🔍 Read the full analysis: The Binance Hack: Tracking One Evening’s Events And Unknowns on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance said an attack on October 29 had an estimated impact of about $6.3 billion across its wallets, including a major Ethereum hot-wallet sweep. The company said user funds are safe and it will cover losses; roughly $3 billion had been frozen, while the investigation and withdrawal recovery were still underway on October 30.
Binance said on October 30 that an attack spanning several blockchains had an estimated total impact of about $6.3 billion, after a transaction drained assets from its Ethereum hot wallet the previous evening. The company said user funds are safe and it will cover losses, while deposits and withdrawals were disrupted and the incident remained under investigation.
The most visible transfer occurred at 20:24 UTC on October 29, when a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from the wallet identified as Binance 14 to a newly created address. Blockworks valued that transfer at roughly $2.5 billion. Binance’s broader estimate includes activity on other networks, not just the Ethereum transaction.
The reported totals varied by source and time. Binance estimated an impact of about $6.3 billion; TRM Labs put it near $6.36 billion, Arkham reported $6.01 billion, and Blockaid estimated at least $5.5 billion as of 22:00 UTC. These are preliminary estimates calculated using different methods and prices. Binance said roughly $3 billion had been frozen; earlier reporting placed the verified frozen total at $2.54 billion around 23:30 UTC on October 29.
Binance said deposits and withdrawals were suspended during its response. Co-CEO Yi He wrote on October 30 that withdrawals were expected to begin resuming within 48 hours of her post. The company said it revoked the affected address authorization, and the attacker’s code was no longer active on Binance 14 by the morning of October 30.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Customer Funds and Withdrawal Access
The incident matters both for the reported scale of the losses and for customers’ immediate access to exchange services. Binance’s assurance that user funds are safe and its commitment to cover losses are company statements; the supplied material does not include a completed independent audit of the full impact. A large estimate can also change as investigators identify transfers, calculate token values and distinguish stolen assets from assets that can be frozen or recovered.
Stablecoin issuers can freeze tokens they control under their systems, and several issuers announced freezes during the response. That option does not apply to ETH or bitcoin in the same way. TRM estimated about $2.4 billion remained beyond issuer freezing, a preliminary figure rather than a final accounting. Customers should treat unsolicited messages offering refunds or support cautiously: the source warns that scammers may exploit the incident, but does not document particular cases.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
As an affiliate, we earn on qualifying purchases.
Binance’s largest reported loss involved an Ethereum mechanism called EIP-7702, introduced with the Pectra upgrade in May 2025. In broad terms, it allows an externally owned account to authorize code to act for it. According to Blockaid’s analysis cited in the source, one transaction included 50 signed permissions covering consecutive transaction numbers, or nonces, for Binance 14. One permission matched the wallet’s current nonce, allowing the attacker’s code to run and the assets to be swept.
The source reports that the same evening also saw transfers from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and smaller networks. TRM Labs described those as ordinary signed transfers. Binance’s later account said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions. The company said it found no evidence of a wallet private-key leak; it had not yet published a full post-mortem.
TRM Labs attributed the attack “with high confidence” to TraderTraitor, a group it links to North Korea. That is an analyst attribution, not a confirmed finding from Binance or a government. The source says the earlier Bybit theft in February 2025 was valued at $1.5 billion and that Binance’s estimate, if borne out, would be larger. That comparison remains dependent on Binance’s preliminary total.
“With high confidence”
— TRM Labs, on the suspected attacker
Cause, Losses and Attribution Still Open
The final amount affected was not established in the source material. Estimates differ, and the reported value depends on which transactions are included, when they were counted and the prices used. It is also not clear how much of the frozen amount will ultimately be recovered or whether all affected assets can be accounted for.
Binance’s laptop and service-container explanation remains a possibility pending a post-mortem. The company said it found no evidence of a private-key leak, but that does not by itself establish exactly how the attacker gained the ability to authorize transfers. TRM Labs’ North Korea-linked attribution is also unconfirmed by Binance or government officials in the supplied reporting. The source does not provide a complete customer-by-customer account of losses or a final timeline for restoring every service.
Incident Review and Service Restoration
The immediate next step described by Binance was to restore withdrawals after resolving the security issue. On October 30, Yi He said they were expected to begin resuming within the next 48 hours; that was an expectation, not confirmation that all withdrawals had resumed. Binance also said deposits were operating normally in her post, while the incident update described deposits and withdrawals as suspended, reflecting the changing status and timing of the company’s communications.
Readers should watch for Binance’s promised post-mortem, updated loss and recovery figures, and confirmation of which services are fully available. Until those details are published, the cause, final financial impact and extent of asset recovery remain provisional.
Key Questions
How much did Binance say was affected?
Binance estimated the total impact at about $6.3 billion in its October 30 update. Other estimates ranged from at least $5.5 billion to about $6.36 billion, and all figures were preliminary.
Did Binance say customers would lose funds?
No. Binance said user funds are safe and that it would cover losses. These are the company’s statements; the supplied material does not include a final independent accounting.
What caused the Ethereum wallet to be drained?
Blockaid’s analysis says an EIP-7702 authorization let attacker-controlled code operate through Binance 14. Binance separately said a compromised employee laptop may have enabled access to a service container. The precise route had not been confirmed in a published post-mortem.
Who was responsible for the attack?
TRM Labs attributed it with high confidence to TraderTraitor, which it links to North Korea. The source says Binance and government officials had not confirmed that attribution.
When were withdrawals expected to resume?
On October 30, Binance co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. The source does not confirm that all withdrawals had resumed.
Source: ThorstenMeyerAI.com
