🔍 Read the full analysis: The Binance Hack In 5 Key Moments—and What Remains Unknown on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an attacker drained or moved assets from its wallets across several blockchains on Oct. 29, estimating the impact at about $6.3 billion. The exchange says customer funds are safe and it will cover losses; the total remains preliminary, and the cause, attribution and full recovery picture are not settled.
Binance says an attacker moved assets worth an estimated $6.3 billion from exchange wallets across multiple blockchains on Oct. 29, prompting the company to suspend deposits and withdrawals while it investigated. The exchange said customer funds are safe and that it will cover losses, but its estimate is preliminary and the full cause and scope of the incident remain unresolved.
The clearest on-chain sequence began at 20:24 UTC, when a transaction swept 167,464 ETH, 1.615 billion USDT and 62 other tokens from an Ethereum hot wallet labelled Binance 14 to a newly created wallet. Blockworks valued that transaction at roughly $2.5 billion. Other outflows from Binance wallets were reported on several networks, including Bitcoin, Tron, the XRP Ledger and Solana. TRM Labs also reported a later wave involving Avalanche and Polygon.
Binance put the incident’s estimated total impact at about $6.3 billion in an update issued early Oct. 30. Other preliminary tallies differ: Blockaid estimated at least $5.5 billion as of 22:00 UTC, Arkham counted $6.01 billion, and TRM Labs estimated about $6.36 billion. The figures use different timings and methods, so they are not directly interchangeable. Binance said roughly $3 billion had been frozen; the source account says stablecoin issuers froze about $2.5 billion to $3 billion. These are reported estimates, not a final accounting.
Binance’s account of the suspected entry point is also preliminary. The company said a compromised DevOps engineer’s laptop may have given the attacker access to a service container used to submit unauthorized withdrawal transactions. Binance said it had found no evidence of a wallet private-key leak. On Ethereum, Blockaid described a transaction carrying 50 pre-signed EIP-7702 permissions for Binance 14, with one matching the wallet’s current transaction number and enabling the attacker’s code. That technical interpretation is attributed to Blockaid; Binance has not yet published a full post-mortem.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Cost of a Hot-Wallet Breach
The reported scale would make this one of the largest known crypto thefts if Binance’s preliminary estimate holds. The source compares the roughly $6.3 billion estimate with the $1.5 billion Bybit hack of February 2025, but the Binance figure remains unconfirmed and could change. The incident also shows how a security failure affecting an exchange’s operational systems can be followed by transfers across several blockchain networks, complicating both tracking and response.
For customers, Binance’s statement that funds are safe and its pledge to cover losses are consequential, but they do not by themselves explain how withdrawals will resume or how the company will verify and account for affected assets. Freezes by stablecoin issuers can restrict movement of some tokens, while ETH and bitcoin cannot be frozen by a token issuer in the same way. TRM estimated about $2.4 billion remained beyond issuer freezes; that figure is an analyst estimate, not a final recovery assessment.
Products Worth Considering
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
EcoFlow DELTA 3 Classic Portable Power Station, 1024Wh, 1800W
As an affiliate, we earn on qualifying purchases.
How the Wallet Permissions Worked
Binance’s principal reported Ethereum loss involved a hot wallet, a wallet used to support exchange operations. The source account says the attack used EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. It lets an externally controlled account authorize code to act for it. Blockaid’s analysis says the attacker supplied 50 permissions tied to consecutive transaction numbers, or nonces, because the wallet’s current nonce was not known in advance; one permission matched.
The timeline reported from public blockchain records and analyst accounts starts with small tests on Oct. 29, followed by deployment and rehearsal of a contract. Outflows from Binance wallets began at about 20:05 UTC. The permission transaction for Binance 14 was recorded at 20:20:59, followed by the large sweep at 20:24:23. Binance later said it revoked the affected address authorization. The sequence is based on public transaction data and attributed analysis, while the explanation of how access was obtained is still under investigation.
Binance posted that it was investigating at 21:29 UTC and said withdrawals would resume once the security issue was resolved. In an update at 02:23 UTC on Oct. 30, it reported the estimated impact, freezes and suspension of deposits and withdrawals. Co-CEO Yi He said at 04:17 UTC that deposits continued to operate normally and withdrawals were expected to begin resuming within 48 hours of her post.
The Unresolved Scope and Attribution
The final amount affected is not established. Binance’s $6.3 billion figure is an estimate, while analyst totals vary by source, time and valuation. The supplied account does not establish how much of the reported movement represents permanent losses, how much may be recoverable, or whether all counted transfers belong to the same incident.
The cause also remains under review. Binance’s laptop and service-container explanation is framed as a possibility, and its statement that it found no evidence of a private-key leak is not a complete public account of the breach. TRM Labs attributed the attack with high confidence to TraderTraitor, a unit it links to North Korea. Neither Binance nor a government had confirmed that attribution in the material available for this report.
It is also unclear when withdrawals would fully return, whether all networks and services would reopen at once, and what further evidence Binance will provide. The account says the attacker-controlled code had been removed from Binance 14 by the morning of Oct. 30, but that does not settle the broader investigation or recovery status.
Withdrawal Resumption and Audit Findings
Binance said withdrawals would resume once the security issue was resolved, while Yi He gave an expectation of beginning to resume them within 48 hours of her Oct. 30 post. That was a stated target, not a confirmed reopening time. The company’s next public update should clarify which services are available and whether restrictions remain on particular networks.
A fuller post-incident report is needed to establish how the attacker gained access, how Binance calculated the impact, what assets were frozen or recovered, and what controls will change. Until then, users should distinguish Binance’s assurances and estimates from independently verified outcomes. The source also warns that scams may pose as refund offers or customer support; readers should rely on Binance’s official channels rather than unsolicited messages.
Key Questions
What happened in the Binance incident?
Binance reported that an attacker moved assets from exchange wallets across multiple blockchains on Oct. 29. The best-documented single transaction swept assets from the Ethereum wallet Binance 14; the exchange estimated the total impact at about $6.3 billion.
Were Binance customer funds affected?
Binance said customer funds are safe and that it would cover losses. The company’s assurance is confirmed as a statement, but the supplied material does not include a completed independent audit or final accounting.
How did the attacker access the Ethereum wallet?
Blockaid said a transaction used EIP-7702 permissions, with one of 50 signed permissions matching Binance 14’s current transaction number and allowing attacker-controlled code to run. Binance separately said a compromised DevOps engineer’s laptop may have enabled access to a service container. The full access path remains under investigation.
Has North Korea been confirmed as responsible?
No. TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. Binance and government authorities had not confirmed that attribution in the supplied material.
When will Binance withdrawals resume?
Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. Binance had not confirmed in the supplied material that withdrawals had reopened, so the timing remained an expectation.
Source: ThorstenMeyerAI.com
