According to Ondology Labs, a Binance wallet already under attacker control received another transfer of $200 million USDT, which then flowed through several addresses.

Timeline of transfers

Analysts reported that a separate exchange address credited the compromised Binance 14 wallet, and within 72 seconds the attacker withdrew the incoming funds.

The funds were subsequently routed to a Tether address that had already been frozen, where they remained immobilised for an unexplained period, Ondology Labs notes.

Prolonged access and secondary takeovers

Bitquery data indicate the malicious code retained control over Binance 14 for nearly four hours, during which the wallet continued to accept deposits and allow repeated withdrawals.

Investigators also allege that control of Binance 14 permitted commands to a second wallet, Binance 34, enabling the attacker to extract 823 million USDC through that channel.

Preparation and exploitation methods

Security researchers tracked preparatory funding via Tornado Cash beginning on 28 October, and observed tests conducted on attacker-owned wallets before the main theft.

Prior to the incident, the actor trialled the EIP-7702 mechanism: a signed approval that allows a wallet to execute smart contract code, according to Ondology Labs.

Post-theft conversions and issuer actions

Within 35 minutes of the breach, linked addresses swapped 435 million USDT into 160,451 ETH, reportedly paying a 17–20% premium to market prices to avoid potential freezing by the stablecoin issuer.

Bitquery counted that in six of eleven instances Tether froze wallets that were already emptied, illustrating issuer intervention on related addresses.

Open questions

Key aspects remain unresolved, including why a frozen Tether address received funds and the exact vector that initially granted persistent control of Binance 14.

Both Ondology Labs and Bitquery continue to publish findings as the investigation progresses and related on-chain activity is monitored.