The Binance hack

Most of it was gone in 20 minutes

The first funds left Binance at 4:05 p.m. ET on Oct. 29. Investigators say most of the roughly $6.3 billion went in the next 20 minutes. Stablecoin issuers began freezing within an hour; the last sweep came just before 8 p.m. All times ET.

1. Oct. 29
   4:05 p.m.

   First funds leave Binance, on the XRP Ledger. Investigators say most of the theft happened in the next 20 minutes. reported TRM Labs

2. 4:20 p.m.

   18,270 bitcoin leave Binance's bitcoin hot wallet and land in 19 new wallets, 17 of them holding exactly 1,000 BTC. measured time: TRM Labs; wallets: on-chain

3. 4:20 p.m.

   The attacker's wallet signs a transaction giving it control over one of Binance's Ethereum hot wallets. measured on-chain

4. 4:24 p.m.

   The biggest sweep: one transaction moves ether, stablecoins and other tokens out of that wallet in 64 transfers. measured on-chain

5. 5:01 p.m.

   Tether freezes the attacker's main wallet. It blocks eight more wallets over the next hour. measured on-chain

6. 5:04 p.m.

   Circle freezes USDC in the same wallet. measured on-chain

7. 6:06 p.m.

   Tether blocks Binance's compromised hot wallet itself. Circle does the same at 7:53 p.m. measured on-chain

8. 7:05 p.m.

   A second wave reaches Avalanche and Polygon. reported TRM Labs

9. 7:56 p.m.

   Last Ethereum sweep, nearly four hours after the first funds left. reported TRM Labs

10. 8:10 p.m.

    Binance's hot wallet replaces the permission the attacker had set up. measured on-chain

11. That night

    Binance puts the impact at about $6.3 billion with about $3 billion frozen, and says a DevOps engineer's compromised laptop may have been the way in. It says it found “no evidence of any wallet private key leak,” that it will cover all losses, and that withdrawals stay suspended. Co-CEO Yi He says they should resume “in the next 48 hours.” reported Binance

12. 10:10 p.m.

    TRM Labs publishes its analysis (figures as of 8:30 p.m.): about $6.36 billion taken across 10 blockchains, attributed to North Korea's TraderTraitor unit “with high confidence.” reported TRM Labs

13. Oct. 30
    12:30 a.m.

    Chainalysis also attributes it to TraderTraitor, after seeing stolen Binance funds mixed with funds from September's Bitget theft. Its estimate is about $6.4 billion. reported Chainalysis

14. 1:15 a.m.

    17,260 ETH move from the attacker's main wallet to a new one. measured on-chain

15. 7:16 a.m.

    CNBC check: none of the 19 bitcoin wallets has spent a coin. No issuer can freeze bitcoin. measured on-chain

Notes and source

Times are ET. Measured = read by CNBC from the Bitcoin and Ethereum blockchains (transactions, wallet balances and the USDT and USDC freeze records); reported = said by Binance or by investigators TRM Labs and Chainalysis in their own published analyses, not independently confirmed. Binance has not published times for its statements or for when it suspended withdrawals.