🔍 Read the full analysis: Billions Out Of Binance: What Happened During The Hack? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says an attack on 29 October affected about $6.3 billion across its wallets, including a major Ethereum hot-wallet sweep. The estimate remains preliminary; the exchange says user funds are safe, about $3 billion has been frozen, and it will cover losses. The attack method and the identity of the attacker are not fully confirmed.
Binance reported an estimated $6.3 billion impact from a wallet attack that began on 29 October, when funds were moved from the exchange’s hot wallets across several blockchains. The company said user funds are safe and it will cover losses, but withdrawals were suspended while Binance addressed the incident; the impact estimate and the attack’s full scope remain preliminary.
The largest identified movement came at 20:24 UTC on 29 October, when a transaction transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from an Ethereum wallet labelled “Binance 14.” Blockworks valued that transaction at about $2.5 billion. Public Ethereum records reviewed by ThorstenMeyerAI.com show that 28,005.6 ETH also moved from another Binance wallet to the same receiving address shortly afterward.
Outflows were also reported from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks. TRM Labs said most transfers occurred within about 20 minutes, with another wave involving Avalanche and Polygon wallets later that evening. Binance’s October 30 update put the estimated impact at about $6.3 billion and said roughly $3 billion had been frozen. Other early estimates differed: Blockaid put the amount at at least $5.5 billion, Arkham at $6.01 billion and TRM at about $6.36 billion.
Binance said it found that a DevOps engineer’s compromised laptop may have given an attacker access to a service container used to submit unauthorized withdrawal transactions. The company also said it had found no evidence that a wallet private key was leaked. Binance said deposits were operating normally, but withdrawals were paused until the security issue was resolved. By the morning of 30 October, the exchange said it had revoked the affected address authorization.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Wallet Loss Affects Users
The reported scale makes this a major security incident for one of the world’s largest crypto exchanges, with potential consequences for customer confidence, withdrawals and the wider market. Binance’s assurance that user funds are safe and its commitment to cover losses are significant, but the company had not yet published a full post-mortem explaining how the attacker obtained the ability to initiate transfers.
Freezing some assets can limit what an attacker can spend, but it does not reverse every transfer. According to the source report, stablecoin issuers froze roughly $2.5 billion to $3 billion. TRM estimated about $2.4 billion was in assets such as ETH or bitcoin that issuers could not freeze. Those figures are estimates made during an unfolding response, not a final accounting.
The incident also shows why the distinction between an exchange’s stated user balances and the security of the systems that control its wallets matters. Customers need reliable information about which services remain available, whether funds are protected and when withdrawals can resume. Binance’s statements address those immediate concerns, while the cause and recovery details still require further confirmation.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K Video
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
As an affiliate, we earn on qualifying purchases.
The EIP-7702 Permission at Issue
Blockchain records and analyses cited by the source report point to Ethereum’s EIP-7702 feature as the mechanism used against Binance 14. The feature lets an account authorize code to act on its behalf. In the reported transaction, 50 pre-signed permissions covered consecutive transaction numbers, or nonces; one matched the wallet’s current number and took effect, according to Blockaid’s analysis.
That permission allowed the attacker’s code to operate through the wallet and sweep assets. The on-chain transfers are visible, but the records alone do not establish how the attacker obtained the permissions. Binance’s account of a compromised engineer’s laptop is a company finding described as a possibility, not a complete public forensic report.
The timeline in the source report begins with small withdrawals from Tornado Cash on 28 October and test activity on smaller wallets the next day. Binance posted that it was investigating at 21:29 UTC on 29 October and later said withdrawals would resume once the issue was resolved. The exchange’s October 30 incident update supplied the preliminary impact and freeze estimates.
The Final Loss and Cause Remain Open
The $6.3 billion figure is an estimate, and the available estimates differ by source, timing and valuation. The final amount affected, how much was recovered or frozen, and what remains under attacker control were not settled in the source material. The reported asset totals also span multiple networks, making a final accounting dependent on tracing and valuation.
Binance’s laptop explanation remains a possible cause, and the company had not released a full post-mortem. TRM Labs attributed the attack “with high confidence” to TraderTraitor, a group it links to North Korea; neither Binance nor a government had confirmed that attribution. The public blockchain record can show transactions and wallet activity, but it does not by itself establish who carried them out or how access was obtained.
It was also unclear when withdrawals would fully return. Yi He’s 48-hour expectation was a forecast made on 30 October, not confirmation that the service had resumed. The source report said Binance had paused withdrawals while deposits continued to operate normally.
Withdrawal Restart and Forensic Findings
Binance said it would resume withdrawals once the security issue was resolved, and Yi He said withdrawals were expected to begin returning within 48 hours of her October 30 post. Customers should treat that as an expected window rather than a confirmed reopening time; the exchange had not provided a precise schedule in the source material.
The next key development is a fuller account of how the permissions and cross-chain transfers were authorized, along with a final accounting of affected assets and frozen funds. Binance’s promised post-mortem and any further findings from blockchain analysts may clarify whether the laptop access theory is supported and how the exchange plans to address the security weakness.
Customers should rely on Binance’s official channels for service updates. The source report also warned that scams posing as refund offers or customer support may target users after the incident. No refund process or individual customer loss details were established in the material available on 30 October.
Key Questions
How much money was affected in the Binance hack?
Binance estimated the impact at about $6.3 billion in its October 30 update. Other early estimates ranged from at least $5.5 billion to about $6.36 billion, so the total was not final.
What happened to Binance’s Ethereum wallet?
A transaction transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from the wallet labelled Binance 14 to another address at 20:24 UTC on 29 October. Blockworks valued that transfer at about $2.5 billion.
Were customer funds safe?
Binance said user funds are safe and that it would cover losses. The source material did not include a detailed post-mortem or a final account of the incident’s financial impact.
How were the attackers identified?
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government in the source material.
When will Binance withdrawals resume?
Binance said withdrawals would return once the security issue was resolved. Co-CEO Yi He expected them to begin resuming within 48 hours of her October 30 post, but no exact reopening time was confirmed.
Source: ThorstenMeyerAI.com
