🔍 Read the full analysis: The Binance Hack Unpacked: One Evening, Billions, And Open Questions on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an October 29 attack affected its wallets across several blockchains, with an estimated total impact of about $6.3 billion. The exchange says user funds are safe and it will cover losses; stablecoin issuers froze about $3 billion, while the total loss and attacker identity remain unconfirmed.
Binance said on October 30 that a security attack the previous evening had an estimated impact of about $6.3 billion, after funds moved from its wallets on multiple blockchains. The exchange said customer assets are safe and that it will cover losses; about $3 billion had been frozen by stablecoin issuers, while deposits and withdrawals were suspended as Binance investigated.
The incident began with a large Ethereum transaction at 20:24 UTC on October 29. Public blockchain records show 167,464 ETH, 1.615 billion USDT and 62 other tokens moved from a wallet identified as Binance 14 to a newly created address. Blockworks valued that transaction at roughly $2.5 billion. The source’s account, citing TRM Labs, says outflows from Binance wallets on several other networks began around 20:05 UTC, with further activity continuing later that evening.
Estimates differ because analysts and Binance used different counting times and asset prices. Binance put the estimated total impact at about $6.3 billion; TRM Labs estimated about $6.36 billion, Arkham $6.01 billion and Blockaid at least $5.5 billion as of 22:00 UTC. These are preliminary figures, not a settled accounting of permanent losses. Binance said roughly $3 billion was frozen; the source reports that stablecoin issuers froze approximately $2.5 billion to $3 billion. Assets such as ETH and bitcoin cannot be frozen by stablecoin issuers.
Binance’s October 30 security update said a compromised DevOps engineer’s laptop may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The company said it had found “no evidence of any wallet private key leak” and that it revoked the affected address authorization. Its deposits and withdrawals were suspended during the response. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her October 30 post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Customer Funds and Frozen Assets
The reported scale makes the incident consequential for customers and the wider crypto market, even though the final loss figure is not yet known. Binance says user funds are safe and that it will cover all losses. That assurance is a company statement; the source material does not provide a completed independent accounting or a detailed explanation of how the exchange will fund any unrecovered assets.
The freezes show both the reach and limits of intervention after a crypto theft. Issuers can block transfers of their own stablecoins, and the source reports about $3 billion frozen within hours. But that does not recover every asset: TRM Labs counted about $2.4 billion in assets beyond any issuer’s ability to freeze. The figures are preliminary, and the ultimate recoverable amount remains uncertain.
For customers, the immediate practical issue was access. Binance suspended withdrawals while it addressed the incident, although it said deposits continued to operate normally. The disruption also raises questions for other exchanges about how hot-wallet permissions, operational systems and employee devices are protected.
Products Worth Considering
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
As an affiliate, we earn on qualifying purchases.
How Binance 14 Was Used
According to the source’s account of Blockaid’s analysis and public Ethereum records, the attacker used EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act for it. In this case, the report says one transaction carried 50 pre-signed permissions for 50 consecutive transaction numbers, or nonces, associated with Binance 14. One permission matched the wallet’s current nonce and took effect.
That authorization allowed the attacker’s code to operate the wallet before the large transfer. The source says outflows from other Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and smaller networks were made through ordinary signed transfers, according to TRM Labs. That distinction matters: the reported activity was not a single Ethereum exploit accounting for every movement, but a series of transactions across networks during the same period.
Binance’s first public response came at 21:29 UTC on October 29, when it said it was investigating reports of a potential security issue and stated that user funds were safe. At 22:15, it said withdrawals would resume once the issue was resolved. Binance’s fuller incident update followed at 02:23 UTC on October 30. The source says the affected authorization had been revoked by that morning.
Losses and Attribution Still Unsettled
The $6.3 billion impact estimate is preliminary, and the source gives several different totals from analysts and Binance. It does not establish how much of the reported movement represents permanently lost funds, how much was recovered or frozen, or how the parties reconciled assets counted at different times and prices.
The precise access route also remains under investigation. Binance said a compromised DevOps engineer’s laptop “may” have provided access to a service container, while saying it found no evidence of a private-key leak. The source says a post-mortem was still to come, so it does not establish how the laptop was compromised or which safeguards failed.
TRM Labs attributed the activity with high confidence to TraderTraitor, which it links to North Korea. Binance and government authorities had not confirmed that attribution in the supplied material. The attacker’s identity, the fate of assets that could not be frozen and the final customer impact remain unclear.
Withdrawal Recovery and Investigation
Binance said withdrawals would resume once its security issue was resolved, and Yi He forecast that they would begin resuming within 48 hours of her October 30 post. That was an expectation rather than confirmation of a specific restart time. The source says Binance reported that deposits continued to operate normally, but withdrawals remained suspended in its incident update.
The next major information point is Binance’s promised post-mortem, which should clarify the access path, the scope of affected wallets and the company’s final accounting. Updates from Binance, blockchain analysts and stablecoin issuers may also change estimates of frozen or recoverable assets. Until then, the total impact and the share that can be returned or otherwise accounted for remain open questions.
Customers should rely on Binance’s official channels for account and recovery information. The source warns that scams impersonating support or offering refunds may follow the incident; it does not describe any verified refund program.
Key Questions
How much did the Binance attack affect?
Binance estimated the impact at about $6.3 billion. Other preliminary estimates cited in the source ranged from at least $5.5 billion to about $6.36 billion. The final amount of unrecovered losses has not been established.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover all losses. That is the exchange’s stated position; the supplied material does not include a completed independent accounting.
How were funds moved from Binance 14?
The source says analysis of the Ethereum record found that a valid EIP-7702 authorization enabled attacker code to operate Binance 14, followed by a transfer of ETH, USDT and other tokens. Other reported outflows used signed transfers on separate networks.
Who was responsible for the attack?
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. The supplied material says neither Binance nor a government had confirmed that attribution.
When would Binance withdrawals resume?
Co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post. The source does not confirm that withdrawals had restarted or give a precise resumption time.
Source: ThorstenMeyerAI.com
