🔍 Read the full analysis: Binance’s Hack: A Timeline Of Billions Leaving And Lingering Questions on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact after funds left its wallets across several blockchains on Oct. 29. The exchange says user funds are safe and it will cover losses; stablecoin issuers froze about $3 billion, while the final accounting and the full cause remain unconfirmed.
Binance reported an estimated $6.3 billion impact after an attacker moved assets from exchange wallets across several blockchains on Oct. 29, including a major Ethereum hot-wallet sweep. The exchange says user funds are safe and it will cover losses, but the figure remains preliminary and the precise route into its systems has not been established publicly.
The largest individual transfer described in the available account occurred at 20:24 UTC on Oct. 29. A transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created wallet. Blockworks valued that transaction at about $2.5 billion. A separate Binance wallet sent 28,005.6 ETH to the same destination 24 seconds later, according to the public Ethereum record cited in the source material.
Outflows were also reported from Binance wallets on other networks. TRM Labs said transfers involved Bitcoin, Tron, the XRP Ledger, Solana and smaller networks, with a later wave on Avalanche and Polygon. The estimates differ: Blockaid put the impact at at least $5.5 billion as of 22:00 UTC, Arkham at $6.01 billion, TRM at about $6.36 billion and Binance at about $6.3 billion. These are preliminary figures calculated at different times and prices, not a settled loss total.
Binance said an investigation found that a compromised DevOps engineer’s laptop may have provided access to a service container that could submit unauthorized withdrawals. The company said it found no evidence that a wallet private key had leaked. Binance’s Oct. 30 update said deposits and withdrawals were suspended; co-CEO Yi He later said withdrawals were expected to begin resuming within 48 hours of her post. The source material does not establish whether that resumption has since occurred.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
What the Frozen Funds Mean
The incident puts pressure on Binance to show how its wallet controls and internal access systems performed, and to explain how funds moved across multiple networks in a short period. The gap between the estimated total impact and the amount frozen matters: a freeze can prevent some assets from being moved, but it does not by itself recover them or settle the final loss.
According to the source material, stablecoin issuers froze roughly $2.5 billion to $3 billion within hours. Binance separately reported about $3 billion frozen. TRM estimated roughly $2.4 billion was beyond issuer control, including assets such as ETH and bitcoin that cannot be frozen by a stablecoin issuer. These figures use different estimates and should not be treated as a final accounting.
For customers, Binance’s assurance that user funds are safe is central, but the pause in withdrawals affects access to assets while the company investigates. The episode also shows why an exchange’s stated security practices and its ability to respond quickly can matter beyond one transaction: an incident involving a major trading platform can unsettle users and counterparties across several crypto networks.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
TCL QM64L 85-Inch QD-Mini LED 4K Smart Fire TV
Roborock F25 GT Set Cordless Wet Dry Vacuum Cleaner and Mop with 2 Brushes
As an affiliate, we earn on qualifying purchases.
How the Wallet Permission Was Used
The attack account in the supplied material centers on EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act for it. According to the account’s interpretation of the public transaction record, the attacker used this mechanism to make Binance 14 run code that swept its assets.
Blockaid said one transaction carried 50 pre-signed permissions tied to consecutive transaction numbers, or nonces. Only the permission matching the wallet’s current nonce was valid. This account does not independently establish who created or signed those permissions, but the supplied analysis says such permissions would require the wallet’s key or the system holding it.
The source describes preparation before the main transfers: an operator wallet received small withdrawals from Tornado Cash on Oct. 28, and the attacker tested code and deployed a contract on Oct. 29. Those details are attributed to TRM and the source author’s review of public Ethereum records. They inform the reported sequence but do not, on their own, identify the person or organization behind the attack.
The Final Loss and Cause
The final amount affected or lost is not established. Binance’s roughly $6.3 billion estimate and outside estimates were preliminary, and the supplied figures differ by source, valuation time and methodology. The account also does not confirm how much frozen value will ultimately be recovered or how much of the reported impact represents assets that were successfully taken and remain inaccessible.
Binance’s laptop explanation is explicitly tentative: it said the device may have enabled access to a service container. Its statement that it found no evidence of a private-key leak does not answer publicly how the attacker obtained the permissions or authorized transfers across the other networks. A post-mortem had not yet been released in the source material.
TRM’s attribution to TraderTraitor is an analyst assessment, not a confirmed finding from Binance or a government. The identity of the attacker, whether anyone inside the company knowingly assisted, and the complete technical path remain unclear on the information provided.
Post-Mortem and Withdrawal Status
Binance said it had revoked the affected address authorization by the morning of Oct. 30 and was investigating the incident. The next key developments are a detailed post-mortem, a confirmed accounting of affected and frozen assets, and an update on whether withdrawals have resumed. Yi He’s 48-hour estimate was a stated expectation, not confirmation that service had returned.
Customers should rely on Binance’s official channels for updates. The source material warns that scammers may pose as support staff or offer refunds; it does not report a specific confirmed refund scheme. Any recovery claims should be treated as unverified unless confirmed by the exchange or the relevant asset issuer.
Key Questions
How much did Binance say the incident affected?
Binance estimated an impact of about $6.3 billion. That figure was preliminary; outside estimates ranged from at least $5.5 billion to about $6.36 billion, using different methods and valuation times.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover losses. The source material does not provide an independent audit or a final post-incident accounting.
How much was frozen?
Binance reported about $3 billion frozen, while the source describes estimates of roughly $2.5 billion to $3 billion frozen by stablecoin issuers. The amount is not a final recovery total, and some assets cannot be frozen by those issuers.
Who was responsible for the attack?
TRM Labs attributed it with high confidence to TraderTraitor, a group it links to North Korea. Neither Binance nor a government had confirmed that attribution in the supplied material, and the attacker’s identity remains unverified.
When were Binance withdrawals expected to resume?
On Oct. 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. That was a forecast; the material does not confirm whether withdrawals subsequently resumed.
Source: ThorstenMeyerAI.com
