Binance says hackers who stole billions in crypto spent months planning heist

Key Points:

• Binance hot wallets on Solana and Optimism transferred approximately 970,500 SOL and 44.2 million OP tokens to attacker-controlled addresses, followed by the transfer of 18,270 BTC to another attacker-controlled address.
• The attacker exploited Ethereum’s EIP-7702 authorization mechanism, which allows delegation of execution rights to smart contracts, to gain partial control over a Binance hot wallet without exposing private keys.
• Binance responded swiftly by suspending withdrawals, coordinating token freezes, and revoking unauthorized permissions, successfully freezing $2.85 billion in assets.
• Despite these measures, attackers continued unauthorized asset movements using malicious EIP-7702 authorizations that operated independently of Binance’s withdrawal systems, requiring additional transactions to revoke.
• The revocation process was complicated by the use of Multi-Party Computation (MPC) in Binance’s hot wallet, necessitating a specialized procedure to invalidate on-chain authorizations, which took additional time beyond suspending withdrawals.