An attacker drained $6.36 billion in cryptocurrency from Binance wallets across 10 blockchains on October 29, beginning with a $296 million XRP transfer after spending at least 36 hours preparing and testing the operation, according to a TRM Labs investigation published the same day.
The attacker’s preparation started on October 28 morning, when an attacker-controlled wallet received three small transfers from Tornado Cash, a cryptocurrency mixing service. The attacker then deployed malicious smart-contract code and tested it against two newly created Ethereum wallets early on October 28. A revised version was rehearsed on a third wallet, with test funds successfully transferred and returned before the main attack commenced.
The Attack Sequence
The operation unfolded across multiple blockchains in rapid succession on October 29. Five Binance wallets on XRP Ledger transferred approximately 233.46 million XRP (worth $296 million) between 20:05 and 20:09 UTC. Suspicious transfers began from Binance wallets on Solana and Optimism at 20:10 UTC.
At 20:20 UTC, the Binance Bitcoin wallet transferred 18,270 BTC ($1.47 billion), while the Binance Tron wallet transferred 612.7 million USDT and 46.4 million TRX ($628 million combined). At the same time, the attacker submitted 50 EIP-7702 authorizations to the Binance hot wallet.
EIP-7702 authorizations allowed the attacker to delegate execution to a malicious smart contract. The authorizations covered consecutive transaction counts to ensure one would match the wallet’s current count when processed. Three minutes and 24 seconds after submitting the authorizations, at 20:23:24 UTC, the attacker activated the contract’s sweeping function, transferring 167,464 ETH and 63 tokens, including 1.615 billion USDT.
Additional sweeps executed at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 UTC. A second wave extended the operation to Binance wallets on Avalanche and Polygon at 23:05 UTC. By 00:30 UTC on October 30, TRM had traced approximately $6.36 billion in transfers across 10 blockchains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.
Technical Mechanics
The delegated wallet exercised existing permissions over a separate Binance smart account to facilitate transfers. The attacker transferred 823 million USDC via the delegated wallet’s existing permissions. Most funds left Binance-linked wallets within approximately 20 minutes.
On-chain investigator Wazz Crypto noted the timing of events across networks: “This was actually the canary in the coal mine as the Ripple hack [sic] apparently started 10 mins before all the other chains.” The XRP Ledger transfer preceded the coordinated sweeps on other blockchains, suggesting the attacker executed the operation sequentially rather than simultaneously.
The TRM Labs investigation reconstructed the full attack sequence across all 10 blockchains affected. The operation demonstrated how EIP-7702 authorizations, a feature enabling contract delegation, could be weaponized against exchange infrastructure when combined with existing wallet permissions and careful preparation.
