🔍 Read the full analysis: A Minute-by-Minute Guide To The Binance Hack And Its Unknowns on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says attackers exploited an Ethereum wallet authorization and moved assets across several networks on October 29, with a preliminary estimated impact of about $6.3 billion. The company says user funds are safe and it will cover losses; the exact loss, how the attackers gained access and who was responsible remain unconfirmed.
Binance says an attack on its wallets on October 29 had an estimated impact of about $6.3 billion, after assets moved across Ethereum and other blockchain networks. The exchange says user funds are safe and it will cover losses, but its estimate is preliminary and the cause of the breach has not been conclusively established.
The most visible transaction occurred at 20:24 UTC, when 167,464 ETH, 1.615 billion USDT and 62 other tokens left an Ethereum wallet labelled Binance 14. The source report says the transaction followed an authorization that let attacker-controlled code operate through the wallet. Public Ethereum records show the transfer; the full route by which the attacker obtained the necessary authorization is not yet known.
Outflows from Binance wallets on other networks began around 20:05 UTC, according to blockchain security firm TRM Labs. TRM said transfers also involved Bitcoin, Tron, the XRP Ledger, Solana and smaller networks. The source report places a second wave involving Avalanche and Polygon at about 23:05 UTC. Binance later said deposits and withdrawals were suspended while it responded to the incident.
Loss estimates differ by source and timing. The report cites at least $5.5 billion from Blockaid, $6.01 billion from Arkham, about $6.36 billion from TRM Labs and approximately $6.3 billion from Binance. These are preliminary estimates, not a final accounting. Binance said about $3 billion had been frozen; the report says stablecoin issuers froze roughly $2.5 billion to $3 billion, while assets such as ETH and bitcoin cannot be frozen by those issuers.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of Binance’s Exposure
The reported amount makes the incident consequential for Binance customers and the wider crypto market, even though the exchange says customer balances are safe. A loss on the scale Binance estimates could test confidence in exchange custody, the systems used to authorize withdrawals and the ability of platforms to contain stolen assets across different blockchains.
The response also shows the limits of asset recovery. Issuers can freeze some centralized stablecoins, but that option does not apply to ETH or bitcoin. The source report estimates about $2.4 billion was beyond issuer freeze mechanisms. That figure is an attributed estimate, and the ultimate amount recovered or permanently lost has not been established.
Binance’s assurance that it will cover losses is relevant to customers, but it does not resolve questions about the incident’s cause or operational effects. At the time described in the report, withdrawals were paused, and co-CEO Yi He said they were expected to begin resuming within 48 hours of her October 30 post.
Popular right now
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Shark Rocket Pet Plus Corded Stick Vacuum, Lightweight, Bordeaux, HV322
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
The reported Ethereum transaction used EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act for it. In the source account, Blockaid said the transaction carried 50 pre-signed permissions tied to consecutive transaction numbers, or nonces; one matched Binance 14’s current number and took effect.
That technical finding describes how the wallet was made to run the attacker’s code, not how the authorization was obtained. Binance said a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawal transactions. The company also said it found no evidence that a wallet private key had leaked. Those statements remain the company’s account pending a fuller post-mortem.
The report’s timeline records small tests by the operator on October 29 before the main transfers. It says the operator wallet received three small withdrawals from Tornado Cash on October 28, citing TRM Labs and Blockworks. These details are investigative reporting based on the cited analyses and public chain records; they do not independently identify who controlled the wallets.
Questions Still Open After the Breach
The final financial impact is not settled. The published estimates vary, and the source report describes them as preliminary. It is not yet clear how much of the transferred value was recovered, how much remains accessible to the attackers or what final amount Binance will record as a loss.
The precise route into the wallet system also remains under investigation. Binance’s laptop explanation is tentative, and its statement that it found no evidence of a private-key leak does not establish what access the attacker had or how the relevant permissions were produced. A full post-mortem had not yet been released in the source material.
TRM Labs attributed the operation with high confidence to TraderTraitor, which it links to North Korea. This is an attribution by a private research firm, not a confirmed finding by Binance or a government. The source report also does not establish the attacker’s identity or whether all affected wallets and services have been secured.
Withdrawals and the Forensic Review
Binance said it would resume withdrawals once the security issue was resolved. On October 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post; that was an expectation, not confirmation that all services had returned. Customers should rely on Binance’s official status notices for current service information.
The next major information point is Binance’s promised fuller account of the incident, including what happened to the engineer’s laptop, how the wallet authorization was issued and how the company calculated its final impact. Investigators and blockchain analysts may also publish updated tracking and recovery figures. Until then, the loss totals and attribution should be treated as provisional.
Key Questions
What happened to Binance on October 29?
Binance reported that attackers moved assets from its wallets across several blockchains. The clearest individual transfer was from the Ethereum wallet labelled Binance 14, which sent 167,464 ETH, 1.615 billion USDT and 62 other tokens at about 20:24 UTC.
How much was taken?
Binance estimated the total impact at about $6.3 billion, but the figure is preliminary. Other estimates cited in the source report range from at least $5.5 billion to about $6.36 billion, reflecting different sources and accounting points.
Are Binance customer funds safe?
Binance said user funds are safe and that it would cover losses. That is the company’s assurance; the source material does not provide an independent final accounting of the incident or its total financial impact.
How did the attackers access the Ethereum wallet?
The source report says the attackers used an EIP-7702 authorization to make Binance 14 run their code. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container, while saying it found no evidence of a wallet private-key leak. The exact access route remains under investigation.
Who was responsible for the attack?
TRM Labs attributed the operation with high confidence to TraderTraitor, a group it links to North Korea. The source material says neither Binance nor a government confirmed that attribution.
Source: ThorstenMeyerAI.com
