🔍 Read the full analysis: The Night Billions Left Binance: A Minute-by-Minute Breakdown on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Binance reported an estimated $6.3 billion impact from a 29 October attack involving its hot wallets across multiple blockchains. The company says user funds are safe and it will cover losses, while investigators and the exchange continue to establish how much was stolen and recovered.
Binance reported an estimated $6.3 billion impact from an attack on its wallets on 29 October, after assets moved across several blockchains over roughly three hours. The exchange said user funds are safe and it will cover losses, but the total remains preliminary and the investigation is continuing.
The first major transaction described in the source occurred at 20:24 UTC, when 167,464 ETH, 1.615 billion USDT and 62 other tokens were transferred from a wallet identified as Binance 14 to a newly created address. Blockworks valued that transaction at about $2.5 billion. About 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same destination in a separate, signed transaction, according to the public blockchain record.
Blockchain security firms reported that transfers also came from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks. TRM Labs placed the start of outflows at about 20:05 UTC; a further wave involving Avalanche and Polygon was reported at about 23:05. Binance’s 30 October incident update put the estimated impact at about $6.3 billion. Other preliminary estimates differed: Blockaid reported at least $5.5 billion at 22:00 UTC, Arkham estimated $6.01 billion and TRM about $6.36 billion.
Binance said roughly $3 billion had been frozen by the time of its update. The source says stablecoin issuers froze between about $2.5 billion and $3 billion within hours. That does not account for all assets: TRM estimated roughly $2.4 billion was beyond issuers’ ability to freeze. Binance suspended deposits and withdrawals during the incident; co-CEO Yi He later said withdrawals were expected to begin resuming within 48 hours of her 30 October post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of the Reported Loss
The reported amount makes this a major security incident for one of the world’s largest cryptocurrency exchanges, with potential consequences for customers, markets and confidence in exchange custody. Binance’s assurance that user funds are safe and its pledge to cover losses are significant, but the final financial impact has not been independently established in the source material.
The incident also highlights how fast a wallet compromise can spread across different networks. Some assets, including certain stablecoins, can be frozen by their issuers; ETH and bitcoin cannot be frozen in the same way. The gap between the reported impact and the amount frozen leaves a substantial part of the movement to be traced and assessed.
Popular right now
Ninja Hot & Iced XL Coffee Maker with Rapid Cold Brew, Black, CM371
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Dyson Car+Boat Cordless Handheld Vacuum
As an affiliate, we earn on qualifying purchases.
How Binance 14 Was Taken Over
According to the source’s account of Binance’s explanation and analysis by Blockaid, the attacker used Ethereum’s EIP-7702 feature to authorize code to operate through Binance 14. The account says a transaction carried 50 pre-signed permissions tied to consecutive transaction numbers, or nonces; one matched the wallet’s current number and took effect. The attacker then used the wallet to transfer assets.
Before the large transfers, the operator reportedly tested code on smaller wallets and deployed a contract for use in the attack. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. The company also said it had found no evidence of a wallet private-key leak. Those statements describe Binance’s preliminary assessment, not a completed forensic finding.
The account attributes the transaction timeline to Binance statements, TRM Labs and Blockaid, alongside public Ethereum records. TRM said it attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That attribution has not been confirmed by Binance or a government, according to the source.
“Withdrawals are expected to begin resuming in the next 48 hours.”
— Co-CEO Yi He, in a post on 30 October
Losses and Attribution Remain Open
The $6.3 billion figure is an estimate, and the competing totals use different reporting times and methods. The source does not establish how much of the reported impact represents assets ultimately lost, how much was recovered or frozen, or the final cost to Binance. The exchange’s statement that customer funds are safe is not the same as a published, independently verified accounting of the incident.
It also remains unclear whether the DevOps laptop was the route used, how an attacker obtained the permissions described by Blockaid, and whether other systems or wallets were exposed. TRM’s attribution to TraderTraitor is an analyst assessment; it has not been confirmed by Binance or a government. Binance’s full post-mortem was still to come in the source material.
Forensic Review and Withdrawal Status
Binance said it had revoked the affected address authorization and that Binance 14 no longer ran the attacker’s code by the morning of 30 October. The next milestones are the exchange’s promised post-incident account, a clearer reconciliation of affected and frozen assets, and confirmation of when suspended deposits and withdrawals return to normal.
Customers should rely on Binance’s official channels for service updates. The source warns that scams may pose as refund offers or customer support; users should treat unsolicited messages about recovering funds with caution. The full scope, final losses and any confirmed attribution remain dependent on further investigation.
Key Questions
How much money was affected?
Binance estimated the impact at about $6.3 billion in its 30 October update. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, and the final loss has not been established.
Were customer funds safe?
Binance said user funds were safe and that it would cover losses. The source does not provide an independent audit or final accounting confirming the total cost of the attack.
How did the attack work?
Blockaid’s analysis, as reported in the source, says the attacker used Ethereum’s EIP-7702 authorization feature to run code through the Binance 14 wallet, then transferred assets. Binance separately said a compromised DevOps laptop may have provided access to a service container.
How much was frozen?
Binance reported about $3 billion frozen. The source says stablecoin issuers froze roughly $2.5 billion to $3 billion, while assets such as ETH and bitcoin could not be frozen by issuers in the same way.
Who was responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. The source says neither Binance nor a government had confirmed that attribution.
Source: ThorstenMeyerAI.com
