Tornado

Million

Ethereum

<div>
 <h3 id="key-takeaways">Key takeaways</h3>
 <ul>
 <li>Hackers prepared Binance attack at least 36 hours</li>
 <li>Five Binance wallets lost 233.46 million XRP first</li>
 <li>Investigators trace $6.36 billion across ten blockchain networks</li>
 </ul>
 The record-breaking $6.3 billion Binance hack began with the theft of approximately $296 million in XRP, according to a new blockchain investigation revealing how attackers prepared for at least 36 hours before executing the operation.
 In its <a href="https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" rel="noopener noreferrer nofollow">October 29 investigation</a>, TRM Labs identified 233.46 million XRP transferred from five Binance wallets between 20:05 and 20:09 UTC. The funds reached a single attacker-controlled address before major withdrawals began on Bitcoin and Ethereum.
 The findings expand on Coinpaper's earlier <a href="https://coinpaper.com/38092/binance-hack-hits-6-3-b-cz-speaks-out-and-north-korea-is-suspected" rel="noopener noreferrer nofollow">Binance hack investigation</a>, offering a detailed reconstruction of how attackers coordinated the largest cryptocurrency theft on record.Binance Hackers Rehearsed Attack Before Draining XRP Wallets 
 TRM Labs traced preparations to the morning of October 28, when an attacker-controlled wallet received three small withdrawals from Tornado Cash, a cryptocurrency mixing service.
 The following day, the operator deployed malicious Ethereum code and tested it on two newly created wallets. A revised version was subsequently rehearsed using a third wallet.
 Approximately four hours after the final rehearsal, the same code was installed on a Binance Ethereum hot wallet.
 However, the first confirmed theft occurred on the XRP Ledger.
 Between 20:05 and 20:09 UTC, five Binance wallets transferred 233.46 million XRP, worth approximately $296 million, to a single destination.
 The withdrawals left each wallet holding only its minimum required XRP balance. TRM reported that the stolen XRP remained unmoved at the time of its investigation.
 The coordinated transfers were part of a much larger operation, rather than evidence of a vulnerability in XRP Ledger's underlying protocol.
 The distinction matters as developers separately work on <a href="https://coinpaper.com/news/crypto" rel="noopener noreferrer nofollow">XRPL token security improvements</a>, including authorization controls for issued assets.Bitcoin and Ethereum Wallets Drained Minutes Later 
 After the XRP transfers, the operation spread rapidly.
 At approximately 20:20 UTC, a Binance Bitcoin hot wallet transferred 18,270 BTC, valued at about $1.47 billion, to an attacker-controlled address.
 The Bitcoin was subsequently divided into smaller transfers, complicating efforts to follow the stolen funds.
 On Ethereum, attackers exploited EIP-7702 account-delegation functionality to install malicious execution instructions on a Binance hot wallet.
 TRM identified 50 pre-signed authorizations prepared in advance, allowing the attacker to execute a sweeping operation involving 167,464 ETH and 63 additional tokens.
 The initial Ethereum sweep included approximately 1.615 billion USDT, while other unauthorized transfers continued throughout the evening.
 By 00:30 UTC on October 30, investigators had identified approximately $6.36 billion in transfers across ten blockchain networks.
 The investigation adds context to the <a href="https://coinpaper.com/38108/ethereum-price-prediction-binance-hacker-reportedly-controls-195-000-eth" rel="noopener noreferrer nofollow">large Ethereum balances</a> subsequently discovered in attacker-linked wallets.Investigators Suspect North Korean Hackers 
 TRM Labs attributed the operation with high confidence to TraderTraitor, a North Korea-linked hacking unit previously associated with major cryptocurrency thefts.
 The company cited similarities in preparation methods, wallet activity and transaction patterns.
 However, Binance has not independently confirmed the perpetrators.
 The exchange's preliminary investigation initially identified a compromised employee laptop as a possible entry point. Subsequent findings suggested additional vulnerabilities, leaving the precise mechanism unresolved.
 Binance reported freezing approximately $3 billion in affected assets and pledged to reimburse customers through its emergency protection fund and corporate resources.
 The attack also triggered wider market volatility, with BNB falling sharply as investors reassessed exchange-related risks. Coinpaper's <a href="https://coinpaper.com/38110/bnb-price-prediction-binance-hack-sends-token-down-8-as-700-support-breaks" rel="noopener noreferrer nofollow">BNB price analysis</a> examined the token's breakdown below $700.
</div>

Binance's $6.3 Billion Hack Started With $296 Million in XRP After 36 Hours of Preparation

Table of Contents

Coinpaper.com

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!