🔍 Read the full analysis: Tracing The Binance Hack As Billions Left In One Evening on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says an attack on Oct. 29 affected its wallets across multiple blockchains, with an estimated total impact of about $6.3 billion. Blockchain analysts traced a major Ethereum wallet sweep and other transfers; Binance says user funds are safe and it will cover losses. The total remains preliminary, and the attacker’s identity has not been confirmed by Binance or a government.
Binance reported an estimated $6.3 billion impact from a wallet attack that began on Oct. 29, after an Ethereum transaction swept assets from one of the exchange’s main hot wallets and other transfers drained funds across several networks. The company said user funds are safe and it will cover losses, while the total remains preliminary and the incident is under investigation.
At 20:24 UTC on Oct. 29, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created wallet. Blockworks valued that transfer at roughly $2.5 billion. Public Ethereum records show a Binance wallet labelled Binance 16 sent another 28,005.6 ETH to the same address 24 seconds later. Binance’s incident update, issued early on Oct. 30, put the estimated total impact at about $6.3 billion.
The reported total varies by source and counting time. Blockaid estimated at least $5.5 billion by 22:00 UTC on Oct. 29; Arkham put it at $6.01 billion; TRM Labs estimated about $6.36 billion. Binance’s roughly $6.3 billion figure is also preliminary. These figures should not be treated as a settled measure of unrecoverable losses: assets were frozen, prices and valuation times differ, and the full accounting has not been published.
TRM Labs said Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks also sent funds during the incident window, mostly through ordinary signed transfers. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions. The company said it had found no evidence of a wallet private-key leak. A full post-mortem has not yet been released.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Exchange Reserves and Frozen Assets
The incident matters because it involved exchange-controlled wallets across multiple blockchains, rather than a single user account. Binance is one of the largest crypto exchanges, so a disruption to its withdrawals and deposit services can affect customers who need access to funds as well as confidence in the systems that hold assets for them. Binance said deposits were operating normally, but withdrawals were suspended while it addressed the security issue.
Recovery prospects differ by asset. Binance said about $3 billion had been frozen; the source material places the amount frozen by issuers at roughly $2.5 billion to $3 billion. Stablecoin issuers can freeze tokens they control, while ETH and bitcoin cannot be frozen by an issuer in the same way. TRM estimated about $2.4 billion was beyond issuer freeze controls. Those figures describe different parts of a developing response, not a final recovery total.
Binance’s promise to cover losses is relevant to customers, but the company has not yet provided a complete public accounting of the incident or explained how its compensation process will work. The scale and technical route of the attack also make the eventual review of wallet controls and operational access important beyond Binance itself.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The EIP-7702 Wallet Route
Blockchain analyst reports and the public Ethereum record point to EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act on its behalf. The authorization is signed and tied to a transaction number, or nonce. In the reported attack, one Ethereum transaction carried 50 pre-signed permissions for consecutive nonces associated with Binance 14; Blockaid said one matched the wallet’s current nonce and took effect.
Once the authorization was accepted, the wallet ran attacker-controlled code to move assets, according to the analysis cited in the source material. This describes how the on-chain transaction worked; it does not by itself establish how the attacker obtained the permissions. Binance’s explanation about a possibly compromised employee laptop and service container is an initial account, not a completed forensic finding.
The timeline began before the main transfers. TRM and Blockworks reported small withdrawals from Tornado Cash to an operator wallet on Oct. 28. On Oct. 29, blockchain analysis recorded tests of sweeper code and deployment of a contract before the large transfers. Binance first publicly acknowledged reports of a potential security issue at 21:29 UTC, then said withdrawals would resume after the issue was resolved. These details are attributed to the analysts and Binance; Binance’s full post-incident report remains outstanding.
Losses and Attribution Remain Open
The final value of affected assets, the amount that can be recovered, and the net loss to Binance have not been established publicly. Estimates ranged from $5.5 billion to about $6.36 billion in the reports cited, with different sources using different timestamps and methods. Binance’s approximately $6.3 billion figure is described as an estimated impact, not a confirmed final loss.
The precise compromise path is also unresolved. Binance said a DevOps engineer’s laptop may have provided access to a service container, while saying it found no evidence of a private-key leak. No full post-mortem is available in the source material. TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea; neither Binance nor a government had confirmed that attribution at the time of the report.
It is also unclear when all affected services would return to normal and whether every frozen asset can be recovered. The stated withdrawal window was an expectation, not a completed restoration.
Withdrawal Resumption and Binance Review
Binance’s next stated operational milestone was to begin resuming withdrawals within 48 hours of Yi He’s Oct. 30 post. The company said withdrawals would resume once the security issue was resolved; the source material does not confirm that they had restarted. Users should rely on official Binance channels for service updates, since the incident also creates opportunities for fraudsters to pose as support staff or offer fake refunds.
The next substantive update should be a fuller account of the incident: how access was obtained, how the affected wallets were secured, the final asset and loss calculations, and the status of recovery efforts. Until Binance publishes those findings, the mechanism visible on-chain is clearer than the route by which the attacker obtained the authorization.
Key Questions
How much money was affected in the Binance hack?
Binance estimated an impact of about $6.3 billion. Other preliminary estimates ranged from $5.5 billion to about $6.36 billion, reflecting different sources and counting times. The final loss has not been established.
Were Binance customers’ funds lost?
Binance said user funds are safe and that it would cover losses. The company had not yet released a complete accounting or post-mortem in the source material.
How did the attacker move funds from Binance 14?
Analysts linked the Ethereum wallet sweep to EIP-7702 authorization. Blockaid said a transaction carried 50 permissions for consecutive wallet nonces and that one matched, allowing code to act for Binance 14. The route by which the attacker obtained the permissions remains under investigation.
Who carried out the attack?
TRM Labs attributed the activity with high confidence to TraderTraitor, which it links to North Korea. That attribution had not been confirmed by Binance or a government in the available reporting.
When will Binance withdrawals resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within the next 48 hours. That was a forecast; the source material does not confirm that withdrawals had resumed.
Source: ThorstenMeyerAI.com
