Timeline

Binance said its hot wallets were compromised at around 20:05 UTC, a loss of about $6.3B

Per Binance, Binance. Original

TRM said five Binance wallets on the XRP Ledger sent 233.46M XRP to one address between 20:05 and 20:09

Per TRM Labs, TRM Labs. Original

TRM said a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address

Per TRM Labs, TRM Labs. Original

Chainalysis said funds began leaving Binance hot wallets (stated as around 4:20 p.m. ET)

Per Chainalysis, Chainalysis. Original

Blockaid said the operator sent a transaction carrying 50 EIP-7702 authorizations to a Binance Ethereum hot wallet

Per blockaid.io. Original

Hacken said one Ethereum transaction moved about $2.53B out of a single Binance wallet

Per Hacken. Original

Blockaid said 780M USDC was moved from a Circle smart account linked to Binance

Per blockaid.io. Original

TRM said Tether froze 971.1M USDT in the main receiving wallet, 37 minutes after the main sweep

Per TRM Labs, TRM Labs. Original

TRM said Circle froze 823M USDC in the main receiving wallet

Per TRM Labs, TRM Labs. Original

Chainalysis said freezes started by 5:14 p.m. Eastern; TRM and Hacken list Tether's first freeze at 21:01

Per Chainalysis, Chainalysis. Original

Hacken noted another count dates the first freezes at 21:14, against 21:01 in its own table

Per Hacken. Original

Cointelegraph reported a Binance spokesperson said the exchange was investigating reports of a potential security issue

Per Binance spokesperson, Cointelegraph. Original

Blockaid said the operator swept the still-delegated Binance wallet again for 200M USDT and 13 other tokens

Per blockaid.io. Original

TRM said Ripple froze the wallet holding the stolen RLUSD, with 40.5M of 88.5M RLUSD still inside

Per TRM Labs, TRM Labs. Original

TRM said World Liberty Financial froze 27.8M USD1 in the main receiving wallet

Per TRM Labs, TRM Labs. Original

TRM said a second wave of transfers reached Binance wallets on Avalanche and Polygon

Per TRM Labs, TRM Labs. Original

TRM said Binance stated the verified frozen total had reached $2.54B (Hacken and Cointelegraph give the same time)

Per TRM Labs, TRM Labs. Original

Binance published Security Incident Update #2: set aside more than $6.34B, about 80% of the impacted amount covered, about $3B frozen

Per Binance, Binance. Original

Cointelegraph reported Binance said it had temporarily suspended deposits (live-blog entry time)

Per Binance, Cointelegraph. Original

TRM said the Arbitrum Security Council moved 8,426 ETH and 74.6M ARB out of the attacker's reach

Per TRM Labs, TRM Labs. Original

Hacken said Binance signed a new authorization resetting the delegation on its Ethereum wallet

Per Hacken. Original

Cointelegraph reported Chainalysis estimated $5.912B stolen at the time of the theft (live-blog entry time)

Per Chainalysis, Cointelegraph. Original

Cointelegraph reported the Arbitrum Security Council said it froze $30.5M; TRM and Hacken give 00:08 for the transfer (live-blog entry time)

Per Arbitrum Security Council, Cointelegraph. Original

Hacken said Binance published its first written update: laptop hypothesis, about $6.3B impact, about $3B frozen

Per Binance, Hacken. Original

Chainalysis said it announced its TraderTraitor attribution (stated as 12:30 a.m. ET); Hacken also lists 04:30 for the first public attribution

Per Chainalysis, Chainalysis. Original

Cointelegraph reported ZachXBT said Binance and Bitget funds were commingled in one address (live-blog entry time)

Per ZachXBT, Cointelegraph. Original

Hacken said the verified frozen total reached $2.84B, 44% of the theft

Per Hacken. Original

Cointelegraph reported Binance said its investigation had found additional points of breach (live-blog entry time)

Per Binance, Cointelegraph. Original

Elliptic said the attacker began moving funds between blockchains, selling stolen AVAX for USDC from 11:38

Per Elliptic, Elliptic. Original

Cointelegraph reported Richard Teng said the EIP-7702 delegation did not pass through Binance's normal approval controls (live-blog entry time)

Per Richard Teng, Cointelegraph. Original

The FBI published an alert saying North Korea was responsible, naming TraderTraitor, with a list of addresses

Per Federal Bureau of Investigation (FBI), FBI. Original

Binance published Recovery Update #3: the covered amount up to 90%, a new Proof of Reserves snapshot taken

Per Binance, Binance. Original

Elliptic said about $196M had been sent out of the main Tron distribution wallet to around 200 wallets

Per Elliptic, Elliptic. Original

Binance published Recovery Update #4: about 95% of the impacted amount covered, withdrawals to resume in phases

Per Binance, Binance. Original

Binance said it was preparing to resume phase one of withdrawals between 06:00 and 09:00 UTC

Per Binance, Binance. Original

Elliptic's update log recorded Binance had begun reopening withdrawals, starting with the Bitcoin network

Per Binance, Elliptic. Original