Inca Digital

3/ Inca’s past analyses of Bybit noted irregularities in its proof of liabilities reporting. The report below details these findings and indicates potential issues regarding the reliability of other parts of Bybit’s operations. Read the report here: inca.digital/intelligence/by…

Today, more than $5.6 billion was stolen from Binance wallets across multiple chains, making it the largest crypto attack to date and more than triple the amount of the $1.5 billion Bybit hack in February 2025. The total figure is still growing as additional sweeps continue. Preparation On October 28 at 07:39 UTC, a brand-new wallet, 0x7c86, received the first of three 0.1 ETH withdrawals from Tornado Cash. This wallet became the attacker’s relayer, the account used to run the attack. At 15:59 UTC on October 29, the wallet deployed the sweeper contract, 0x63e842. Takeover At 20:20:59 UTC, 0x7c86 sent a single EIP-7702 transaction to Binance 14. A wallet can only be delegated under EIP-7702 if its owner signs an authorization. This transaction carried 50 of them, all validly signed with Binance 14’s key. Each authorization is tied to a nonce, a counter that goes up every time the wallet sends a transaction, and it only works if it matches the wallet’s current count. Binance 14 sends thousands of transactions a day, so the attacker signed a range of 50 consecutive nonces (18914775 to 18914824) to make sure one would line up whenever their transaction landed. Nonce 18914809 matched, and from that moment Binance 14 was delegated to the attacker’s sweeper contract. Sweep At 20:24:23 UTC, 3 minutes and 24 seconds after the delegation, the relayer called the sweeper contract’s sweep() function on Binance 14. The function empties the wallet of every token and all its ETH except 1 ETH, left behind to cover transaction fees. In a single transaction, Binance 14 sent 167,464 ETH and 63 different tokens to the attacker’s collection address, 0x5227. The largest token holdings taken were 1.615B USDT, 198.4M ENA, 62.6M RLUSD, 27.8M USD1, 6.19M UNI, 2.26M LINK, 127,853 AAVE, 29,934 wBETH, 11,372 XAUt and 7.175T PEPE. At 20:24:47, Binance 16, a second Binance hot wallet, sent 28,005.6 ETH and 55.7M USDT to the same address. Those transfers were signed directly with Binance 16’s own key. At 20:41:23, in a separate transaction, the attacker used Binance 14’s owner role on Binance 34 to move 780M USDC, and another 43M USDC followed at 20:59. At 21:04, the attacker swept Binance 14 again to collect deposits that had arrived since the first sweep, including 1,699.9 ETH. Because the delegation was still active, no new signature was needed. The attack appears to be ongoing. Binance 14 continues to be swept, and the most recent sweep moved 128 ETH and 122 token transfers to a fresh receiving address, 0xa97bf. The wallet’s delegation hasn’t changed and still points to the attacker’s sweeper contract, so the attacker can likely keep draining any funds that arrive. Response In a post on X, Binance said its team is aware of reports of a potential security issue and are actively investigating. Around $2.54 billion of the stolen funds has already been frozen, including more than 1.567 billion USDT frozen by Tether, more than 823 million USDC frozen by Circle and about $200 million frozen by Ripple. The attacker also deposited USDT as collateral on Aave and borrowed 20,000 WETH against it. Aave responded by freezing its V3 and V4 lending markets to stop the attacker from borrowing additional funds. Inca Digital is monitoring the situation, tracing the flow of funds and working to determine the root cause of the attack.

A wallet showed up on Hyperliquid the day before NVIDIA earnings. Built a $1.66M long. Closed as earnings hit. Took $24K. Never came back. We screened 84,079 accounts to find trades like this. The full story is in the latest Nothing Escapes Inca: nothingescapesinca.com/p/per…

Southeast Asia-based scam networks steal $10+ Billion from Americans every year. In Cambodia, the structures that made the industry possible remain largely intact. Watch the ScamStateArchitecture launch with @jdanielsims,@NDI, and @inca_digital: youtube.com/watch?v=EeMC4jEg…

We're hiring for multiple roles, including: ⚖️ Senior Manager, Lawfare 📊 Advanced Analytics Crypto Expert 🎬 Senior Video Editor, Motion & Narrative 💼 Sales Director, Traditional Finance Remote-first, flexible hours, workations worldwide. Apply here: job-boards.greenhouse.io/inc…

Inca Digital is hiring. Blockchain forensics, OSINT, and financial crime intelligence, with open roles across investigations, engineering, comms, legal, and finance. Remote-first. Flexible hours. Workations worldwide. Apply here: inca.digital/careers/#roles

Pig butchering isn't a small-time scam. It's a tens-of-billions-a-year industry run like a cartel. Inca CEO @AdamZarazinski joined @austincampbell on the Zero In podcast to break down the mule accounts, money flows, and laundering-as-a-service behind it. youtube.com/watch?v=oW8qInDG…

We're hiring! Work from anywhere, on your schedule, with workations worldwide. 📣 Brand & Communications Lead 🎬 Lead Editor 📊 Advanced Analytics Crypto Expert ⚖️ Senior Manager, Lawfare 📒 Staff Accountant Apply here: inca.digital/careers/#roles

Traditional finance and crypto have long been treated as separate, siloed worlds. Inca's VP of Global Business Greg Favitta explains how Inca finds the commonalities. youtube.com/shorts/RREZo9T4l…

Traditional government contractors lack a critical capability: intelligence at the intersection of crypto and traditional finance. Greg Favitta, Inca's VP of Global Business, explains why they need companies like Inca Digital. youtube.com/shorts/K4yODz73H…

Inca Digital is headed to @Sibos in Miami Beach, starting Sept 28. 🌴 In town? Let's talk blockchain intelligence, financial crime, and digital asset risk. DM us to grab time with the team.

The scam compounds are empty. The architecture behind them isn't. Hun To, cousin of Cambodia's PM, still holds 30% of Huione Pay - zero accountability. Our new report authored by @jdanielsims and co-published with @NDI, breaks down why. Read now: nothingescapesinca.com/p/sca…

Cambodia's scam compounds are mostly empty. The system that built them isn't. Scam State Architecture, a new report on Cambodia's state-crime nexus by Inca Senior Advisor @jdanielsims, launches tomorrow at a closed-door event in DC. Limited seats. DM us for an invite.