🔍 Read the full analysis: A Timeline Of The Hack Behind Billions Leaving Binance on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Binance says an attack on its hot-wallet systems on Oct. 29 caused an estimated $6.3 billion in impact across multiple blockchains. The company says customer funds are safe and it will cover losses; about $3 billion was frozen, while the investigation and a full post-mortem remain pending.
Binance says an attack on its hot-wallet systems on Oct. 29 had an estimated impact of about $6.3 billion, as funds moved from wallets across several blockchains. The exchange said customer funds are safe and that it will cover losses, while deposits and withdrawals were suspended as its teams investigated.
The first reported major outflow came from an Ethereum wallet labelled Binance 14. At 20:24 UTC, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens to a newly created wallet. Blockworks valued that transaction at roughly $2.5 billion. Blockchain security firm Blockaid said a transaction sent minutes earlier had attached attacker-controlled code to Binance 14 using Ethereum’s EIP-7702 feature.
Outflows were also reported from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks. TRM Labs said many of these transfers were ordinary signed transactions. Reported totals differ: Blockaid estimated at least $5.5 billion by 22:00 UTC, Arkham put the figure at $6.01 billion, and TRM estimated about $6.36 billion. Binance’s Oct. 30 update gave an estimate of about $6.3 billion. These figures are preliminary and depend on timing and token prices.
Binance said it had identified a possible route through a compromised DevOps engineer’s laptop, which may have allowed an attacker to access a service container and submit unauthorized withdrawals. The company said it found “no evidence of any wallet private key leak.” Binance also reported that roughly $3 billion had been frozen, deposits and withdrawals were suspended, and the affected authorization had been revoked by the morning of Oct. 30.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Customer Funds and Frozen Assets
The scale and spread of the reported outflows make this a major test of exchange security and incident response. Binance’s estimate is several times the $1.5 billion Bybit theft reported in February 2025, though the Binance figure remains preliminary and the two incidents may be measured differently. Binance’s assurance that customers are protected is significant because the exchange says it will cover losses rather than pass them on to users.
Asset recovery is uneven. According to the source material, stablecoin issuers froze roughly $2.5 billion to $3 billion within hours. Issuers can freeze some tokens under their control, but ETH and bitcoin cannot be frozen by those companies. TRM estimated about $2.4 billion was beyond issuer freezing. The amount ultimately recovered, and how much of the estimated impact represents unrecoverable loss, has not been established.
The incident also highlights how a technical authorization mechanism and access to operational systems can affect hot wallets. That matters beyond Binance: exchanges and other digital-asset businesses rely on controls around signing systems, software permissions and staff devices. The available evidence does not yet establish exactly how the attacker obtained the access needed for the transfers.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Sonos Era 100 SL Compact, Microphone-Free Speaker – Black
Apple Watch SE 3 GPS 44mm Smartwatch
As an affiliate, we earn on qualifying purchases.
The reported Ethereum method involved EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act on its behalf. According to Blockaid’s analysis, the attacker’s transaction included 50 signed permissions tied to consecutive transaction numbers, or nonces, for Binance 14. One matched the wallet’s current nonce, allowing the authorization to take effect.
That explanation comes from analysis of public blockchain data, not from a completed Binance post-mortem. The source account says the attacker tested code on smaller wallets earlier on Oct. 29, deployed a contract that afternoon, and began wider outflows at about 20:05 UTC. At 20:24, the large Binance 14 sweep occurred; another transfer of 28,005.6 ETH from Binance 16 followed 24 seconds later. Binance later said it revoked the affected address authorization.
Binance’s public response developed through the evening. At 21:29 UTC on Oct. 29, it said it was investigating reports of a potential security issue and that user funds were safe. It said withdrawals would resume once the issue was resolved. On Oct. 30, the company gave its $6.3 billion estimate and reported about $3 billion frozen. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post.
What Investigators Have Not Resolved
The exchange’s $6.3 billion impact estimate is not final. Analysts’ totals vary, and the source material says the calculations depend on when assets were counted and what prices were used. Binance has not published a full post-mortem explaining the complete sequence, the precise access path or the final amount of loss and recovery.
TRM Labs attributed the attack “with high confidence” to TraderTraitor, a group it links to North Korea. That is an attribution by a private research firm; Binance and government authorities had not confirmed it in the supplied material. Binance’s reference to a potentially compromised laptop also remains qualified, and the company said it found no evidence that a wallet private key had leaked.
It is also unclear how much of the frozen value will be returned, whether additional transfers or recovery efforts will change the totals, and exactly when all services will be restored. Binance said user funds were safe, but the full operational and financial consequences remain subject to investigation.
Restoring Withdrawals and Publishing Findings
Binance said it was working to resolve the security issue and expected withdrawals to begin resuming within 48 hours of Yi He’s Oct. 30 post. That was a forecast, not confirmation of a completed restoration. The company also said deposits continued to operate normally, while the supplied update described deposits and withdrawals as suspended; the status of each service should be checked against Binance’s latest official notices.
The next major milestone is a full incident post-mortem setting out the attack path, the systems affected, the final loss estimate and the recovery of frozen assets. Investigators and blockchain analysts may revise their estimates as wallets are tracked and issuers report further actions. Binance users should rely on the exchange’s official channels for service updates and treat unsolicited refund or support messages with caution.
Key Questions
How much money was involved in the Binance incident?
Binance estimated an impact of about $6.3 billion in its Oct. 30 update. Other preliminary estimates ranged from $5.5 billion to about $6.36 billion; the total may change as analysts refine their calculations.
Were Binance customer funds lost?
Binance said user funds are safe and that it would cover losses. The supplied material does not include a completed post-mortem or a final accounting of recovered and unrecovered assets.
How did the attacker access the Ethereum wallet?
Blockaid’s analysis said a transaction used EIP-7702 to authorize attacker-controlled code for Binance 14. Binance separately said a compromised DevOps engineer’s laptop may have enabled access to a service container, but the precise route has not been confirmed.
How much of the stolen value was frozen?
Binance reported about $3 billion frozen. The source material says stablecoin issuers froze roughly $2.5 billion to $3 billion, while ETH and bitcoin are not subject to the same issuer-controlled freezing mechanism.
When will Binance withdrawals resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. The material provided does not confirm that the service had resumed.
Source: ThorstenMeyerAI.com
