance later estimating ~$6.3B total impact, per Binance.
The drain tx bundled 50 EIP-7702 authorizations with sequential nonces, only one matching the wallet nonce, per @0xQuit. Binance says initial investigation points to a compromised DevOps engineer's laptop reaching a service container, with no evidence of wallet private-key leak.
Attacker funds moved into DeFi: one wallet deposited 60M USDT into Aave and borrowed 19,762 ETH, per @odysseas_eth. Aave said its contracts were unaffected and paused new deposits/borrows as precaution, per Aave. About 36M RLUSD was swapped for 15,439 ETH, with ~52.54M RLUSD then unfrozen.
Tether froze over 1.567B USDT, per Paolo Ardoino. Circle froze over 800M USDC, per Jeremy Allaire. Yi He reported ~$200M Ripple freeze and ~$30.5M Arbitrum freeze, with Binance later saying ~$3B frozen with partners including World Liberty and Paxos.
Binance 14 stayed under delegation and was swept again around 21:44 UTC after new deposits, including ~200M USDT to an address later frozen, per @WazzCrypto. CZ called it looking like a hack and said user funds would be covered, per CZ. Binance says SAFU plus company funds will cover losses.
Still unknown: how the 50 valid signatures were obtained, when, whether signing infrastructure or keys were compromised, final net loss after freezes, and full cross-chain tally. Figures remain researcher estimates and reported freezes, not a confirmed final loss.