Key Points

• Hackers prepared for at least 36 hours before attacking Binance.
• Five Binance wallets first lost 233.46 million XRP.
• Investigators traced the flow of $6.36 billion across 10 blockchain networks

According to a new blockchain investigation, this record-breaking $6.3 billion Binance hack began with the theft of approximately $296 million in XRP. The investigation shows that the attackers prepared for at least 36 hours before carrying out their attack.

On October 29th, TRM Labs stated in a survey that between 20:05 and 20:09 Coordinated Universal Time, 233.46 million XRP were transferred out of 5 Binance wallets. These funds first reached a single address controlled by the attackers, after which large-scale transfers of Bitcoin and Ethereum began to occur.

These findings complement Coinpaper's previous investigation into the Binance hack incident, providing a more detailed account of how the attackers collaborated to carry out the largest cryptocurrency theft case on record.

Before clearing the XRP wallet, Binance hackers conducted attack drills.

TRM Labs tracking has revealed that the preparatory work can be traced back to the morning of October 28th, when a wallet controlled by the attacker received three small transfers from Tornado Cash. Tornado Cash is a type of cryptocurrency mixing service.

The next day, the operator deployed malicious Ethereum code and tested it on two newly created wallets. Subsequently, the revised version was tested again through a third wallet.

About 4 hours after the last drill, the same piece of code was installed onto a Binance Ethereum hot wallet.

However, the first confirmed theft occurred on XRP Ledger.

Between 20:05 and 20:09 UTC, 5 Binance wallets transferred a total of 233.46 million XRP to the same destination address, worth approximately 296 million US dollars.

After these transfers are completed, each wallet will only have a balance of XRP sufficient to meet the minimum requirements. TRM indicates that, at the time of the investigation, the stolen XRP has not yet been transferred.

These coordinated transfers are part of a larger-scale operation, and not evidence of vulnerabilities in the XRP Ledger underlying protocol.

The reason this is important is that developers are also separately advancing security improvements for the XRPL token, including authorization control for already issued assets.

A few minutes later, Bitcoin and Ethereum wallets were also emptied.

After XRP was transferred out, this operation quickly spread.

At around 20:20 Coordinated Universal Time, a hot wallet of Bitcoin on Binance transferred 18,270 BTC to an address controlled by the attackers, worth approximately 1.47 billion US dollars.

Subsequently, these bitcoins were split into multiple smaller transfers, increasing the difficulty of tracking the stolen funds.

On the Ethereum network, attackers utilized the delegation feature of the EIP-7702 account to install malicious execution instructions on a Binance hot wallet.

TRM identified 50 pre-signed authorizations, which allowed the attacker to carry out a large-scale cleanup operation involving 167,464 ETH and another 63 types of tokens.

The initial Ethereum cleanup involved approximately 1.615 billion USDT, while other unauthorized transfers continued to occur that same night.

As of 00:30 Coordinated Universal Time on October 30th, investigators have identified transfers across 10 blockchain networks, totaling approximately $6.36 billion.

This investigation also provides additional context for the large amounts of Ethereum balances found in wallets later associated with the attackers.

Investigators suspect that it was the work of hackers associated with North Korea.

TRM Labs attributes a high degree of confidence to this action to TraderTraitor, a hacking group associated with North Korea and previously linked to several major cryptocurrency theft cases.

The company stated that the basis for this judgment includes similarities in preparation methods, wallet activities, and transaction patterns.

However, Binance has not yet independently confirmed the identity of the perpetrator.

In the preliminary investigation, the exchange identified a compromised employee laptop as a possible entry point for the attack. Subsequent findings indicated that there were other vulnerabilities as well, so the exact mechanism of the attack has not yet been determined.

Binance stated that it has frozen approximately $3 billion in affected assets and pledged to compensate customers through its emergency protection fund and company resources.

This attack also triggered broader market fluctuations. As investors re-evaluated the risks associated with the exchanges, BNB tumbled significantly. Coinpaper had previously discussed in its analysis of BNB's price that the token could fall below $700.