Binance Hackers Paid $15 in Ethereum Fees, Then Routed Stolen NEAR Through Six Meme Coins

The Oct. 29 Binance breach involved the unauthorized movement of billions of dollars in cryptocurrency across multiple wallets and blockchains. An Ethereum transaction costing about $15 in network fees carried 50 signed authorizations for one of the exchange’s hot wallets. One of those authorizations enabled an attacker-operated contract to move roughly $2.5 billion in assets, according to blockchain security firm Blockaid.

Days later, the attackers used six newly created meme coins to route about $430,000 in stolen NEAR through separate wallets, blockchain analytics firm Elliptic found. One token featured an image of Elon Musk beneath an “Elon 2028 President” banner. Elliptic said there was no suggestion that Musk had any connection to it.

A $15 Authorization Enabled a $2.5 Billion Transfer

The Ethereum operation centered on Binance 14, one of the exchange’s Ethereum hot wallets. Blockaid found that attackers submitted a transaction carrying 50 signed authorizations for the wallet at about 20:20 UTC on Oct. 29. Bloomberg reported that the transaction cost roughly $15 in Ethereum network fees.

The mechanism involved EIP-7702, an Ethereum feature that allows a regular cryptocurrency wallet to delegate transaction execution to code associated with a smart contract. The authorization transaction did not itself transfer any assets. Instead, it delegated execution to an attacker-operated sweeper contract, which could move cryptocurrency held by the wallet when called.

The 50 authorizations did not all take effect. The attackers prepared authorizations with consecutive nonce values, a number that tracks a wallet’s transaction sequence. Only one matched Binance 14’s nonce when the transaction was processed, allowing the malicious delegation to take effect. The other 49 did not match.

Three minutes and 24 seconds later, the attackers called the sweeper contract and moved roughly $2.5 billion in cryptocurrency in a single transaction, Blockaid found. The transfer included 167,464 ether and 63 other tokens, including about $1.6 billion in Tether’s USDT stablecoin.

In its Nov. 3 incident report, Binance said attackers had used 50 signed authorizations to establish malicious EIP-7702 delegations. The exchange said the permissions remained active on the blockchain independently of its normal withdrawal infrastructure, allowing unauthorized transfers outside its usual controls.

Six Meme Coins Routed Stolen NEAR Through Liquidity Pools

A separate investigation by Elliptic identified another method used to move part of the stolen cryptocurrency. Between Nov. 5 and Nov. 7, attackers created six tokens on the NEAR blockchain, pairing each with NEAR in a separate liquidity pool on Ref Finance, a decentralized exchange.

The tokens were named FUK, OLCCL, MEILI, MMLI, DABI and SINU. One featured Musk’s image beneath an “Elon 2028 President” banner. Elliptic said there was no suggestion that the billionaire had any connection to the token.

The scheme relied on two groups of wallets. One group used stolen NEAR to buy the newly created tokens, while another sold tokens into the same liquidity pools and received NEAR in return. The pools separated the two groups, meaning the stolen cryptocurrency did not pass directly from the buying wallets to the receiving wallets.

Elliptic traced about 117,000 NEAR, worth roughly $430,000 at the time, through the six tokens. The arrangement made the receiving wallets appear to have obtained NEAR through trading rather than direct transfers from wallets linked to the theft, according to the firm’s analysis.

A separate on-chain reconstruction by Chain-Analyzer identified the same trading pattern but reported different transaction totals. Its review found 2,559 purchases totaling about 143,700 NEAR and 2,573 sales totaling roughly 143,100 NEAR across the six pools. Chain-Analyzer also found no direct transfers between the wallets buying and selling the tokens.

The figures describe different measurements of activity and should not be treated as competing estimates of the stolen amount. Elliptic’s 117,000 NEAR figure represents its tracing of funds through the six tokens, while Chain-Analyzer reported the aggregate volumes of purchases and sales across the pools.

More Than 11 Million NEAR Remained in a Receiving Wallet

The amount traced through the meme coins represented only a small portion of the cryptocurrency stolen from Binance. Chain-Analyzer traced 12.41 million NEAR from three Binance hot wallets to a single receiving account during the Oct. 29 attack. About 11.62 million NEAR remained in that account as of Nov. 9, according to its analysis.

Elliptic separately estimated that about 11.8 million NEAR from the theft remained unmoved. The figures reflect different tracking methods and scopes: Chain-Analyzer’s number refers to a specific receiving account, while Elliptic’s is a broader estimate of the remaining stolen NEAR. They should not be read as competing estimates of the same wallet balance.

Chain-Analyzer also identified about 310,000 USD Coin (USDC), a stablecoin designed to track the U.S. dollar, arriving at three Ethereum addresses on Nov. 8 and Nov. 9. Some NEAR collected through the liquidity pools was converted into USDC and transferred to Ethereum through cross-chain infrastructure. The firm cautioned that it could not attribute the entire 310,000 USDC to the six-token activity.

The Federal Bureau of Investigation (FBI) attributed the Binance theft to North Korea and referred to the activity as TraderTraitor. Binance said about $6.34 billion in digital assets were affected and approximately $2.85 billion had been frozen or intercepted as of its Nov. 3 update. The exchange cautioned that the figures remained subject to reconciliation and market price movements.

Elliptic said routing funds through liquidity pools did not make the transactions untraceable. Instead, the method added steps to the tracing process by keeping the buying and receiving wallets from transferring funds directly to each other. Trading in all six tokens had stopped by Nov. 8, Elliptic reported. The creators of four tokens also withdrew the remaining liquidity from their pools that day.