🔍 Read the full analysis: When Billions Left Binance: The Hack’s Timeline And Unanswered Questions on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact from an October 29 attack involving its hot wallets across several blockchains. The exchange says customer funds are safe and it will cover losses, while investigators continue to examine how the attacker obtained authorization and who was responsible.
Binance says an attack on October 29 had an estimated impact of about $6.3 billion, after a hot wallet on Ethereum was compromised and funds moved from Binance wallets across multiple blockchains. The exchange says customer funds are safe and it will cover losses, but the cause, full accounting and identity of the attacker remain under investigation.
The clearest on-chain event in the supplied reporting came at 20:24 UTC on October 29, when a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance wallet labelled “Binance 14” to a newly created address. Blockworks valued that transaction at roughly $2.5 billion. Binance wallet outflows on several other chains were reported in the same period.
The totals vary by source and reporting time. Binance put the estimated impact at about $6.3 billion; TRM Labs estimated about $6.36 billion, Arkham reported $6.01 billion, and Blockaid put the amount at at least $5.5 billion as of 22:00 UTC. These are preliminary estimates, not a settled final loss figure. The source account says issuers froze roughly $2.5 billion to $3 billion in assets, while some other funds, including ETH and bitcoin, cannot be frozen by stablecoin issuers.
Binance’s October 30 update said deposits and withdrawals had been suspended. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. Binance also said it found no evidence that a wallet private key had leaked, while reporting that a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Cost of a Multi-Chain Breach
The reported scale makes the incident a major test of exchange custody and operational security. Hot wallets hold assets for routine transfers, so an attacker who can authorize transactions may affect funds across networks even if the exchange’s central platform remains available. Binance’s statement that it will cover losses addresses customer exposure, but the event still raises questions about the controls around wallet authorization and internal systems.
The different estimates also show why early theft figures should be treated carefully. Prices fluctuate, transactions may be tracked at different points, and some assets can be frozen while others cannot. The reported freezes may limit what an attacker can use, but they do not by themselves establish the final amount recovered or the net loss.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K Video
Logitech MX Keys S Wireless Keyboard, Graphite
As an affiliate, we earn on qualifying purchases.
According to the source account’s review of the public Ethereum record and analyses by Blockaid and TRM Labs, the attacker used EIP-7702, an Ethereum feature that lets an externally owned account authorize program code. A transaction at 20:20:59 UTC carried 50 permissions tied to consecutive transaction numbers, or nonces. Blockaid’s analysis says one permission matched Binance 14’s current nonce, allowing the wallet to run the attacker’s code.
The sequence reported began before the main transfer. TRM and the source account describe small tests on other wallets on October 29, followed by deployment and rehearsal of a contract. The large Binance 14 sweep followed at 20:24 UTC. Other transfers were reportedly made through ordinary signed transactions from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and additional networks. The source account says Binance later revoked the affected address authorization; Binance’s full post-mortem had not yet been published.
“The attack was attributed with high confidence to TraderTraitor, a unit TRM links to North Korea.”
— TRM Labs, as reported in the supplied source
Key Questions Still Open
Binance had not released a full post-mortem in the supplied reporting, leaving the precise compromise path unresolved. The company’s laptop finding is phrased as a possibility, and it has not explained how an attacker could submit the permissions accepted by Binance 14 or whether the same method affected other wallets.
The final amount lost or recovered also remains uncertain, as do the exact amounts frozen and the extent to which frozen assets can be returned. TRM Labs’ attribution to TraderTraitor has not been confirmed by Binance or a government. The source material does not establish whether the reported multi-chain transfers all resulted from the same access route.
Withdrawal Resumption and Findings
Binance said deposits and withdrawals were suspended during its response. Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post; the supplied information does not confirm whether that timetable was met. Binance’s next major disclosure is expected to clarify the wallet controls involved, the scope of the incident and its final accounting.
Investigators and blockchain analysts are continuing to trace funds and monitor addresses associated with the transfers. Until Binance publishes further findings, users should distinguish its assurance that it will cover losses from questions about the attacker’s identity and the amount ultimately recovered.
Key Questions
How much was involved in the Binance attack?
Binance estimated an impact of about $6.3 billion. Other preliminary estimates in the source material range from at least $5.5 billion to about $6.36 billion, reflecting different sources and reporting times.
Were Binance customer funds lost?
Binance said user funds are safe and that it would cover losses. The supplied reporting does not include a completed post-mortem or a final accounting of funds recovered.
How was Binance 14 compromised?
Blockaid’s analysis says a transaction used EIP-7702 permissions to authorize code for the wallet. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container, but the full route has not been confirmed.
Who carried out the attack?
TRM Labs attributed it with high confidence to TraderTraitor, which the firm links to North Korea. The source material says neither Binance nor a government had confirmed that attribution.
When were withdrawals expected to resume?
Co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post. The supplied account does not confirm whether service resumed on that schedule.
Source: ThorstenMeyerAI.com
