Binance Hack: $6.36 Billion Drained in 20 Minutes After Attacker Preparation Period

TRM's account shows the attacker rehearsed before the main operation. Tornado Cash deposits reached an attacker-controlled wallet on the morning of October 28, and the malicious code was tested on two new Ethereum wallets and then on a third, where test funds were moved and returned. The main attack began about four hours after that final rehearsal.

Disagreement on Preparation Time

Sources differ on how long the attackers were active before the theft. TRM Labs, in its October 29 investigation, describes a preparation window of at least 36 hours beginning on October 28. Crypto Briefing reports that the attackers reportedly had access to Binance systems for eight weeks, with preparation starting no later than June 2026, and that testing of internal access took place about 36 hours before the attack. The two accounts are not contradictory on the 36-hour figure, but the eight-week claim has no corresponding on-chain trail in the TRM reporting and rests on the reported timeline of Binance's own investigation. Readers should treat the eight-week figure as reported rather than independently confirmed.

How Access Was Obtained

The source of the authorizations remains unresolved. Ethlabs researcher Derek Chiang said the attacker could have obtained the wallet's private key or induced its owner to sign a malicious authorization. Crypto Briefing, citing Binance's investigation, says the breach came from a multi-layered social engineering campaign that included a fake job interview and tampered software development tools, and that private keys were not compromised. Binance's account and TRM's on-chain reconstruction do not yet reconcile on this point.

Response and Recovery

Binance paused withdrawals immediately and reopened them in phases. The exchange said it allocated about $6.34 billion from corporate resources to cover losses, and by October 31 indicated that roughly 98% of the stolen assets had been replenished. Partners and stablecoin issuers froze or intercepted an estimated $2.85 billion to $3 billion of the stolen funds. Binance has also commissioned an independent security review.

Why It Matters

For Traders

Withdrawal reopening and the 98% replenishment claim are the near-term variables to watch, as they bear on exchange balances and liquidity conditions.

For Investors

A $6.36 billion breach that Binance says it covered from corporate reserves raises questions about exchange custody risk that will likely shape counterparty assessments.

For Builders

The EIP-7702 delegation vector and the approval-pipeline compromise show that hot wallet security depends on internal authorization controls, not just key protection.