Binance attacker prepared $6.36 billion hack for 36 hours

TRM Labs, a blockchain intelligence firm, reported on Oct. 29 that the attacker responsible for the $6.36 billion hack of Binance spent at least 36 hours preparing the operation before execution. The investigation details a sequence of events that began on Oct. 28, when the attacker initiated the preparatory phase, culminating in coordinated transfers across 10 different blockchains the following evening.

Preparation and Execution Timeline

According to the investigation, the preparatory phase lasted a minimum of 36 hours. The attacker began this process on Oct. 28. The execution of the hack occurred the evening after the preparation started. During this period, the attacker moved from initial setup to the active draining of assets. The total value of the hack is estimated at $6.36 billion. The operation was not a single isolated event but a coordinated effort spanning multiple digital asset networks.

The investigation highlights the duration of the preparation as a key factor in the scale of the breach. The 36-hour window allowed the attacker to arrange the necessary infrastructure and access points required to move funds across 10 blockchains. The timing of the execution, specifically the evening following the start of preparation, suggests a deliberate operational schedule rather than an opportunistic strike.

Initial XRP Drain and Multi-Chain Movement

The hack began with a specific drain of XRP worth $296 million. This initial transfer marked the start of the asset extraction process. Following this first move, the attacker executed coordinated transfers across 10 blockchains. The use of multiple networks indicates a strategy to distribute the stolen assets rapidly and diversify the pathways for moving the funds. The $296 million XRP drain represents a significant portion of the total $6.36 billion value, serving as the primary initial vector for the theft.

TRM Labs identified the specific blockchains involved in the coordinated transfers, noting the complexity of moving assets across such a diverse set of networks. The investigation focuses on the on-chain movements that occurred during the 36-hour preparation and execution window. The firm’s analysis tracks the flow of funds from the initial XRP drain to the subsequent distribution across the other nine blockchains.