A sophisticated attack on Binance resulted in the theft of approximately $6.36 billion in cryptocurrency across 10 blockchains, according to an Oct. 29 investigation by blockchain intelligence firm TRM Labs. The incident marked the largest cryptocurrency theft on record, with most funds leaving Binance-linked wallets within 20 minutes.
TRM traced the earliest preparations to Oct. 28, when an attacker-controlled wallet received three small transfers from Tornado Cash, a cryptocurrency mixing service. The attacker spent approximately 36 hours preparing before executing coordinated transfers the following evening.
Attack Timeline and Execution
Early on Oct. 29, the attacker deployed malicious smart-contract code and tested it against two newly created Ethereum wallets. A revised version was then rehearsed on a third wallet, with test funds successfully transferred and returned before the main operation commenced approximately four hours later.
Between 20:05 and 20:09 UTC on Oct. 29, five Binance wallets on the XRP Ledger transferred approximately 233.46 million XRP, valued at $296 million, into a single attacker-controlled address. On-chain investigator Wazz Crypto noted this XRP transfer began roughly 10 minutes before attacks on other blockchains.
Coordinated Transfers Across Multiple Chains
By 20:10 UTC, suspicious transfers began from Binance wallets on Solana and Optimism. At 20:20 UTC, a Binance Bitcoin wallet transferred 18,270 BTC worth approximately $1.47 billion, with the attacker immediately splitting the funds into smaller batches of 1,000 and 100 BTC.
Within two minutes, a Binance wallet on Tron transferred 612.7 million USDT and 46.4 million TRX, valued at approximately $628 million combined.
Ethereum Operation and Smart Contract Exploitation
At 20:20 UTC, the attacker submitted 50 previously signed EIP-7702 authorizations to a Binance hot wallet, allowing it to delegate execution to a malicious smart contract. Three minutes and 24 seconds later, the attacker activated the contract's sweeping function, transferring 167,464 ETH and 63 tokens, including 1.615 billion USDT, in a single transaction.
Additional sweeps occurred at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC as more assets entered the compromised wallet. The delegated wallet also exercised existing permissions over a separate Binance smart account, facilitating the transfer of another 823 million USDC.
A second wave around 23:05 UTC extended the operation to Binance wallets on Avalanche and Polygon. By 00:30 UTC on Oct. 30, TRM had traced approximately $6.36 billion in transfers across Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
Unresolved Questions on Attack Origin
While investigators have reconstructed the sequence of events, the source of the necessary authorizations remains unclear. Ethlabs researcher Derek Chiang indicated the attacker could have obtained the wallet's private key or tricked its owner into signing a malicious authorization, but emphasized that valid authorization was required to execute the EIP-7702 operation.
