CryptoQuant’s analysis found that Binance’s Bitcoin, Ethereum, and USDT outflows on October 29 differed markedly from similarly sized transfers seen in the previous three months.
An analysis shared by CryptoQuant’s Julio Moreno compares large outflows between July 29 and October 28 with activity on the day of the attack. The key difference was not just the amount transferred; the transaction structure, the accounts signing the transactions, and the addresses receiving the assets were also outside the usual pattern.
Bitcoin was consolidated first, then split into batches of 1,000
According to the analysis, Binance’s routine Bitcoin withdrawals combine many transfers into a single transaction. During the period examined, transactions had a median of 16 inputs and 11 outputs, with some of the funds returned to the exchange as change.
The transaction chain on October 29 showed a different structure, with two outputs in each transaction. First, the BTC in a cold wallet was consolidated at a new address in 11 transactions. Then, in 17 steps, batches of approximately 1,000 BTC were sent to previously unused addresses.
This distribution pattern did not match the large Binance outflows from the previous three months covered by the analysis. The differences in transaction patterns alone do not reveal the identity of the receiving addresses or show that the Bitcoin was sold.
Recipients also changed for Ethereum and USDT
On the Ethereum side, transfers exceeding 10,000 ETH during the comparison period consisted of routine transactions signed by Binance. These transfers went to two repeatedly used recipients on weekday mornings, with the largest reaching 80,000 ETH.
On October 29, however, approximately 167,000 ETH from 14 Binance wallets was withdrawn through an EIP-7702 batch call signed by an external account. A separate routine transfer of approximately 28,000 ETH was also made to the same new address. We covered the role of the EIP-7702 authorization in the attack in our previous report.
The comparison for USDT showed a similar difference. The 12 large outflows from the earlier period examined by Moreno consisted of 500 million USDT transfers to the Tether treasury for redemption. On October 29, however, 1.615 billion USDT was moved in a single transaction to an entirely new address.
The analysis’s contribution was to show not so much the amounts involved in the large outflows reported earlier, but rather how they differed from the exchange’s past transfer behavior.
Not investment advice.