In-depth Analysis of the $6.36 Billion Binance Crypto Heist: A 36-Hour Preparation for a Coordinated Attack

Massive Security Breach at Binance

In a significant security breach, the Binance cryptocurrency exchange suffered a massive theft totaling $6.36 billion, which began with an initial transfer of $296 million in XRP. An investigation conducted by blockchain analytics firm TRM Labs has uncovered that the hacker meticulously orchestrated this operation over a period of 36 hours, starting preparations on October 28.

The Attack Unfolds

The attack unfolded on the evening of October 29 as the perpetrator executed a series of coordinated transactions across ten different blockchains. TRM Labs reported that nearly all funds transferred from wallets associated with Binance were moved within a swift timeframe of roughly twenty minutes, marking it the largest heist in the history of cryptocurrency.

The preparation period included the hacker gaining access to an attacker-controlled wallet, where they received three minor transfers from Tornado Cash, a service notorious for mixing cryptocurrencies to obscure transaction origins.

Preparation and Execution

On October 29, prior to executing the main attack, the hacker deployed and tested suspicious smart contract code against newly minted Ethereum wallets, on two occasions, and subsequently refined their approach after conducting a successful mock operation on a third wallet. This rehearsal was a crucial step before launching the major assault just four hours later.

Details of the Heist

Between 20:05 and 20:09 UTC, the attack commenced with the movement of 233.46 million XRP, or approximately $296 million, from five Binance wallets on the XRP Ledger to a single address controlled by the attacker. Following this, inexplicable transfers began to filter in from Binance wallets on other chains, including Solana and Optimism.

By 20:20 UTC, an alarming transfer of 18,270 BTC, equivalent to around $1.47 billion, was executed from a Binance Bitcoin wallet. The attacker quickly divided these assets into smaller denominations of 1,000 and 100 BTC.

Simultaneously, a transfer from a Binance wallet on Tron delivered 612.7 million USDT and 46.4 million TRX—worth approximately $628 million—within mere minutes. The Ethereum blockchain was not exempt from this operation either; at the same 20:20 UTC mark, the hacker used prior signed authorizations to allow a Binance hot wallet to pass transactions onto a malicious smart contract.

This tactic involved pseudo-executing the authorization to facilitate a large transfer of 167,464 ETH along with numerous tokens, including 1.615 billion USDT, in one fell swoop. Additional asset sweeps were conducted throughout the evening, extending the heist until around midnight, with assets also being siphoned from Binance wallets on Avalanche and Polygon.

Aftermath and Investigation

By 00:30 UTC on October 30, TRM reported tracking $6.36 billion in illicit transfers across various blockchains such as Ethereum, Bitcoin, and Solana, among others. The means by which the hacker secured the necessary authorizations for this massive operation remain unknown. Ethlabs researcher Derek Chiang suggested that the attacker may have either acquired the private key of the wallet or employed methods to deceive the wallet owner into signing off on malicious authorization requests.

Valid authorization was essential for the execution of the EIP-7702 operation, highlighting the sophisticated nature of this cybercriminal strategy.