🔍 Read the full analysis: How The Binance Hack Played Out—and What’s Still A Mystery on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says attackers compromised hot-wallet activity across several blockchains on October 29, with an estimated impact of about $6.3 billion. The exchange says it will cover losses and user funds are safe, but the exact amount, access path and attacker identity remain unsettled.
Binance said on October 30 that an attack on its hot wallets had an estimated impact of about $6.3 billion, after a transaction drained assets from an Ethereum wallet and transfers were reported across several other blockchains. The exchange says user funds are safe and it will cover losses, but the total remains preliminary and the method used to gain access is still under investigation.
The most visible on-chain event occurred at 20:24 UTC on October 29, when a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet labelled Binance 14 to a newly created receiving wallet. Blockworks valued that transaction at roughly $2.5 billion. Public Ethereum records show another Binance wallet sent 28,005.6 ETH to the same address 24 seconds later.
Binance’s overall estimate covers more than that Ethereum transaction. The company put the total impact at about $6.3 billion; other preliminary estimates differed, including about $5.5 billion from Blockaid, $6.01 billion from Arkham and roughly $6.36 billion from TRM Labs. Those figures reflect different counting methods, timing and asset prices, so they should not be treated as a settled final loss.
According to TRM Labs, outflows from Binance wallets on several networks began around 20:05 UTC, with transfers reported on Bitcoin, Tron, the XRP Ledger, Solana and other chains. Stablecoin issuers froze roughly $2.5 billion to $3 billion in assets, according to the source report. Binance suspended deposits and withdrawals during its response; co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her October 30 post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Wallets Were Compromised
The incident highlights the risks of hot wallets, which keep crypto available for operational use, and of the systems that authorize transactions. A large outflow from a major exchange can disrupt customer access, raise questions about custody controls and prompt other platforms to review their own wallet procedures. Binance’s promise to cover losses is significant for customers, but it does not resolve how the access occurred or whether any assets can be recovered.
The response also showed a key difference between assets. Some stablecoins can be frozen by their issuers, while ETH and bitcoin cannot be frozen by a central issuer in the same way. TRM Labs estimated about $2.4 billion remained beyond issuer freeze controls. That figure is an analyst estimate, not a final accounting of recoverable funds.
Products Worth Considering
Apple Watch Series 12 GPS Smartwatch, 46mm
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
As an affiliate, we earn on qualifying purchases.
The October 29 Attack Sequence
Blockchain records reviewed in the source report show preparation before the main transfers. On October 29, an operator tested code on smaller wallets and deployed a contract later used in the attack. At 20:20:59 UTC, a transaction carried 50 EIP-7702 permissions for Binance 14, each tied to a consecutive transaction number, or nonce. Blockaid’s analysis says one permission matched the wallet’s current nonce, allowing the attacker’s code to run.
EIP-7702, introduced with Ethereum’s Pectra upgrade in May 2025, lets an externally owned account authorize code to act on its behalf. In this incident, analysts say the permission was used to sweep assets from Binance 14. Binance later said it had revoked the affected address authorization. Separate transfers from other Binance wallets were described by TRM Labs as ordinary signed transactions, though the process behind those signatures remains under examination.
Binance first acknowledged reports of a possible security issue at 21:29 UTC on October 29 and said it was investigating. Its October 30 incident update gave the estimated impact and described a possible connection to a compromised DevOps engineer’s laptop. The company said it found no evidence of a wallet private-key leak, while noting the laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions.
“with high confidence”
— TRM Labs
The Unresolved Access Questions
The final amount affected, the share that can be recovered and the full path into Binance’s systems remain unclear. Binance’s laptop explanation is tentative: the company said a compromised DevOps engineer’s device “may” have provided access to a service container. It has not yet published the post-mortem promised in the source report, and its statement that it found no evidence of a private-key leak does not by itself explain how the unauthorized transactions were approved.
Attribution is also unconfirmed. TRM Labs linked the operation with high confidence to TraderTraitor, which it associates with North Korea, but neither Binance nor a government had confirmed that attribution in the material available. The estimate of funds frozen varies by report, and it is not clear how much of the non-frozen crypto can be traced or recovered.
Binance’s Recovery and Investigation
Binance said it was working to resolve the security issue and expected withdrawals to begin resuming within 48 hours of Yi He’s October 30 update. That was a projected timetable, not confirmation that all withdrawals had restarted. The exchange’s next substantive milestone is a post-mortem explaining the access route, the scope of affected wallets and the final accounting of losses and frozen assets.
Customers should rely on Binance’s official channels for service updates and be alert to messages falsely offering refunds or support. The source report warns that scams may exploit the incident. Until Binance publishes more findings, the technical explanation, final impact and responsibility for the attack remain subject to revision.
Key Questions
How much was taken in the Binance incident?
Binance estimated the total impact at about $6.3 billion. That figure is preliminary. Other estimates cited in the source report ranged from about $5.5 billion to $6.36 billion, using different methods and valuation times.
Were Binance customer funds lost?
Binance said user funds are safe and that it will cover losses. The source material does not include a final independent accounting or a completed post-mortem.
How did the Ethereum wallet get drained?
Blockaid’s analysis says an EIP-7702 permission let attacker-controlled code act through the Binance 14 wallet. The transaction included 50 permissions tied to consecutive nonces, and one matched the wallet’s current transaction number. Binance has not yet published a full technical explanation.
Who carried out the attack?
TRM Labs attributed it with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government in the source material.
When will withdrawals resume?
Binance co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours. The source material does not confirm that the service had fully resumed.
Source: ThorstenMeyerAI.com
