Binance Hack Began With $296 Million XRP Drain After 36-Hour Setup

The incident began with 233.46 million XRP, worth about $296 million, moving from five Binance wallets to one attacker-controlled address Oct. 29.

The transfers occurred between 4:05 and 4:09 p.m. ET (20:05–20:09 UTC) on Oct. 29. Transfers across 10 blockchains totaled about $6.36 billion through 8:30 p.m. ET on Oct. 29, valued at each asset’s price at the time of transfer. Binance estimated the incident’s impact at about $6.3 billion.

On-chain activity showed preparation beginning at least 36 hours before the transfers. The operator wallet received three small withdrawals from Tornado Cash on the morning of Oct. 28, and the operator tested code on Ethereum wallets before the main activity.

Binance’s preliminary investigation pointed to a possible compromise of a DevOps engineer’s laptop that could have given the attacker access to a service container used to submit unauthorized withdrawals. The exchange said it found no evidence of a wallet private key leak and would cover all losses. Binance said it plans to publish a technical post-mortem when its investigation is complete.