Binance attacker spent at least 36 hours preparing for the hack, starting with a $296 million XRP drain, according to an Oct. 29 investigation by TRM Labs. The attacker began preparing the operation on Oct. 28 before executing coordinated transfers across 10 blockchains the following evening. Most funds left Binance-linked wallets within approximately 20 minutes, making it the largest cryptocurrency theft on record.