🔍 Read the full analysis: The Night Of The Binance Hack: Events, Money, And Unknowns on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says attackers moved funds from its wallets across several blockchains on October 29, with a preliminary estimated impact of about $6.3 billion. The exchange says user funds are safe and it will cover losses; investigators’ totals differ, and a full post-mortem and confirmed attribution are still pending.
Binance reported an estimated $6.3 billion impact from an attack that moved assets out of its hot wallets across multiple blockchains on October 29, and said customer funds are safe and it will cover losses. The preliminary total would make the incident larger than any prior crypto theft if confirmed, but the amount, attack path and attribution remain under investigation.
The most visible transfer occurred at 20:24 UTC on October 29, when a transaction moved 167,464 ether, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created address. Blockworks valued that transaction at about $2.5 billion. Blockchain security firm Blockaid said a transaction three minutes earlier had attached attacker-controlled code to the wallet using Ethereum’s EIP-7702 feature.
Outflows were also reported from Binance wallets on other networks. TRM Labs said transfers occurred on Bitcoin, Tron, the XRP Ledger, Solana and smaller chains, with a further wave involving Avalanche and Polygon. Binance’s October 30 statement put the estimated total impact at about $6.3 billion. Other preliminary estimates varied: Blockaid reported at least $5.5 billion, Arkham about $6.01 billion, and TRM about $6.36 billion. These figures use different counting methods, timing and asset prices, so they are not a settled final accounting.
Binance said it found that a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawals. The company said it had found “no evidence of any wallet private key leak.” It also said it revoked the affected address authorization. Deposits and withdrawals were suspended during the response; co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her October 30 post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
A Test of Exchange Security and Trust
The incident matters because Binance is one of the world’s largest cryptocurrency exchanges, and a loss on the reported scale could affect customers, counterparties and confidence in the systems that hold exchange assets. Binance’s assurance that customer balances are safe and its commitment to cover losses are central to the immediate impact, but users still need clarity on how the company will account for the transfers and restore normal service.
The reported attack also highlights a distinction between asset recovery and transaction reversal. Issuers can freeze some centralized stablecoins, while assets such as ether and bitcoin do not have a comparable issuer-controlled freeze mechanism. The source report says stablecoin issuers froze roughly $2.5 billion to $3 billion within hours; TRM estimated about $2.4 billion remained beyond issuer control. Those are preliminary figures, and frozen assets are not necessarily recovered or returned.
For customers, the suspension of withdrawals creates an immediate practical concern even if Binance’s statement that funds are safe proves accurate. It also creates an opportunity for impersonation scams: the source report warned about fake refund and support messages. Users should rely on Binance’s official channels rather than unsolicited requests for passwords, recovery phrases or payments.
Products Worth Considering
Fitbit Versa Smart Watch – Black Aluminum, One Size (S & L Bands Included)
Oura Ring 4 Smart Ring – Silver – Size 8
BowFlex Results Series SelectTech Adjustable Dumbbells, Pair
As an affiliate, we earn on qualifying purchases.
How the Wallet Permission Was Used
The central Ethereum transaction involved EIP-7702, a feature introduced with the Pectra upgrade in May 2025. The source report describes it as a signed authorization that allows a wallet to run program code. In this case, Blockaid said an attacker supplied 50 permissions covering consecutive transaction numbers, or nonces, for Binance 14; one matched the wallet’s current number. The public Ethereum record shows the transfer, but the underlying security failure that enabled the permission remains under investigation.
The sequence began before the largest transfer. According to TRM and the source report’s review of public records, the operator wallet received small withdrawals from Tornado Cash on October 28, tested code on smaller wallets the following day and deployed a contract before the main outflows. The report says outflows from Binance wallets began around 20:05 UTC. Binance posted at 21:29 that it was investigating reports of a potential security issue and that user funds were safe.
TRM Labs attributed the attack “with high confidence” to TraderTraitor, a group it links to North Korea. That is an assessment by a blockchain analytics firm, not a confirmed finding by Binance or a government. Binance’s own public update focused on the possible compromised laptop and service-container access, while stating that investigators had not found evidence of a private-key leak.
“with high confidence”
— TRM Labs
Final Losses and Attribution Remain Open
The $6.3 billion figure is preliminary, and public estimates differ by hundreds of millions of dollars. The available source material does not establish a final net loss after frozen assets, recovery efforts, or later price changes. It also does not provide a completed accounting of which funds were ultimately recovered or remain accessible to the attacker.
Binance’s description of a potentially compromised DevOps laptop is preliminary: the company said the laptop “may” have enabled access to a service container. It has not published a full post-mortem explaining how access was gained, what controls failed, or whether other systems or wallets were exposed. TRM’s attribution to TraderTraitor is an analytic conclusion, not a publicly confirmed government finding.
The source report says Binance had removed the attacker’s code from Binance 14 by the morning of October 30. That step does not by itself resolve the status of assets transferred to other addresses. The eventual return of frozen stablecoins, the location of funds that cannot be frozen by issuers and the scope of any additional losses remain unclear.
Binance’s Recovery and Investigation
Binance said it was working to resolve the security issue and expected withdrawals to begin resuming within 48 hours of Yi He’s October 30 post. That was a stated expectation, not confirmation of a completed reopening. Customers will need updates from the exchange on service restoration, the accounting of affected wallets and how its promise to cover losses will be carried out.
The next major information point is a full post-incident review, including a clearer account of the suspected laptop compromise, the service container, the EIP-7702 authorization and the cross-chain transfers. Investigators and the exchange may also provide revised estimates as asset movements are tracked and frozen funds are assessed. Until then, the total impact and any formal attribution should be treated as unsettled.
Users should check Binance’s official announcements for withdrawal status and avoid messages claiming to offer refunds or recovery assistance. No recovery procedure or customer action beyond the exchange’s verified instructions was confirmed in the source material.
Key Questions
How much money was affected?
Binance estimated the total impact at about $6.3 billion. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, and a final accounting has not been published.
Were customer funds lost?
Binance said user funds are safe and that it will cover losses. The source material does not include an independently completed audit of customer balances or a final loss report.
How did the main wallet transfer happen?
Blockaid said the attacker used an EIP-7702 authorization to make Binance 14 run attacker-controlled code, then transferred assets out. Binance has not yet published a full technical post-mortem explaining how the attacker obtained the ability to authorize it.
Who was responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. That attribution has not been confirmed by Binance or a government.
When will Binance withdrawals resume?
On October 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. The source material does not confirm that withdrawals had resumed.
Source: ThorstenMeyerAI.com
