• 1.615B USDT

• 62.6M RLUSD

• 29,934 wBETH

• 11,372 XAUt

• 6.19M UNI

• 198.4M ENA

• 7.175T PEPE

• 27.8M USD1

• 2.26M LINK

• 127,853 AAVE

about $2.5B at the explorer’s prices.

1. The attacker deployed a delegate contract, 0x63e842b0...73e9c6fAe, from the relayer at 15:59 UTC.

2. About four hours later, the relayer submitted an EIP-7702 authorization transaction

That installed the malicious 7702 delegate code on Binance 14.

3. The relayer then made a call to Binance 14, executing the delegate code, and transferring Binance 14’s ETH and token balances.

4. The calldata is labeled sweep(address, address[]). The second argument is a list of recognizable token-contract addresses plus the zero-address (eth).

5. The same relayer later used the same delegate to move 780M USDC from Binance Hot Wallet 34 into the same pool

• The relayer 0x7C... was funded by three Tornado Cash 0.1 ETH withdrawals over the prior two days.

• The same pool also received 28,005.6 ETH from Binance 16 24 seconds after the main sweep.

• The pool then forwarded 195,460 ETH to a fresh, unlabeled EOA

• That EOA has only one transaction and currently holds the 195,460 ETH.

What's a bit unclear is why the relayer was needed in the first place. If they had the private keys to the Binance wallets, they could have just sent the assets out in an atomic bundle without needing a relayer at all.

So it seems likely that they didn't have the private keys and instead just had the 7702 auth signatures, which must have been phished somehow.

(http://www.autoadmit.com/thread.php?thread_id=5916092&forum_id=2#50213416)