A record cryptocurrency theft linked to Binance began with the movement of about $296 million in XRP, according to an investigation by blockchain intelligence firm TRM Labs. The attacker had spent at least 36 hours preparing and testing the operation before coordinated transfers spread across 10 blockchains.
TRM’s findings, reported by CryptoSlate, put the total value of transfers traced by 00:30 UTC on Oct. 30 at approximately $6.36 billion. Most of the funds left Binance-linked wallets within roughly 20 minutes, although further wallet sweeps continued for several hours.
Preparations preceded the attack
The earliest activity identified by TRM occurred on the morning of Oct. 28. An attacker-controlled wallet received three small transfers from Tornado Cash, a cryptocurrency mixing service.
On the following day, the attacker deployed malicious smart-contract code and tested it against two newly created Ethereum wallets. A revised version was then deployed and rehearsed against a third wallet. In that test, funds were transferred successfully and subsequently returned.
The main operation began about four hours after the last rehearsal. The preparation period is significant because it shows that the transfers were not a single isolated transaction, but a coordinated operation involving testing, revised code and activity across several networks.
XRP transfer opened a wider sweep
Between 20:05 and 20:09 UTC, five Binance wallets on the XRP Ledger sent approximately 233.46 million XRP, valued at $296 million, to one address controlled by the attacker. On-chain investigator Wazz Crypto described the XRP movement as an early warning that preceded activity on other networks.
Suspicious transfers from Binance wallets on Solana and Optimism were detected by 20:10 UTC. At 20:20 UTC, a Binance Bitcoin wallet transferred 18,270 BTC, worth approximately $1.47 billion. The attacker immediately divided the bitcoin into smaller batches of 1,000 BTC and 100 BTC.
Two minutes later, a Binance wallet on Tron transferred 612.7 million USDT and 46.4 million TRX. The combined value of those assets was approximately $628 million.
The Ethereum-related activity unfolded at around the same time. The attacker submitted 50 previously signed EIP-7702 authorizations to a Binance hot wallet. EIP-7702 is an Ethereum mechanism that can allow a wallet to delegate transaction execution to smart-contract code. In this case, the authorizations enabled a malicious contract to carry out the asset transfers.
Three minutes and 24 seconds after the authorizations were submitted, the attacker activated the contract’s sweeping function. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
The operation was not over after the initial wave. Additional sweeps took place at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC as more assets reached the compromised wallet. The delegated wallet also used existing permissions over another Binance smart account, helping transfer a further 823 million USDC.
A second wave of activity around 23:05 UTC reached additional Binance wallets on Avalanche and Polygon. TRM ultimately traced transfers across Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
Authorization remains the key unanswered question
Although investigators reconstructed the timing and movement of the funds, they have not determined how the attacker obtained the authorizations needed for the EIP-7702 transaction.
Derek Chiang, a researcher at Ethlabs, said the attacker may have obtained the wallet’s private key or persuaded its owner to sign a malicious authorization. He also stressed that a valid authorization was required to execute the EIP-7702 operation.
The distinction matters because the incident involved more than the deployment of a contract. The attacker needed the permissions that allowed the contract to act through the Binance wallet. The source of those permissions is therefore central to understanding how the compromise occurred.
Moneyiar market picture
Moneyiar market data at the stated times showed XRP at $1.2991099051, up 0.56% over 24 hours and 0.09% over seven days, as of Oct. 25 at 22:38 +03:30. BNB was priced at $740.8618136891, with a 24-hour gain of 0.81% and a seven-day rise of 3.32%, as of Oct. 25 at 22:39 +03:30.
The same Moneyiar data showed Cronos at $0.054290275, down 1.83% over 24 hours and 3.03% over seven days, and Telcoin at $0.0014157918, down 0.97% and 7.28% over those periods, respectively. Both figures were recorded at 22:39 and 22:38 +03:30, respectively, on Oct. 25. These market readings are separate from the transaction values cited in TRM’s reconstruction.
