Key takeaways Hackers prepared Binance attack at least 36 hours Five Binance wallets lost 233.46 million XRP first Investigators trace $6.36 billion across ten blockchain networks The record-
The record-breaking $6.3 billion Binance hack began with the theft of approximately $296 million in XRP, according to a new blockchain investigation revealing how attackers prepared for at least 36 hours before executing the operation.
In its October 29 investigation, TRM Labs identified 233.46 million XRP transferred from five Binance wallets between 20:05 and 20:09 UTC. The funds reached a single attacker-controlled address before major withdrawals began on Bitcoin and Ethereum.
The findings expand on Coinpaper's earlier Binance hack investigation, offering a detailed reconstruction of how attackers coordinated the largest cryptocurrency theft on record.
Binance Hackers Rehearsed Attack Before Draining XRP WalletsTRM Labs traced preparations to the morning of October 28, when an attacker-controlled wallet received three small withdrawals from Tornado Cash, a cryptocurrency mixing service.
The following day, the operator deployed malicious Ethereum code and tested it on two newly created wallets. A revised version was subsequently rehearsed using a third wallet.
Approximately four hours after the final rehearsal, the same code was installed on a Binance Ethereum hot wallet.
However, the first confirmed theft occurred on the XRP Ledger.
Between 20:05 and 20:09 UTC, five Binance wallets transferred 233.46 million XRP, worth approximately $296 million, to a single destination.
The withdrawals left each wallet holding only its minimum required XRP balance. TRM reported that the stolen XRP remained unmoved at the time of its investigation.
The coordinated transfers were part of a much larger operation, rather than evidence of a vulnerability in XRP Ledger's underlying protocol.
The distinction matters as developers separately work on XRPL token security improvements, including authorization controls for issued assets.
Bitcoin and Ethereum Wallets Drained Minutes LaterAfter the XRP transfers, the operation spread rapidly.
At approximately 20:20 UTC, a Binance Bitcoin hot wallet transferred 18,270 BTC, valued at about $1.47 billion, to an attacker-controlled address.
The Bitcoin was subsequently divided into smaller transfers, complicating efforts to follow the stolen funds.
On Ethereum, attackers exploited EIP-7702 account-delegation functionality to install malicious execution instructions on a Binance hot wallet.
TRM identified 50 pre-signed authorizations prepared in advance, allowing the attacker to execute a sweeping operation involving 167,464 ETH and 63 additional tokens.
The initial Ethereum sweep included approximately 1.615 billion USDT, while other unauthorized transfers continued throughout the evening.
By 00:30 UTC on October 30, investigators had identified approximately $6.36 billion in transfers across ten blockchain networks.
The investigation adds context to the large Ethereum balances subsequently discovered in attacker-linked wallets.
Investigators Suspect North Korean HackersTRM Labs attributed the operation with high confidence to TraderTraitor, a North Korea-linked hacking unit previously associated with major cryptocurrency thefts.
The company cited similarities in preparation methods, wallet activity and transaction patterns.
However, Binance has not independently confirmed the perpetrators.
The exchange's preliminary investigation initially identified a compromised employee laptop as a possible entry point. Subsequent findings suggested additional vulnerabilities, leaving the precise mechanism unresolved.
Binance reported freezing approximately $3 billion in affected assets and pledged to reimburse customers through its emergency protection fund and corporate resources.
The attack also triggered wider market volatility, with BNB falling sharply as investors reassessed exchange-related risks. Coinpaper's BNB price analysis examined the token's breakdown below $700.
