The hacker group is said to have conducted test transactions at least 36 hours in advance, then "fully attacked" Binance, quickly draining money from many wallets in just 20 minutes.

Reuters quoted data analysis company TRM Labs (USA) as saying that hackers penetrated Binance's "signing infrastructure" - the system that approves transactions, helping them issue withdrawal orders from affected wallets. Binance confirmed the attack affected approximately $6.3 billion.

Blockchain data shows that most of the money was withdrawn in about 20 minutes, starting at 8:05 p.m. on October 29 (3:00 a.m. on October 30, Hanoi time), including Ethereum, Bitcoin, Tron, Solana, and transferred to many addresses controlled by the same attack group.

"The preparation process began at least 36 hours before the hack occurred," TRM Labs said. Specifically, the attacker's wallet received 3 small withdrawals during the testing period on the morning of October 28. By early October 29, the attacker deployed the first code for the hack and continued testing it on two wallets. They test the final version on a third wallet, then transfer the test funds back to their own wallet.

Four hours later, the code was installed on a Binance hot wallet.

The first official withdrawal occurred on the XRP Ledger blockchain network. From 8:05 p.m. to 8:09 p.m. on October 29, UTC time zone, 5 Binance wallets transferred a total of 233.46 million XRP to an address controlled by the attacker group, causing the balance in each wallet to be minimal. Binance wallets on the Solana and Optimism blockchain networks were also affected shortly after.

At 8:20 p.m., a Binance Bitcoin hot wallet continued to transfer 18,270 Bitcoin to the attack group's address. The money was broken into parts of about 1,000 and 100 BTC, making it difficult to trace. Within the next two minutes, a Binance hot wallet on the Tron network also transferred 612.7 million USDT and 46.4 million TRX to the attack group. They then quickly sought to take the funds out of the control of Binance trading partners and stablecoin issuers.

According to Reuters, several blockchain analysis companies commented that the Binance hack had similarities with previous activities believed to have been carried out by North Korean hackers. Richard Teng, co-CEO of Binance, said the company is investigating but has not yet identified the culprit, while North Korea regularly denies involvement in cyber attacks and cryptocurrency theft.

On October 30, Binance shared on X that they initially assessed that the hack may have originated from a compromised DevOps engineer's laptop. "However, our subsequent investigation discovered additional intrusion points," the world's largest cryptocurrency exchange said, without providing further details.

Binance announced that it "will compensate all losses through the Secure Asset Fund for Users (SAFU) and the company's funds", confirming that user funds are still safe. SAFU was established by Binance in 2018, to protect users in emergency situations. The fund currently holds one billion USD worth of Bitcoin.

Although he no longer directly runs the company, billionaire Changpeng Zhao (CZ), former CEO and founder of Binance, said that as a shareholder, he expects all user assets to be guaranteed. The war of words on social networks between him and billionaire Elon Musk, CEO of Tesla and SpaceX, after the hack is also attracting a lot of attention.

From LuBian's 127,000 Bitcoin theft in 2020 to the Binance attack, cryptocurrency history now records three hacks with values ​​exceeding one billion USD. Experts say that Binance's incident could reach the largest scale in the history of digital currency exchanges, many times greater than the damage that Bybit encountered last year, when hackers stole about 1.5 billion USD.

Thu Thao summary