Twenty Minutes, Ten Blockchains: The Binance Heist In Numbers - CIO Africa

The first sign of trouble was small. On the morning of 28 October, a wallet identified by TRM Labs as belonging to the attacker received three small withdrawals from Tornado Cash, a mixing service. That was at least 36 hours before the theft.

The following day, the attackers rehearsed. According to TRM's reconstruction, they deployed attack code on two wallets, tested a final version on a third, and routed the test funds back to themselves. About four hours later, the same code was deployed against a Binance hot wallet.

Twenty Minutes

At 20:05 UTC on 29 October, five Binance XRP wallets sent 233.46 million XRP to a single address. Within minutes, wallets on Solana and Optimism were drained. At 20:20, Binance's Bitcoin hot wallet sent out 18,270 BTC, worth about $1.47 billion.

The largest transfer came from Ethereum. At 20:20, the hot wallet authorised a sweeper contract using one of 50 authorisations signed in advance. About three minutes and 24 seconds later, the contract emptied the wallet, transferring 167,464 ETH and 1.615 billion USDT, among 63 tokens, according to TRM.

By the end, funds had left Binance across ten blockchains. TRM estimates the haul at about $6.36 billion, based on prices at the time of each transfer. This included roughly $3.79 billion on Ethereum, $1.47 billion in Bitcoin, $628 million on Tron, $296 million in XRP and $96 million on Solana.

How the Money Got Out

Binance has not disclosed how the attackers gained access. Its initial statement pointed to a compromised DevOps engineer's laptop, which provided access to a service container used to submit unauthorised withdrawals. The company later said its investigation had identified 'additional points of breach.'

Binance says no wallet private key was leaked. Co-CEO Richard Teng also said the attack was not a single-permission, one-click operation. No root cause has been published.

Outside analysts have offered their own assessments. TRM believes Binance's signing infrastructure was compromised, given that funds were taken across ten chains using different key and signing schemes. Elliptic says the attacker did not steal keys but instead manipulated Binance's own systems into signing transactions.

The Race to Freeze

While the sweeps were still underway, stablecoin issuers began freezing assets. At 21:01 UTC, about 40 minutes after the main transfer, Tether froze $971.1 million in USDT in the attacker's main receiving wallet. Circle froze $823 million in USDC there at 21:04.

Ripple froze 40.5 million RLUSD at 22:01, while World Liberty Financial froze 27.8 million USD1 at 22:10. At 00:08 on 30 October, the Arbitrum Security Council forced about $30 million in ETH and ARB out of the attacker's control.

Overall, TRM counted about $2.7 billion frozen by 00:30 UTC on 30 October. Elliptic put the figure at $2.84 billion, while Binance said about $3 billion had been frozen the following day. Elliptic estimates the attacker's remaining holdings at about $3.33 billion across 43 wallets.

Making Customers Whole

Binance's response to customers rests on a promise and a ledger. The company says it has set aside more than $6.34 billion of its own resources to restore every balance on a one-for-one basis. About $5 billion is already held in the same assets that were stolen.

The remainder is being acquired through public markets and over-the-counter transactions, according to CoinDesk. Binance says the money does not come from customer funds and that frozen assets are separate from its reserves. It is also drawing on its Secure Asset Fund for Users (SAFU), its emergency fund.

Deposits remained open. Withdrawals were suspended, with Binance saying it expected to resume them within 45 to 48 hours. For context, DefiLlama put Binance's assets at about $144 billion before the theft, making the loss roughly 4 per cent of its assets.