Binance hack began with a $296 million XRP drain after 36-hour preparation
Summary
TRM Labs says an attacker spent at least 36 hours preparing a Binance-linked wallet compromise before moving about $6.36 billion in assets across 10 blockchains. The operation began with $296 million in XRP transfers, then swept Bitcoin, Ethereum, stablecoins and other tokens from Binance wallets over several hours. On Ethereum, the attacker used 50 pre-signed EIP-7702 authorizations to delegate wallet execution to malicious smart-contract code. Investigators have reconstructed the transfers, but do not know how the attacker obtained the required authorizations; possibilities include stealing a private key or deceiving its owner into signing.
