🔍 Read the full analysis: A Timeline Of The Binance Hack That Sent Billions Out In One Evening on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance reported an estimated $6.3 billion impact after attackers took control of a major Ethereum hot wallet and moved assets from wallets across several blockchains on Oct. 29. The company says user funds are safe and it will cover losses; billions in stablecoins were frozen, but attribution and the full technical cause remain unconfirmed.
Binance says an attack on Oct. 29 had an estimated impact of about $6.3 billion, after a compromised Ethereum hot wallet and other Binance wallets sent assets across multiple blockchains. The exchange said user funds are safe and that it would cover losses, while deposits and withdrawals were suspended during the response. The figure is preliminary, and the scale of the incident depends on how assets and transfers are counted.
The first major on-chain movement described in the source occurred at 20:24:23 UTC on Oct. 29. A transaction transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from the hot wallet labelled Binance 14 to a newly created receiving wallet. Blockworks valued that transaction at roughly $2.5 billion. Binance 16 sent a further 28,005.6 ETH to the same address 24 seconds later, according to the public Ethereum record cited in the source.
Binance’s incident update, issued at 02:23 UTC on Oct. 30, put the estimated total impact at about $6.3 billion and said roughly $3 billion had been frozen. Other estimates cited in the source differ: Blockaid counted at least $5.5 billion at 22:00 UTC, Arkham put the figure at $6.01 billion, and TRM Labs estimated about $6.36 billion. These are preliminary estimates, not a settled accounting of losses.
TRM Labs reported that Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and smaller networks also sent funds during the incident window. Those transfers were ordinary signed transactions, according to the firm. Binance said it found no evidence of a wallet private-key leak and that a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. The company has not yet published its full post-mortem.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of Binance’s Exposure
The reported total makes this a major test of exchange security and incident response. Binance’s estimate, if sustained, would exceed the $1.5 billion Bybit theft reported in February 2025 by about four times. That comparison is conditional: Binance’s total is still an estimate, and the source describes the competing figures as preliminary.
The episode also shows how one compromise can involve different kinds of assets and controls. Issuers including Circle and Tether froze stablecoins, while the source says roughly $2.5 billion to $3 billion was frozen within hours. ETH and bitcoin cannot be frozen by a central issuer in the same way; TRM estimated about $2.4 billion was beyond issuer control. For customers, the immediate practical issue was service disruption: Binance paused deposits and withdrawals while investigating.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
How the Wallet Permission Worked
The source’s timeline says the attacker’s operator wallet received three small withdrawals from Tornado Cash on Oct. 28, then tested sweeper code on two small wallets the next day. At 15:59 UTC on Oct. 29, the attacker deployed a contract later used with Binance 14 and rehearsed it on another wallet. These steps are attributed to the source author’s review of public Ethereum records and to analysis by TRM Labs.
The central Ethereum mechanism was EIP-7702, which the source describes as allowing an externally owned account to authorize program code to act for it. Blockaid’s analysis says a transaction carried 50 pre-signed permissions covering consecutive transaction numbers, or nonces, for Binance 14; one matched the wallet’s current nonce. The record then shows the wallet running the attacker’s code and assets being swept. The source says Binance later reported revoking the affected address authorization. This account relies on the cited analysts and transaction records; Binance’s full technical explanation is still pending.
Binance posted on X at 21:29 UTC on Oct. 29 that it was investigating reports of a potential security issue and that user funds were safe. At 22:15, it said withdrawals would resume once the issue was resolved. A second wave of activity involving wallets on Avalanche and Polygon was reported at about 23:05, while sweeps from Binance 14 continued until 23:56, according to the source’s timeline.
Open Questions on Cause and Losses
The final amount affected is not established. Binance’s roughly $6.3 billion estimate and the figures from Blockaid, Arkham and TRM Labs vary by source, timing and valuation. The source does not provide a final reconciliation showing how much was stolen, frozen, recovered or otherwise accounted for.
Binance has not published the promised full post-mortem, so the precise route from the reported laptop compromise to unauthorized transactions remains unclear. TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea, but that attribution has not been confirmed by Binance or a government in the supplied material. The source also reports that a wallet holding about 195,460 ETH had made no further transaction by the morning of Oct. 30; its eventual use is unknown.
Withdrawal Resumption and Binance’s Review
Binance said deposits were operating normally by the morning of Oct. 30, while withdrawals remained suspended. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her Oct. 30 post; that was a forecast, not confirmation of a restart. Customers should rely on Binance’s official service notices for current availability, since the timeline may change as the investigation continues.
The next substantive update is Binance’s full post-mortem, including a clearer account of how the access was obtained and a reconciled impact estimate. The source also warns users to be alert for scams impersonating Binance support or offering refunds. No official confirmation of the alleged North Korean link is provided in the material.
Key Questions
How much did Binance say the incident affected?
Binance estimated the impact at about $6.3 billion in its Oct. 30 update. The figure is preliminary; other estimates cited in the source range from at least $5.5 billion to about $6.36 billion.
Were Binance customer funds lost?
Binance said user funds were safe and that it would cover losses. The source does not include a final accounting of the assets moved or recovered.
How did the attackers access the Ethereum wallet?
Binance said a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized transactions. Analysts cited in the source describe an EIP-7702 authorization involving Binance 14. Binance’s complete technical explanation has not yet been released.
Who was responsible for the attack?
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That attribution is not confirmed by Binance or a government in the supplied reporting.
When were withdrawals expected to resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within the next 48 hours. The statement was an expectation, not confirmation that service had resumed.
Source: ThorstenMeyerAI.com
