Binance hot wallet drain, reconstructed from raw chain data.
Not a contract exploit. The attacker held the Binance 14 private key and used EIP-7702 to install their own code ON the Binance account, then swept 65 assets in one call. 167,464 ETH + 1.6B USDT in a single tx.
The clever bit: Binance 14 sends a tx every ~10s, so they couldn't know its nonce. They signed 50 authorizations with 50 consecutive nonces and fired them all. One matched.
Rehearsed the whole thing on three test accounts six hours earlier.
The backdoor is still installed as I post this. Every new deposit to Binance 14 is sweepable, and has been swept repeatedly tonight.
Full case file, every hash verifiable: https://hasky00.github.io/haskDetect/
HaskDetect case 001, Hasky Labs. #nostr
hasky
npub1za…zufw0
2026-10-29 22:59:47 UTC
Author Public Key
npub1zaal69jq3qaulph9q2yy8mcxjz2wwh52zthdz4543h0kkdr6qljq8zufw0Published at
2026-10-29 22:59:47 UTCEvent JSON
{
"id": "d981b382f0362a7d2f64f8d95bfb9f7cb8e18e8854df9a14087a3ccb69361943",
"pubkey": "177bfd1640883bcf86e5028843ef069094e75e8a12eed156958ddf6b347a07e4",
"created_at": 1793314787,
"kind": 1,
"tags": [
[
"t",
"nostr"
],
[
"client",
"Primal Web"
]
],
"content": "Binance hot wallet drain, reconstructed from raw chain data.\n\nNot a contract exploit. The attacker held the Binance 14 private key and used EIP-7702 to install their own code ON the Binance account, then swept 65 assets in one call. 167,464 ETH + 1.6B USDT in a single tx.\n\nThe clever bit: Binance 14 sends a tx every ~10s, so they couldn't know its nonce. They signed 50 authorizations with 50 consecutive nonces and fired them all. One matched.\n\nRehearsed the whole thing on three test accounts six hours earlier.\n\nThe backdoor is still installed as I post this. Every new deposit to Binance 14 is sweepable, and has been swept repeatedly tonight.\n\nFull case file, every hash verifiable: https://hasky00.github.io/haskDetect/\n\nHaskDetect case 001, Hasky Labs. #nostr",
"sig": "141bf1825da647b43f0215661c5989de0690750bf74a14781ae4f091853abc71568c903e912b7136af32372c6d91facbdaefeea1fa1df1038503f6f67543a7ec"
}