Grok summarized the entire Binance hack in chronological order, revealing that the hackers began preparations the previous night: 1. Preparation Phase 1) October 28th: The attacker's address (marked as the initiator, such as 0x7c86…5ca0) received small amounts of ETH from Tornado Cash multiple times as gas fees (approximately three transactions of 0.1 ETH each), laying the groundwork in advance. 2) October 29th, afternoon to evening: The attacker deployed a dedicated sweeper contract. During this period, test/practice transactions were conducted, using their own address to verify the EIP-7702 delegation and sweeping process. The sweeper contract was finally deployed around the afternoon. 2. Main Attack Phase (October 30th, early morning) 1) Around 4:20 AM: The attacker submitted delegation authorization to the Binance 14 hot wallet via EIP-7702. The transaction carried approximately 50 consecutive nonce authorization signatures (all signed by Binance 14's own private key), ensuring that even if the nonce changed rapidly, one of them would still be matched. After the authorization took effect, Binance 14 temporarily/continuously executed the cleanup contract code deployed by the attacker. 2) 04:24: The main sweep begins. Binance 14 transferred approximately 167,000 ETH (approximately $380-390 million USD) + approximately 1.615 billion USDT + over 60 other tokens (including RLUSD, wBETH, UNI, ENA, PEPE, LINK, AAVE, etc.) to a new address (the recipient was identified by Etherscan as a Binance Hot Wallet Exploiter). This single transaction was massive. 3) Approximately 04:24:47 (24 seconds later): Binance 16 hot wallet directly signed with its own private key, transferring approximately 28,000 ETH to the same receiving address. 4) From approximately 04:39–04:41: Some ETH was transferred a second time to the new address. Hot Wallet 34 and others, through their delegated Binance 14 permissions, transferred out approximately 780 million USDC, plus an additional approximately 43 million USDC later. 5) In the following tens of minutes: Outflows continued across multiple chains, including the Bitcoin Network, Tron, Arbitrum, Optimism, Base, and Avalanche. Some altcoins began to be sold off for ETH. 3. Emergency Response and Freezing (After 5 AM) 1) Within approximately one hour: Tether and Circle took emergency action. Tether froze over 1.567 billion USDT; Circle froze approximately 823 million USDC. A total of over $2.3 billion in stablecoins were frozen, with subsequent official confirmation of approximately $2.54 billion (including other stablecoins such as USD1). Ripple, World Liberty Financial, and others also assisted in freezing some assets. 2) Around 5:15 AM: CZ posted that "user funds are safe" and "it does indeed look like a hack targeting Binance," thanking Tether and Circle for their swift freezing. Around 5:29 AM: Binance officially announced that it was aware of the potential security issues and was actively investigating. User funds are completely safe, but users are advised to be wary of scams. Subsequently, it announced security checks and a suspension of multi-chain withdrawals until the environment is confirmed to be secure. Around 6:00-7:00 AM: He Yi and others responded, thanking the relevant teams for their assistance in freezing funds; CZ responded that the estimated net loss "may be slightly higher, but will be covered." Loss Scale and Current Status (Public Data as of Now) 1) Total Outflow: Approximately $5.643 billion in assets related to the Binance Token wallet have flowed out (Ethereum approximately $3.528 billion, Bitcoin approximately $1.449 billion, Tron approximately $628 million, and other chains approximately $38 million). 2) Freeze: At least $2.3-2.54 billion in stablecoins are frozen. 3) Estimated Net Loss: After deducting the frozen portion, DefiLlama and others estimate approximately $1 billion (approximately 0.69% of Binance's custodial assets). CZ stated that it may be slightly higher, but will be covered. User funds have been officially declared safe, and SAFU has historically provided guarantees on multiple occasions. Other Developments: Attackers have been continuously selling altcoins for ETH; some addresses have been using USDT as collateral to borrow ETH on Aave; some hot wallet delegations were not promptly revoked, potentially leading to a secondary sweep of newly entered funds. Attack Summary: The prevailing view is that this attack exploited the Ethereum EIP-7702 mechanism (Pectra's upgraded account delegation feature) against Binance's hot wallet. The core issue is that the attackers obtained the relevant hot wallet's private key or signing capabilities, rather than a simple smart contract vulnerability. It's not a traditional smart contract vulnerability, but rather EIP-7702 delegation: a regular wallet can temporarily/continuously execute specified contract code after signing with its own private key. On-chain evidence shows that the authorized signature originated from Binance's hot wallet's own private key; therefore, the mainstream judgment is that the private key was obtained, or the signing system/process was breached/spoofed (similar to past cases of exchange signature process manipulation). The attackers pre-emptively used Tornado Cash to launder gas, deployed the contract, and used continuous nonces to protect the authorization—a highly professional approach. The official intrusion path has not yet been released. Currently, it appears that user assets are safe, and the scale of the loss is not significant for Binance, which should be able to fully cover it. However, it must be said that the security environment for cryptocurrencies in the AI era will become increasingly severe. The attack threshold has been significantly lowered, and the frequency of incidents has increased, exhibiting overall characteristics of being "more frequent, more intelligent, and more systematic." AI has not "created" entirely new fundamental vulnerabilities, but rather amplified and industrialized existing weaknesses (keys, people, operational processes, new protocol functions). The security environment has therefore become more dynamic and frequent: small-scale, automated attacks are more common, and high-value targets (exchange hot wallets, large protocols) can still experience single incidents involving hundreds of millions of dollars (this time it reached billions). Of course, defenders are also deploying AI protection on a large scale, using the same technologies to fight back. In the long run, key management (multi-signature, threshold signature, hardware security modules), the principle of least privilege, and the isolation and access control of AI agents are the most critical systemic defenses.