🔍 Read the full analysis: One Evening At Binance: The Hack, The Timeline, And What We Don’t Know on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact from a security incident that began on October 29, 2026, involving its hot wallets across several blockchains. The company says user funds are safe and it will cover losses; the reported totals remain preliminary, and the cause and attacker’s identity have not been independently confirmed.
Binance said on October 30 that a security incident affecting wallets on several blockchains had an estimated impact of about $6.3 billion, after an attacker drained a major Ethereum hot wallet the previous evening. The company said user funds are safe and it will cover losses, while withdrawals remained suspended as Binance investigated and worked to restore service.
The central event occurred at 20:24 UTC on October 29. A transaction emptied a Binance wallet identified as “Binance 14,” moving 167,464 ETH, 1.615 billion USDT and 62 other tokens, according to the public Ethereum record reviewed by ThorstenMeyerAI.com and reporting cited from Blockaid. Blockworks valued that transaction at roughly $2.5 billion. About 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same receiving address in an ordinary signed transaction.
The incident was not confined to Ethereum. TRM Labs reported outflows from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks, with a second wave involving Avalanche and Polygon later in the evening. Estimates varied by source and time: Blockaid put the impact at at least $5.5 billion as of 22:00 UTC, Arkham at $6.01 billion, TRM at about $6.36 billion, and Binance at about $6.3 billion. These are preliminary estimates, not a final audited loss figure.
Binance’s October 30 update said it had identified a compromised DevOps engineer’s laptop as a possible route into a service container used to submit unauthorized withdrawals. The company said it had found “no evidence of any wallet private key leak”. Binance also said about $3 billion had been frozen, while earlier reporting put the verified frozen amount at $2.54 billion. Stablecoin issuers can freeze some assets under their control; ETH and bitcoin cannot be frozen by those issuers.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale and Reach of the Loss
If Binance’s estimate holds, the incident would rank among the largest cryptocurrency thefts reported, at roughly four times the $1.5 billion Bybit hack reported in February 2025. That comparison is conditional: Binance’s total is still an estimate, and the counts differ by source, timing and asset prices.
The episode also shows why a single exchange security incident can span multiple networks. According to TRM Labs, funds moved from wallets on several blockchains during the same window, while the large Ethereum transfer was followed by activity involving other Binance wallets. The incident has immediate consequences for customers because withdrawals were paused while the company investigated, even as Binance said customer balances would be protected and losses covered.
Asset recovery is another concern. Issuers froze billions of dollars’ worth of stablecoins, according to the source reports, but that does not mean all affected assets are recoverable. The reported ETH and bitcoin holdings cannot be frozen by stablecoin issuers, and the eventual amount recovered remains unknown.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
As an affiliate, we earn on qualifying purchases.
How the Ethereum Wallet Was Taken
Blockchain analysts cited in the source material say the Ethereum wallet takeover used EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act for it. In the reported transaction, the attacker supplied 50 pre-signed authorizations for consecutive transaction numbers, or nonces, for Binance 14. Blockaid’s analysis says one authorization matched the wallet’s current nonce, allowing the attacker’s code to run and the funds to be swept.
The timeline described by the source begins with small withdrawals from Tornado Cash on October 28, followed by tests of sweeper code on October 29. The attacker deployed a contract that afternoon and rehearsed with it on another wallet before the main incident. Binance wallet outflows began at about 20:05 UTC; the key authorization transaction followed at 20:20:59, and the large Ethereum sweep at 20:24:23.
Binance posted at 21:29 UTC that it was investigating reports of a potential security issue and said user funds were safe. It later said withdrawals would resume once the issue was resolved. Binance’s October 30 update gave the estimated impact, noted the possible laptop compromise, and said deposits and withdrawals had been suspended. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. Binance later said it revoked the affected address authorization, and the wallet no longer ran the attacker’s code by the morning of October 30, according to the source material.
Open Questions on Cause and Recovery
The full attack path is not yet established. Binance’s account of a compromised DevOps engineer’s laptop is framed as a possibility, and the company says it has found no evidence of a wallet private-key leak. The source material says a post-mortem is still to come; it does not establish how the attacker obtained the permissions used in the Ethereum transaction or how the other wallet transfers were authorized.
The total financial impact and recoveries are also unsettled. The estimates range from $5.5 billion to about $6.36 billion, with differing timestamps and valuation methods. Binance’s reported frozen total and earlier verified figure are not identical, and the final amount recovered has not been stated. TRM Labs attributed the operation “with high confidence” to TraderTraitor, a group it links to North Korea, but neither Binance nor a government had confirmed that attribution in the material provided.
The status of customer withdrawals after Yi He’s stated 48-hour window, the final technical findings, and whether the company’s estimated impact will change remain unclear from the source material. Readers should also treat unsolicited refund or support messages cautiously; the source warns that scammers may pose as Binance staff.
Binance’s Investigation and Withdrawal Restart
Binance said it was continuing its investigation and would resume withdrawals once the security issue was resolved. Yi He’s October 30 post set an expectation that withdrawals would begin resuming within 48 hours, but the source does not confirm that they had restarted. The next concrete developments are an updated service-status notice, a fuller technical post-mortem and revised figures for frozen or recovered assets.
Customers should rely on Binance’s official channels for service updates and avoid sharing credentials or responding to messages promising refunds. Further analysis from blockchain firms may refine the transaction timeline and asset totals, but attribution and the complete route into the affected systems still require confirmation.
Key Questions
How much did Binance say the incident affected?
Binance estimated the impact at about $6.3 billion in its October 30 update. Other preliminary estimates cited in the source ranged from $5.5 billion to about $6.36 billion, depending on the source and time of calculation.
Were Binance customer funds affected?
Binance said user funds are safe and that it would cover all losses. Withdrawals were suspended during the investigation. The source material does not provide a final independent accounting of customer balances or recoveries.
How was the Ethereum hot wallet drained?
Blockaid’s analysis says the attacker used EIP-7702 authorizations for Binance 14. One of 50 pre-signed permissions matched the wallet’s current transaction number, allowing attacker-controlled code to run and transfer assets.
Who carried out the attack?
TRM Labs attributed it “with high confidence” to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government in the source material.
When were withdrawals expected to resume?
Binance co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within the next 48 hours. That was an expectation, not confirmation that withdrawals had restarted.
Source: ThorstenMeyerAI.com
