Cryptocurrency-themed drinks featuring XRP and Bitcoin symbols

The Binance Hack Began With a $296 Million XRP Drain After 36 Hours of Preparation

By Isaac • October 30, 2026 8:06 am • Comments

The first visible move in the record-setting Binance breach was not a giant Bitcoin transfer or an Ethereum sweep. It was XRP.

According to a detailed CryptoSlate summary of TRM Labs’ on-chain investigation, five Binance wallets on the XRP Ledger moved roughly 233.46 million XRP—worth about $296 million at the time—into one attacker-controlled address between 20:05 and 20:09 UTC on October 29.

That was the opening bell for a much larger operation. Suspicious transfers began appearing on Solana and Optimism minutes later.

Trending: Binance Says Compromised Engineer Laptop Opened the Door to Massive Security Breach

By 20:20 UTC, a Binance Bitcoin wallet had sent 18,270 BTC worth approximately $1.47 billion, while activity on Tron and Ethereum followed almost simultaneously.

The XRP movement was the earliest obvious sign that something far larger was underway. Its timing closely matched the sequence later reconstructed by TRM.

The order matters. It suggests the attacker was not improvising after stumbling into one vulnerable wallet.

The transactions were coordinated across chains, assets and signing systems, with the first major transfer beginning only after a long preparation period.

TRM traced the preparation back to the morning of October 28, when an attacker-controlled wallet received three small transfers from Tornado Cash. Early the next day, the attacker deployed malicious smart-contract code, tested it against two newly created Ethereum wallets, revised it and ran another rehearsal on a third wallet.

The final test reportedly succeeded roughly four hours before the main attack. Once the operation began, most of the affected funds left Binance-linked wallets in about 20 minutes.

On Ethereum, the attacker submitted 50 previously signed EIP-7702 authorizations to a Binance hot wallet. The authorizations covered consecutive transaction counts, increasing the chance that one would match the wallet’s live state.

A malicious contract then swept 167,464 ETH and 63 other tokens in one transaction, according to the investigation summarized by CryptoSlate.

Ethlabs researcher Derek Chiang cautioned that EIP-7702 itself was not broken. His explanation is important because the attack appears to have required a valid authorization—potentially obtained through a compromised private key or a malicious signature—rather than a flaw that automatically endangers every wallet using the upgrade.

The transfers ultimately touched Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. TRM had traced about $6.36 billion in suspicious movement across those ten networks by 00:30 UTC on October 30.

The Bitcoin portion was quickly split into smaller batches, while the Ethereum wallet carried out additional sweeps as more assets arrived. A second wave later extended the operation to additional wallets on Avalanche and Polygon.

The chain-level timeline is increasingly clear. The unresolved question is how the attacker obtained the permissions needed to make those transactions look valid to Binance’s signing infrastructure.

Until that is established, the XRP transfer remains more than a dramatic first move: it is the cleanest marker of when a carefully rehearsed operation became a live attack.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews