🔍 Read the full analysis: The Binance Hack By The Minute: Billions, Events, And Questions on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact from an October 29 attack involving its hot wallets, including a major Ethereum wallet sweep. The exchange says user funds are safe and it will cover losses; stablecoin issuers froze about $3 billion, while the total and the attacker’s identity remain preliminary or unconfirmed.
Binance reported an estimated $6.3 billion impact from an attack on its wallets that began on October 29, including the theft of assets from its Ethereum hot wallet Binance 14. The exchange says user funds are safe and it will cover losses, but the total remains an estimate, withdrawals were suspended, and the attack’s full mechanics and attribution have not been independently confirmed.
The most visible transfer occurred at 20:24 UTC on October 29, when a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from Binance 14 to a newly created wallet. Blockworks valued that transaction at about $2.5 billion. Public Ethereum records show another Binance wallet sent 28,005.6 ETH to the same address 24 seconds later. These figures describe specific transfers, not the full estimated impact.
Binance’s October 30 incident update put the estimated total impact at about $6.3 billion and said roughly $3 billion had been frozen. Other preliminary estimates differed: Blockaid put the impact at at least $5.5 billion as of 22:00 UTC, Arkham at $6.01 billion, and TRM Labs at about $6.36 billion. The totals depend on timing, prices and which assets and transfers were counted.
According to TRM Labs, outflows also affected Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and smaller networks. Binance said a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawal transactions. The company said it found no evidence that a wallet private key had leaked. It had not yet published a full post-mortem in the supplied account.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
A Multi-Chain Hit on Binance Wallets
The reported scale would make the incident one of the largest crypto thefts on record if the estimate holds. The source compares Binance’s preliminary $6.3 billion figure with the $1.5 billion Bybit hack reported in February 2025; both the amount and the ranking depend on final accounting. The event matters beyond the headline figure because it affected wallets across several networks and prompted Binance to suspend withdrawals while investigating.
Asset recovery is uneven. The source reports that stablecoin issuers froze roughly $2.5 billion to $3 billion within hours. Those freezes can limit movement of tokens controlled by an issuer, but they do not apply to ETH or bitcoin. TRM Labs estimated about $2.4 billion was beyond any issuer’s ability to freeze. These are preliminary assessments, not a final recovery tally.
For customers, Binance’s statement that user funds are safe and its promise to cover losses are the company’s stated position. The suspension of withdrawals nevertheless left users waiting for access while security work continued. The incident also raises questions for exchanges about how software and operational systems that interact with wallet infrastructure are protected, even when a private-key leak has not been identified.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Nano Gen5 Crypto Wallet, Black
As an affiliate, we earn on qualifying purchases.
How the Ethereum Wallet Was Used
Blockchain analyst Blockaid said the attacker used EIP-7702, an Ethereum feature that lets an externally owned account authorize code to run for it. The source says the feature became available after Ethereum’s Pectra upgrade in May 2025. In the Binance 14 transaction, Blockaid identified 50 signed permissions covering consecutive transaction numbers, or nonces. One matched the wallet’s current nonce, allowing the attacker’s code to run and sweep assets.
The public Ethereum record and analyst reports, as summarized in the source, show activity before the main transfer: the operator wallet received three small Tornado Cash withdrawals on October 28; the attacker tested code on smaller wallets on October 29; and a contract was deployed and rehearsed before the Binance 14 transaction. These details are attributed to TRM Labs, Blockaid and the source author’s review of on-chain records. They do not establish who controlled the wallets.
Binance first posted that it was investigating at 21:29 UTC on October 29 and said user funds were safe. It later said withdrawals would resume once the issue was resolved. On October 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. Binance also said it had revoked the affected address authorization; that is not the same as a completed investigation or a public account of how access was obtained.
“With high confidence, the attack was linked to TraderTraitor, a unit it associates with North Korea.”
— TRM Labs
The Total and Attribution Remain Open
The $6.3 billion impact is preliminary, and estimates vary by source. The supplied material does not provide a final asset-by-asset accounting, a confirmed amount of unrecoverable losses, or a complete explanation of how Binance’s systems were accessed. Binance’s laptop and service-container account is framed as a possibility; the company said it found no evidence of a private-key leak.
Responsibility is also unsettled. TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea, but neither Binance nor a government had confirmed that attribution in the source. On-chain activity can show transfers and contract interactions; by itself, it does not prove who operated the wallets or why.
The status of all affected assets, the amount ultimately recovered, the impact on Binance customers, and the exact timing for fully restored withdrawals were not established in the supplied update. Stablecoin freezes may prevent some funds from moving, but they do not recover assets automatically or control ETH and bitcoin.
Binance’s Investigation and Withdrawal Restart
Binance said deposits and withdrawals were suspended while it addressed the incident. Co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within the next 48 hours of her post; that was an expectation, not confirmation that service had already returned. Binance also said deposits continued to operate normally.
The next key developments are Binance’s promised fuller explanation, confirmation of withdrawal availability, and updated figures for funds frozen or recovered. Those updates should clarify whether the proposed laptop and service-container path was confirmed and how the exchange calculates its total impact. Until then, reported totals and attribution should be treated as provisional.
The source warns that users may face scams posing as refunds or customer support. Readers should distinguish any such messages from official Binance communications. The available account does not identify a confirmed reimbursement process beyond Binance’s statement that it will cover losses.
Key Questions
How much did Binance say was affected?
Binance estimated the total impact at about $6.3 billion in its October 30 update. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, depending on timing and methodology. The final amount was not established.
What happened to Binance 14?
A transaction at 20:24 UTC on October 29 moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from the hot wallet to a newly created address. Blockaid said an EIP-7702 authorization allowed attacker code to run for the wallet.
Are Binance customers’ funds safe?
Binance said user funds are safe and that it will cover losses. That is the company’s stated position. The supplied update does not include a final public accounting or independent confirmation of the full incident impact.
Who does Binance say was behind the attack?
The supplied material does not report a confirmed identification by Binance. TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea, but that attribution had not been confirmed by Binance or a government authority.
When were withdrawals expected to resume?
Co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post. The statement described an expected timetable, not confirmation that withdrawals had restarted.
Source: ThorstenMeyerAI.com
