🔍 Read the full analysis: A Close Look At The Binance Hack That Unfolded In One Evening on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says attackers drained funds from its hot wallets during an incident on Oct. 29, with an estimated total impact of about $6.3 billion. The figure is preliminary; the exchange says user funds are safe and it will cover losses, while investigators and blockchain firms continue tracing assets.
Binance said an attack on its hot wallets on Oct. 29 caused an estimated $6.3 billion in impact, after a single Ethereum transaction drained assets from a major wallet and transfers followed across several blockchains. The exchange said user funds are safe and it will cover losses; withdrawals were paused while Binance investigated.
The central Ethereum transaction occurred at 20:24 UTC on Oct. 29. It moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created address. Blockworks valued the transaction at roughly $2.5 billion. Public Ethereum records show another Binance wallet sent 28,005.6 ETH to the same address 24 seconds later.
Transfers from Binance wallets on other networks were also reported. TRM Labs said outflows occurred across as many as ten blockchains, including Bitcoin, Tron, the XRP Ledger and Solana. Binance’s preliminary estimate was about $6.3 billion. Other early estimates differed: Blockaid reported at least $5.5 billion, Arkham $6.01 billion and TRM about $6.36 billion. These are preliminary figures calculated at different times and prices, not a settled loss total.
Binance said it had found no evidence that a wallet private key was leaked. Its initial explanation was that a compromised DevOps engineer’s laptop may have allowed access to a service container used to submit unauthorized withdrawal transactions. That account remains subject to a fuller post-incident review. Binance said deposits were operating normally in its Oct. 30 update, while withdrawals remained suspended pending resolution of the security issue.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Wallet Breach Affected Users
The scale of the reported outflows makes the incident significant for Binance customers and the wider crypto market. Binance’s assurance that users’ funds are safe, and its commitment to cover losses, are central to whether customers can rely on the exchange while withdrawals are paused. The company has not yet published a completed post-mortem or a final accounting of the incident.
The response also highlights a difference between assets that can be frozen by their issuers and decentralized assets that cannot be frozen in the same way. According to the source report, stablecoin issuers froze roughly $2.5 billion to $3 billion within hours. TRM estimated about $2.4 billion in assets remained beyond issuer control. Those figures are estimates, and the exact amount recovered or frozen may change as transactions are traced.
The reported total could, if confirmed, exceed the $1.5 billion Bybit theft of February 2025. That comparison depends on Binance’s preliminary impact estimate being borne out; the available figures are not yet a final independent accounting.
Products Worth Considering
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Anker SOLIX C1000 Gen 2 Portable Power Station
As an affiliate, we earn on qualifying purchases.
Blockchain analysts said the Ethereum wallet was compromised through EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025. The feature lets an account authorize code to act on its behalf. According to Blockaid’s analysis cited in the source report, the attacker included 50 pre-signed permissions tied to consecutive transaction numbers, or nonces, for Binance 14. One matched the wallet’s current nonce, allowing the attacker’s code to run and sweep assets.
The report’s timeline says the operator tested code on smaller wallets earlier on Oct. 29 and deployed the contract later that afternoon. Outflows began from Binance wallets around 20:05 UTC. Binance 14’s authorization was used at 20:20:59, followed by the major sweep at 20:24:23. The report says additional transfers from Binance wallets continued later in the evening, including a second wave involving Avalanche and Polygon.
Binance reported the issue publicly at 21:29 UTC, saying its teams were investigating and that user funds were safe. It later said withdrawals would resume once the security issue was resolved. By the morning of Oct. 30, Binance said it had revoked the affected address authorization, and the wallet no longer appeared to run the attacker’s code.
Attribution and Losses Remain Open
The final loss figure is not settled. Binance’s roughly $6.3 billion estimate and the other early figures reflect different calculations, timestamps and token prices. The source material does not provide a final audited tally of assets taken, frozen, recovered or otherwise inaccessible.
The method of access is also not fully established. Binance said a compromised engineer’s laptop may have provided a route into a service container, but it did not present that as a confirmed conclusion. The company said it found no evidence of a private-key leak; that finding does not by itself explain who obtained or used the pre-signed authorizations described by Blockaid.
TRM’s attribution to TraderTraitor is an analyst assessment. Neither Binance nor a government had confirmed that attribution in the material provided. It is also not clear how much of the reported frozen total will be permanently recoverable or when all withdrawals will resume.
Withdrawal Resumption and Forensic Review
Binance co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within the next 48 hours, while deposits were continuing as normal. That was an expectation, not confirmation that withdrawals had already restarted. Customers will need a further exchange update for the timing and any limits on resumed service.
Binance has said a post-mortem is still to come. That review is expected to clarify how the attacker gained access, how the exchange calculated the impact, and what portion of the assets can be recovered. Blockchain analysts and token issuers may also provide updated figures as they track transfers and report any additional freezes.
Customers should rely on Binance’s official channels for incident and account information. The source report warns that scams posing as refunds or support may target affected users. No refund process or individual customer payment timeline was specified in the material available.
Key Questions
What happened in the Binance attack?
Binance reported that attackers drained assets from its Ethereum hot wallet Binance 14 on Oct. 29, followed by transfers from wallets on other blockchains. Binance estimated the total impact at about $6.3 billion, a preliminary figure.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover losses. The exchange had paused withdrawals while investigating, so the assurance did not mean customers could withdraw during the suspension.
How did the Ethereum wallet get drained?
Blockaid’s analysis, as described in the source report, says a valid EIP-7702 authorization let attacker code act through Binance 14. Binance separately said a compromised DevOps laptop may have provided access to a service container, but its full explanation was not yet available.
Who was responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. That is an analyst attribution; neither Binance nor a government had confirmed it in the source material.
When will Binance withdrawals resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. The material did not confirm that service had resumed or give a final schedule.
Source: ThorstenMeyerAI.com
