Odysseus, founder of Phylax, who investigated suspicious transfers from a Binance-tagged wallet, claimed that a signed authorization also granted access to a separate smart wallet, from which 780 million USDC was moved.
Following claims of suspicious outflows worth billions of dollars from Binance wallets, a new analysis examined how the transactions may have occurred. In a four-part analysis, Odysseus drew attention to Ethereum’s EIP-7702 authorization mechanism.
Transfer made 3 minutes and 24 seconds after authorization
According to the transaction sequence described by the researcher, a signed code authorization was assigned to a Binance-tagged wallet at 20.20.59 UTC. At 20.24.23 UTC, another address called the sweep() function, which is used to transfer assets in bulk. The two transactions were only 3 minutes and 24 seconds apart.
The analysis said that 167.464 ETH and 63 different tokens were moved in this transaction, including 1,615 billion USDT. It also said that an operator address funded through Tornado Cash was hard-coded into the authorized code, while a read-only test using an unrelated address was rejected.
Access was not limited to the first wallet
The most notable part of the analysis was a separate transaction said to have taken place at 20.41.23 UTC. According to Odysseus, the authorized wallet used its existing ownership authority over another smart wallet to move another 780 million USDC.
This meant the alleged access was not limited to the assets held in the first address; it also extended to that address’s authority over another wallet. The researcher specifically emphasized that this was a separate transaction from the initial transfer.
Why does granting a wallet authorization matter?
EIP-7702 allows a regular Ethereum account to execute code it has authorized through its own account. Because the authorization can be persistent, the code may be able to carry out subsequent transfers, depending on how it is configured, without requiring the wallet owner to sign again.
The risk here depends on which code the wallet authorizes and for which transactions. Odysseus said that a stolen private key or a malicious authorization signed by the account owner could enable this, but it is not yet clear how the signatures in question were obtained.
Binance launches investigation, CZ reveals frozen amounts
Following the technical analysis, Binance and former CEO Changpeng Zhao also issued statements. The exchange said its security teams were investigating information about a possible security issue and that it would share verified updates through its official channels.
CZ said the incident appeared to be an attack and stated that Tether had frozen approximately $971 million and Circle approximately $823 million. Reminding people that he no longer runs Binance.com, CZ said that as a shareholder, he expected all user funds to be covered.
With these statements, attention turned to how the transfers were carried out and what would happen to the frozen assets. The key point in Odysseus’s analysis, however, is that authorization granted to one wallet can also extend to other access rights that wallet holds.
Not investment advice.