Binance hack began with $296 million XRP drain after 36-hour setup, TRM says
In brief
- Preparation began Oct. 28 with three small Tornado Cash transfers, TRM Labs says.
- Five Binance XRP Ledger wallets sent 233.46 million XRP, worth $296 million, in four minutes.
- Fifty pre-signed EIP-7702 authorizations let the attacker sweep a Binance Ethereum hot wallet.
- TRM traced about $6.36 billion across 10 blockchains by 00:30 UTC on Oct. 30.
- How the attacker obtained the authorizations remains unresolved.
A rehearsal that started with Tornado Cash
TRM traced the earliest preparations to the morning of Oct. 28, when an attacker-controlled wallet received three small transfers from Tornado Cash, the mixing service. Early the next day, the attacker deployed malicious smart-contract code and tested it against two newly created Ethereum wallets. A revised version came next (rehearsed on a third wallet, with the test funds moved and then returned).
The main attack began about four hours after that final rehearsal.
XRP went first. Between 20:05 and 20:09 UTC, five Binance wallets on the XRP Ledger sent about 233.46 million XRP, worth $296 million, to a single attacker-controlled address. By 20:10 UTC, suspicious transfers had also started from Binance wallets on Solana and Optimism. On-chain investigator Wazz Crypto pointed to the timing:
"This was actually the canary in the coal mine as the Ripple hack [sic] apparently started 10 mins before all the other chains."
EIP-7702 and the sweep
At 20:20 UTC, a Binance Bitcoin wallet sent 18,270 BTC (about $1.47 billion), and the attacker immediately split it into batches of 1,000 BTC and 100 BTC. Within two minutes, a Tron wallet sent 612.7 million USDT and 46.4 million TRX, worth about $628 million combined.
The Ethereum leg was the technical one. Also at 20:20 UTC, the attacker submitted 50 pre-signed EIP-7702 authorizations to a Binance hot wallet, letting it delegate execution to a malicious contract. They covered consecutive transaction counts, so one would match the wallet's current count when processed. Three minutes and 24 seconds later, the sweeping function moved 167,464 ETH and 63 tokens, including 1.615 billion USDT, in a single transaction. Six more sweeps followed through 23:56 UTC as assets kept landing in the compromised wallet, and the delegated wallet used its existing permissions over a separate Binance smart account to move another 823 million USDC.
A second wave around 23:05 UTC hit Avalanche and Polygon. By 00:30 UTC on Oct. 30, TRM had traced about $6.36 billion in transfers across Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
Root cause still open
Where the authorizations came from hasn't been resolved. Ethlabs researcher Derek Chiang said the attacker could've obtained the wallet's private key or tricked its owner into signing a malicious authorization. He stressed that valid authorization was needed to carry out the EIP-7702 operation.
CryptoSlate's report called it the largest crypto theft on record. It didn't include a Binance statement, and LeoDex News couldn't independently confirm the totals.
Frequently asked questions
How did the attacker use EIP-7702 in the Binance hack?
According to TRM Labs, the attacker submitted 50 pre-signed EIP-7702 authorizations to a Binance hot wallet at 20:20 UTC, letting it delegate execution to a malicious smart contract. The authorizations covered consecutive transaction counts so one would match. Three minutes and 24 seconds later, a sweep moved 167,464 ETH and 63 tokens in one transaction.
How did the attacker get the authorizations needed for the attack?
That's still unresolved. Ethlabs researcher Derek Chiang said the attacker could have obtained the wallet's private key or tricked its owner into signing a malicious authorization. He stressed that valid authorization was needed to carry out the EIP-7702 operation.
