The 6.36 Billion USD Binance Hack Started With 296 Million USD in XRP: Inside the Ten-Chain Attack Timeline

The largest cryptocurrency theft in history did not begin with Bitcoin. According to an October 29 investigation by blockchain intelligence firm TRM Labs, the attack that ultimately drained approximately 6.36 billion USD from Binance opened with a 296 million USD transfer of XRP, executed ten minutes before anything moved on the other nine blockchains the attackers targeted.

For XRP holders, the details are a sobering look at how quickly a single exchange’s hot wallets can be emptied, and why the ledger’s speed is no defense when the keys are compromised.

## Thirty-six hours of preparation

TRM traced the earliest preparations to the morning of October 28, when an attacker-controlled wallet received three small transfers from Tornado Cash, the cryptocurrency mixing service. The next day, the attacker deployed malicious smart-contract code and tested it against two newly created Ethereum wallets, then deployed a revised version and rehearsed the operation on a third wallet, successfully moving test funds before returning them. About four hours after that final rehearsal, the live attack began.

The preparation distinguishes this from an opportunistic exploit. TRM described coordinated transfers across ten blockchains executed over a single evening, with most of the funds leaving Binance-linked wallets within approximately twenty minutes.

## The XRP Ledger went first

Between 20:05 and 20:09 UTC on October 29, five Binance wallets on the XRP Ledger transferred approximately 233.46 million XRP, valued at 296 million USD, into a single attacker-controlled address. XRP traded around 1.24 USD at the time of writing, according to CoinGecko data, which squares with the valuation TRM assigned to the haul.

On-chain investigator Wazz Crypto, cited in the TRM report’s aftermath, called the XRP movement “the canary in the coal mine,” noting it apparently started ten minutes before all the other chains. By 20:10 UTC, suspicious transfers had begun from Binance wallets on Solana and Optimism.

The sequence matters for anyone monitoring exchange reserves. If the XRP Ledger transfers were visible first, on-chain watchers had a narrow window in which the rest of the attack was still unfolding elsewhere.

## Ten chains, twenty minutes, billions gone

At 20:20 UTC, a Binance Bitcoin wallet transferred 18,270 BTC worth approximately 1.47 billion USD, which the attacker immediately began splitting into batches of 1,000 BTC and 100 BTC. Within two minutes, a Binance wallet on Tron moved another 612.7 million USDT and 46.4 million TRX, worth roughly 628 million USD combined.

The Ethereum operation ran almost simultaneously. The attacker submitted 50 previously signed EIP-7702 authorizations to a Binance hot wallet, letting it delegate execution to a malicious smart contract. The authorizations covered consecutive transaction counts, guaranteeing one would match the wallet’s current state. Three minutes and twenty-four seconds later, the attacker triggered the contract’s sweeping function, moving 167,464 ETH and 63 tokens, including 1.615 billion USDT, in a single transaction. Additional sweeps followed at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 UTC.

The delegated wallet also used existing permissions over a separate Binance smart account to transfer another 823 million USDC, and a second wave around 23:05 UTC reached additional Binance wallets on Avalanche and Polygon. By 00:30 UTC on October 30, TRM had traced approximately 6.36 billion USD across Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.

## The unanswered question

Investigators have reconstructed the sequence in remarkable detail, but the source of the authorizations remains unresolved. Ethlabs researcher Derek Chiang said the attacker either obtained the wallet’s private key or tricked its owner into signing a malicious authorization, and emphasized that the EIP-7702 operation required valid authorization to execute. In other words, someone or something with legitimate credentials opened the door.

That is the part XRP holders, and every exchange customer, should sit with. The XRP Ledger settled its part of the attack flawlessly and fast, exactly as designed. The failure happened at the layer of keys and permissions above it, and no blockchain’s throughput protects against that.

## What it means for XRP investors

The practical takeaway is about custody concentration. Nearly a quarter of a billion USD in XRP left five hot wallets in under five minutes because those wallets shared a compromised authorization path. If you keep meaningful holdings on an exchange, this week is a reminder that the exchange’s security posture is now your security posture. Binance has pledged to cover losses through its SAFU fund, and stablecoin issuers have frozen a portion of the stolen funds on-chain, but recovery remains partial and the investigation is ongoing.

The attack also puts fresh attention on how exchanges manage EIP-7702-style delegations and smart-account permissions. A system designed to make wallets more flexible just demonstrated, at a cost of 6.36 billion USD, how much depends on who holds the authorizations. For XRP, the story is not about the token or the ledger. It is about what sat above them, and who was watching when the canary stopped singing.

Disclaimer: This article is for informational purposes only and does not constitute financial advice.