The Binance hack was rehearsed. Twice, on mainnet, in public, hours before it happened.

At 13:51 UTC on October 29, a wallet funded only through Tornado Cash delegated two fresh wallets of its own to an unverified sweeper contract, seeded them with a few dollars of stablecoins and emptied them. At 16:20 it ran the full sequence with its production contract: delegate, sweep, leave 1 ETH, withdraw. Its first sweeper had been on-chain since 02:28. Six hours and 29 minutes after the first rehearsal, it ran the same play on Binance 14, one of the exchange's main Ethereum hot wallets.

We rebuilt the whole attack from the Ethereum record, live balance reads on six chains, and 53,181 posts across X, TikTok, YouTube, Instagram, Reddit and news. Here is what happened, how fast the public pieced it together, and where the money sits now.

The attack in six acts

I. The setup. About 1.49 ETH of Tornado Cash withdrawals, starting at 07:39 on October 28, funded the operator. That was the operation's entire budget.…