🔍 Read the full analysis: The Binance Hack, Explained: How Billions Left In One Evening on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance reported an estimated $6.3 billion impact after attackers took control of a hot wallet and funds moved from Binance wallets across several blockchains. The company says users’ funds are safe and it will cover losses; investigators’ totals and attribution remain preliminary, and a post-incident report is pending.
Binance said on October 30 that an attack affecting its wallets caused an estimated $6.3 billion impact, after attackers took control of the exchange’s Ethereum hot wallet Binance 14 and funds moved across multiple blockchains. Binance says user funds are safe and it will cover losses, while deposits and withdrawals were suspended as the company investigated.
The first major transfer came at 20:24 UTC on October 29, when a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from Binance 14 to a newly created wallet. Blockworks valued that transaction at about $2.5 billion. Public Ethereum records show that a separate Binance wallet sent 28,005.6 ETH to the same receiving address 24 seconds later. Further transfers continued for hours, including movements from Binance wallets on other networks.
Estimates differ because analysts used different methods, timestamps and asset prices. Binance put the estimated total impact at about $6.3 billion. TRM Labs estimated about $6.36 billion; Arkham reported $6.01 billion, while Blockaid’s early estimate was at least $5.5 billion. These are preliminary figures, not a final accounting of confirmed losses.
Binance said the attack may have begun when a DevOps engineer’s laptop was compromised, allowing access to a service container used to submit unauthorized withdrawal transactions. The exchange said it found “no evidence of any wallet private key leak.” It has not yet published a full post-mortem. Stablecoin issuers froze some funds, but assets such as ETH and bitcoin cannot be frozen by an issuer, limiting how much could be blocked.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
A Major Test for Exchange Security
The incident matters because it involved a large exchange’s operational wallet infrastructure, not just an individual account. Hot wallets hold assets online so an exchange can process transfers and withdrawals; a compromise can put substantial funds at risk before security teams can respond. The reported movement across several networks also complicates tracking and recovery.
Binance’s assurance that users will not bear the losses is central to the immediate impact on customers. But that assurance does not answer how the attack succeeded, what portion of the reported total represents recoverable or frozen assets, or whether any services will remain restricted. The incident also highlights the limits of intervention: stablecoin issuers can freeze tokens under their control, while decentralized assets generally cannot be stopped in the same way.
For customers, the immediate practical concern is access to deposits and withdrawals and the risk of fraudulent messages claiming to offer refunds or support. Binance’s service update said deposits continued to operate normally, while withdrawals were expected to resume in stages.
Popular right now
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker, NC701
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)
Sony BRAVIA 5 85-Inch Mini LED 4K HDR Smart TV (K-85XR50)
As an affiliate, we earn on qualifying purchases.
How the Wallet Permission Was Used
According to Binance and blockchain analysts cited by the source report, the attack involved EIP-7702, an Ethereum feature that lets an externally owned account authorize code to run on its behalf. The feature is part of Ethereum’s Pectra upgrade, which went live in May 2025. In this case, the authorization allowed attacker-controlled code to operate through Binance 14 and move its assets.
Blockaid’s analysis found that a transaction carried 50 pre-signed permissions tied to 50 consecutive transaction numbers, or nonces. Only one matched the wallet’s current nonce, according to that analysis. Public chain records show the resulting sweep at 20:24 UTC. Earlier, the operator had tested code on smaller wallets and deployed the contract later used in the attack, according to the report’s review of chain activity and TRM Labs’ findings.
Binance’s statement and the blockchain evidence describe different parts of the incident: the exchange has offered a possible route through a compromised laptop and service container, while on-chain records show the transfers and authorization activity. The company’s planned post-mortem is needed to explain how those elements connect.
“The attack is attributed with high confidence to TraderTraitor, a unit linked by the firm to North Korea.”
— TRM Labs
Losses and Attribution Remain Open
The $6.3 billion estimate is not final, and the source material does not establish that every dollar in the reported impact was permanently lost. Different organizations issued different totals, and the amount frozen by issuers also varied: Binance reported roughly $3 billion, while earlier reports cited approximately $2.5 billion to $2.54 billion. The final disposition of the remaining assets is unclear.
Binance’s explanation about a compromised laptop is preliminary. The company has not released its post-mortem, and it is not yet clear how an attacker gained or used the access described, whether other systems were affected, or what controls failed. TRM Labs’ link to TraderTraitor is an analyst assessment; no government confirmation is included in the source material.
The duration and scope of service restrictions also remain subject to change. Binance said withdrawals were expected to begin resuming within 48 hours of co-CEO Yi He’s October 30 update, but the source material does not confirm that withdrawals had restarted.
Binance Plans a Forensic Report
Binance said it was investigating, had revoked the affected address authorization and would publish a post-incident account. The next key information will be a clearer breakdown of the funds moved, frozen or recovered, and a technical explanation of how the service-container access led to wallet transactions.
The exchange’s co-CEO, Yi He, said on October 30 that deposits continued to operate normally and withdrawals were expected to begin resuming within 48 hours. That was a stated expectation, not confirmation that withdrawals had resumed. Customers should rely on Binance’s official service notices for changes and treat unsolicited messages offering refunds or account assistance with caution.
Key Questions
How much did Binance say was affected?
Binance estimated the total impact at about $6.3 billion. Other early estimates ranged from at least $5.5 billion to about $6.36 billion, so the figure remains preliminary.
Were customer funds lost?
Binance said user funds are safe and that it will cover all losses. The source material does not include a final accounting of the incident or independent confirmation of the company’s complete assessment.
How did the attackers access the wallet?
Binance said a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized transactions. Analysts identified use of Ethereum’s EIP-7702 authorization feature, but the full chain of access has not been explained in a post-mortem.
Was the attack linked to North Korea?
TRM Labs attributed the activity with high confidence to TraderTraitor, a group it links to North Korea. That attribution was not confirmed by Binance or a government in the source material.
When will withdrawals resume?
On October 30, Binance co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours. The source material does not confirm that service had resumed by the time of publication.
Source: ThorstenMeyerAI.com
