🔍 Read the full analysis: How To Follow The Binance Hack That Unfolded Over One Evening on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
On October 29, attackers drained Binance’s Ethereum hot wallet Binance 14 and moved funds from wallets on several other blockchains. Binance estimated the total impact at about $6.3 billion and said it would cover losses, while issuers froze about $3 billion; the totals remain preliminary and the cause is still under investigation.
Attackers drained Binance’s Binance 14 Ethereum hot wallet on October 29 and moved funds from Binance wallets across several blockchains, in an incident the exchange estimated had an impact of about $6.3 billion. Binance said user funds were safe and that it would cover losses; the figure is preliminary, and the precise attack path and total recoverable amount remain under investigation.
The central Ethereum transaction was recorded at 20:24 UTC. It transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from Binance 14 to a newly created wallet. Blockworks valued that transaction at roughly $2.5 billion. About 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same destination in a separate signed transfer.
Blockchain analysis firm TRM Labs reported outflows on as many as ten networks, including Bitcoin, Tron, the XRP Ledger and Solana. Most began around 20:05 UTC, according to the firm. A later wave involving Avalanche and Polygon was reported at about 23:05, while sweeps from Binance 14 continued until 23:56. The reported totals differ: Blockaid put the impact at at least $5.5 billion, Arkham at $6.01 billion, TRM at about $6.36 billion and Binance at about $6.3 billion. These are estimates made at different times and prices, not a settled loss figure.
Binance’s October 30 update said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. The company said it had found “no evidence of any wallet private key leak.” It also said deposits and withdrawals had been suspended during the response. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her October 30 post; that was an expectation, not confirmation that services had resumed.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Losses Could Affect Users
The reported scale makes the incident consequential for Binance customers and the wider crypto market, but the exchange’s statement that user funds are safe is distinct from an independent account of how every affected wallet was accessed. Binance said it would cover losses, while withdrawals were paused during the response. Customers therefore faced uncertainty about service availability even as the company said customer balances were protected.
Some stolen assets may be recoverable when an issuer can freeze a token, but that does not apply equally across assets. The source account reported that stablecoin issuers froze roughly $2.5 billion to $3 billion within hours, with Binance later reporting about $3 billion frozen. TRM estimated around $2.4 billion was beyond any issuer’s ability to freeze. Those figures are time-sensitive estimates; a freeze does not by itself establish that funds have been returned.
The event also puts attention on the systems and permissions behind hot wallets, which are online wallets used to process transactions. A major exchange’s handling of a security incident can affect confidence in its safeguards, operational continuity and public disclosures. The available reports do not establish that Binance’s entire platform or customer account system was compromised.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Flex + Folio Crypto Hardware Wallet
Ledger Flex Crypto Wallet
As an affiliate, we earn on qualifying purchases.
The EIP-7702 Permission Sequence
Analysis by Blockaid focused on EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act for it. The source account describes the attacker’s transaction as carrying 50 pre-signed permissions for 50 consecutive transaction numbers, or nonces, associated with Binance 14. One matched the wallet’s current nonce, allowing the attacker’s code to run.
That account says such permissions could only have been produced by the wallet’s key or the system holding it. That observation helps explain the on-chain mechanics, but it does not establish how the attacker obtained access. Binance’s proposed laptop-to-service-container route remains a preliminary finding, and the company said a post-mortem was still to come.
The timeline began before the main transfers. TRM and Blockworks reported that the operator wallet received three small withdrawals from Tornado Cash on October 28. On October 29, the attacker tested code on small wallets, deployed a contract and rehearsed its use before the large outflows. These steps are based on analyst reports and public transaction records; they do not by themselves identify the person or group responsible.
“with high confidence”
— TRM Labs
Attribution, Recovery and Final Losses
The final amount lost, frozen or recovered is not yet settled. The published estimates vary by source, timing and asset prices, and the available account does not establish how much of the frozen value will be returned. Binance said it would cover losses, but the terms and mechanics of that commitment were not detailed in the material provided.
The attack’s origin also remains uncertain. TRM Labs attributed it “with high confidence” to TraderTraitor, which it links to North Korea. That is an analyst attribution, not a confirmed finding from Binance or a government. Binance’s laptop and service-container explanation is also preliminary, and its statement that it found no evidence of a private-key leak does not settle how the unauthorized transactions were enabled.
Binance said it revoked the affected address authorization by the morning of October 30. The source account reported that a wallet holding 195,460 ETH had not sent a transaction when checked that morning. Those are snapshots of on-chain activity at a particular time; the wallet’s later status and the full movement of assets remain open.
Exchange Review and Withdrawal Restart
Binance said it would investigate, publish a post-mortem and restore affected services. Yi He’s October 30 statement gave an expectation that withdrawals would begin resuming within 48 hours, while the company had said withdrawals would resume once the security issue was fully resolved. Readers should distinguish that schedule from confirmation that withdrawals have restarted; the supplied information does not confirm a completed restart.
The next meaningful updates are likely to clarify the entry route, the scope of affected wallets, how the exchange calculated its estimate and what happened to frozen assets. Further statements from Binance, issuers and blockchain analysts may revise the totals as transactions are tracked. TRM’s attribution may also be assessed by investigators, but it should not be treated as an official identification unless authorities confirm it.
Users should be alert to messages claiming to offer refunds or support. The source account warns of scams that may exploit the incident; Binance’s public channels, rather than unsolicited messages or links, are the appropriate place to check for official service updates. Until the exchange confirms restoration and provides further detail, both the operational status and the final accounting remain developing.
Key Questions
When did the Binance attack happen?
The main Binance 14 Ethereum sweep occurred at 20:24 UTC on October 29, 2026. Reported outflows from other Binance wallets began around 20:05 UTC, with additional activity later that evening.
How much was taken?
Binance estimated the total impact at about $6.3 billion. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, reflecting different sources, times and valuation prices. No final total was established in the supplied account.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover all losses. That is the exchange’s public statement; the supplied material does not include a completed independent review or the final terms of its commitment.
Have the stolen funds been recovered?
Stablecoin issuers reportedly froze roughly $2.5 billion to $3 billion, but a freeze is not the same as a return of funds. The final recoverable amount was not known in the source account.
Who was responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government in the material provided.
Source: ThorstenMeyerAI.com
