🔍 Read the full analysis: The Story Of The Binance Hack That Unfolded In One Evening on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact from an October 29 attack that drained assets from a major Ethereum hot wallet and other exchange wallets. The company says user funds are safe and it will cover losses; the total remains preliminary, and the cause and attribution have not been independently confirmed.
Binance reported an estimated $6.3 billion impact from an attack on its wallets that began on October 29, including a major Ethereum hot wallet drained in a transaction at 20:24 UTC. The exchange said user funds are safe and it will cover losses, while deposits and withdrawals were suspended as it investigated.
Public Ethereum records show that at 20:24:23 UTC, 167,464 ETH, 1.615 billion USDT and 62 other tokens were transferred from a wallet identified as Binance 14. Blockworks valued that transaction at about $2.5 billion. Twenty-four seconds earlier, another Binance wallet sent 28,005.6 ETH to the same receiving address in a separate transaction. Reports from blockchain analysts say outflows also affected wallets on several other networks.
Binance’s October 30 incident update put the estimated total impact at about $6.3 billion and said roughly $3 billion had been frozen. Those figures are estimates, not a final accounting. Earlier estimates varied: Blockaid reported at least $5.5 billion by 22:00 UTC, Arkham estimated $6.01 billion, and TRM Labs put the amount at about $6.36 billion. The differences reflect when assets were counted and how they were valued.
Binance said its initial review found that a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. The company also said it found no evidence that a wallet private key had leaked. That explanation is preliminary; Binance said a post-mortem would follow. It suspended deposits and withdrawals during the response, and co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of Binance’s Exposure
The incident matters because it affected multiple Binance wallets across several blockchains, rather than a single isolated transfer. Binance’s estimate, if it holds, would make this one of the largest reported crypto thefts; the source compares it with the $1.5 billion Bybit hack in February 2025. That comparison depends on Binance’s preliminary total and should not be treated as a finalized ranking.
Asset freezes limited some potential losses, but not all. Stablecoin issuers froze an estimated $2.5 billion to $3 billion, according to the source material. Those issuers can restrict certain tokens, while ETH and bitcoin cannot be frozen by a token issuer in the same way. TRM Labs estimated about $2.4 billion was beyond issuer control. The incident also disrupted exchange services: Binance paused withdrawals while it worked to contain the attack, leaving customers waiting for access even as the company said their balances were safe.
For readers, the practical distinction is between a confirmed transfer and the broader interpretation of what it means. The Ethereum transactions are publicly visible, but the full loss, recovery prospects and cause remain subject to investigation. Binance’s assurance that customers will not bear losses is the company’s stated position, not a completed independent audit of the incident.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
As an affiliate, we earn on qualifying purchases.
How the Ethereum Wallet Was Used
The source’s account, drawing on Binance statements, TRM Labs, Blockaid and public Ethereum records, describes the key event as an EIP-7702 authorization applied to Binance 14. The Ethereum feature allows an account to authorize code to act on its behalf. According to Blockaid’s analysis, one transaction included 50 pre-signed permissions tied to 50 consecutive transaction numbers, or nonces. One matched the wallet’s current number, allowing the code to run and the assets to be swept.
That technical account does not establish how the attacker obtained the permissions. The source says that only the wallet’s own key, or the system holding it, could produce them, while Binance said it had found no evidence of a private-key leak. The exchange’s proposed route through a compromised engineer’s laptop and a service container is still framed as a possibility, not a proven account of the intrusion.
The timeline reported by the source shows preparation before the large transfer. An operator wallet received small withdrawals from Tornado Cash on October 28, and analysts said the attacker tested code on smaller wallets on October 29. Outflows from Binance wallets began around 20:05 UTC. Stablecoin issuers announced freezes later that evening. Binance said at 21:29 UTC that it was investigating a potential security issue and that user funds were safe. The company later reported that it had revoked the affected address authorization.
“With high confidence”
— TRM Labs, on attribution
Cause, Losses and Attribution
The final amount affected and recovered remains unsettled. Binance’s roughly $6.3 billion estimate and the other analysts’ figures are preliminary, with differences in timing and valuation. The source does not provide a completed audit or a final accounting of which assets were recovered, frozen or remain accessible to the attacker.
Binance’s account of a potentially compromised laptop is not yet a confirmed cause, and its statement that it found no evidence of a wallet private-key leak does not explain how the attacker obtained the permissions used in the Ethereum transaction. TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea, but that attribution has not been confirmed by Binance or a government. The source also does not establish who operated the wallets or what happened to all transferred assets.
The Investigation and Service Resumption
Binance said a post-mortem was still to come, which should provide more detail on the entry point, the affected systems and the final loss assessment. The exchange also said it revoked the affected address authorization. On October 30, Yi He expected withdrawals to begin resuming within 48 hours of her post; that was an expectation, not confirmation that service had restarted. Customers should rely on Binance’s official channels for service updates and be alert to messages impersonating support or offering refunds, since the source warns that such scams may appear.
Further updates from Binance, blockchain analysts and stablecoin issuers may clarify which assets remain frozen and whether additional funds can be recovered. Until the investigation and accounting are complete, the reported impact, technical explanation and attribution should be treated as developing information.
Key Questions
What happened in the Binance wallet attack?
On October 29, 2026, an attacker drained assets from Binance 14, a major Ethereum hot wallet, and other Binance wallets. Binance later estimated the total impact at about $6.3 billion, a preliminary figure.
Did the attacker’s transaction take $2.5 billion?
Blockworks valued the main Ethereum transaction at roughly $2.5 billion. That was one transaction; Binance’s estimated impact across wallets and networks was about $6.3 billion.
Are Binance customers’ funds safe?
Binance said user funds are safe and that it would cover losses. That is the exchange’s stated position; the incident’s full accounting and independent verification were not complete in the source material.
How did the attacker access the Ethereum wallet?
Blockaid’s analysis says an EIP-7702 authorization let code act on Binance 14 and transfer its assets. Binance said a compromised engineer’s laptop may have provided access to a service container, but the cause remains under investigation.
Has the attack been linked to North Korea?
TRM Labs attributed it with high confidence to TraderTraitor, a unit it links to North Korea. The source says neither Binance nor a government had confirmed that attribution.
Source: ThorstenMeyerAI.com
