ReportedamountClaim 108
At 20:41:23 the operator used the still-delegated Binance 14, which owns the Circle smart account Binance Hot Wallet 34 , to move 780M USDC from that account to the collection address, followed by another 43M USDC.
Blockaid said that at 20:41:23 UTC the operator used the still-delegated Binance 14 to move 780M USDC from a Circle smart account to the collection address, followed by another 43M USDC.
This line is our short summary of the quote below. The quote is the evidence.
On the timeline
Addresses this source names
- ethereum:
0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055, described as: Victim ('Binance Hot Wallet 34', per Blockaid, a Circle smart account owned by Binance 14 from which 780M USDC was moved). Wallets
Other claims from the same source
ReportedotherClaim 330
Blockaid, which sells a product called Cosigner that rejects malicious transactions before signing, wrote its analysis of the Binance incident.
Blockaid Cosigner is an independent signing layer that sits on a wallet and utilizes signals from our exploit detection engine to reject malicious transactions.
Reportedroot causeClaim 329
Blockaid said its transaction security engine classified the delegation transaction as malicious because an EOA was being upgraded through EIP-7702 to an untrusted address.
Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.
ReportedresponseClaim 328
Blockaid said its detection flagged the drain under two minutes after the sweep and before any public report.
Blockaid’s detection flagged the drain under two minutes after the sweep and before any public report
Reportedroot causeClaim 327
Blockaid said the EIP-7702 delegation was visible on-chain for three minutes and 24 seconds before the sweep.
The delegation itself was visible onchain for three minutes and 24 seconds before the sweep
Reportedroot causeClaim 105
Blockaid said the operator address 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 was funded through three Tornado Cash withdrawals starting October 28.
The operator address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , was funded through three Tornado Cash withdrawals starting October 28.