🔍 Read the full analysis: The Binance Evening Hack: Following Events As They Unfolded on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says a security incident on October 29 affected about $6.3 billion in assets across its wallets, and that it will cover losses and keep user funds safe. Analysts describe a large hot-wallet sweep and outflows across multiple blockchains; the exact impact, cause and attacker identity remain under investigation.
Binance reported an estimated $6.3 billion impact from a security incident that began on October 29 with a large withdrawal from its Ethereum hot wallet, Binance 14. The exchange said user funds are safe and it will cover losses, while deposits and withdrawals were suspended as it investigated the activity across multiple blockchains.
At 20:24 UTC on October 29, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from Binance 14 to a newly created wallet, according to the public Ethereum record reviewed by the source report. Blockworks valued that transaction at roughly $2.5 billion. A separate transfer of 28,005.6 ETH from Binance wallet Binance 16 followed seconds later, the report said.
TRM Labs reported outflows from Binance wallets on several networks, including Bitcoin, Tron, the XRP Ledger and Solana, as well as later activity involving Avalanche and Polygon. Binance put the estimated total impact at about $6.3 billion in an October 30 security update. Other preliminary estimates differed: Blockaid cited at least $5.5 billion, Arkham about $6.01 billion, and TRM about $6.36 billion. These figures depend on timing, asset prices and counting methods and have not been presented as a final accounting.
Binance said it had found no evidence that a wallet private key was leaked. The exchange said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions. Binance also said it revoked the affected address authorization. Stablecoin issuers froze an estimated $2.5 billion to $3 billion, according to the source report; assets such as ETH and bitcoin cannot be frozen by those issuers.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of the Reported Losses
If Binance’s preliminary estimate is borne out, the incident would rank among the largest cryptocurrency thefts reported. The source report compares the roughly $6.3 billion estimate with the $1.5 billion Bybit theft reported in February 2025, while stressing that Binance’s figure is not final. The scale matters both for the exchange’s balance sheet and for confidence in the security of centralized trading platforms.
The incident also highlights how a single compromised operational system can have consequences beyond one blockchain. The reported transfers involved multiple networks and asset types, while the freezing of some stablecoins did not make all funds recoverable: the source report estimates about $2.4 billion remained beyond issuer freeze controls. Binance’s assurance that users will be protected is significant, but the exchange has not yet published its full post-mortem or final loss accounting.
For customers, the immediate practical effect was disruption to withdrawals and deposits while Binance responded. The company said deposits continued to operate normally in a later message, but its October 30 update said deposits and withdrawals were suspended. That difference reflects changing status reports over the night; customers should rely on current official exchange notices rather than older posts or messages claiming to arrange refunds.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with 1 CMOS & 4K/120fps
As an affiliate, we earn on qualifying purchases.
How the Wallet Was Reconfigured
The source report says the main Ethereum wallet activity involved EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act for it. According to the report’s account of Blockaid’s analysis, one transaction carried 50 signed permissions for consecutive transaction numbers, or nonces, associated with Binance 14. One permission matched the wallet’s current nonce, allowing the attacker’s code to run.
The reported preparation began before the largest transfer. TRM and the source report describe small withdrawals to an operator wallet from Tornado Cash on October 28, tests of sweeper code on October 29, and deployment of a contract later used with Binance 14. Around 20:05 UTC, outflows began from Binance wallets on several chains. The large Ethereum sweep followed at 20:24 UTC. The source author says they checked the public Ethereum record on the morning of October 30; the interpretation of the technical method is attributed to Blockaid and TRM, rather than presented as a completed independent investigation.
Binance’s first public post about a potential security issue appeared at 21:29 UTC on October 29. The exchange later said withdrawals would resume when the issue was resolved. Its October 30 update put the estimated impact at about $6.3 billion and said the affected authorization had been revoked. The source report describes the attacker’s wallet movements and the exchange’s public statements, but a full technical post-mortem had not yet been released.
What Investigators Have Yet to Confirm
The final value of affected assets remains unsettled. Binance’s estimate and outside analysts’ totals vary, and the figures are preliminary. The available information does not establish how much of the reported amount represents permanently lost funds, recoverable assets, or movements counted at different prices and times.
The precise access route is also not confirmed. Binance said a DevOps engineer’s compromised laptop may have given an attacker access to a service container, while saying it found no evidence of a private-key leak. A complete incident report has not been released, so the sequence between the reported laptop compromise, the Ethereum authorization and the ordinary signed transfers on other networks remains unclear.
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea, according to the source report. Binance and government authorities had not confirmed that attribution in the material provided. The identity of the attacker, the amount ultimately recovered and whether any additional systems were affected are also not established.
Withdrawal Restoration and the Post-Mortem
Binance’s next immediate task is to restore normal access while continuing its investigation. On October 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. That was a projected timeframe, not confirmation that withdrawals had reopened. The exchange also said the affected authorization had been revoked, but the source material does not provide a final service-restoration notice.
Readers should watch for a formal post-mortem and revised asset accounting from Binance, as well as any further statements from stablecoin issuers about frozen funds. Independent investigators may publish additional findings on the wallet permissions, cross-chain transfers and recovery prospects. Until then, totals and attribution should be treated as preliminary.
Binance customers should use the exchange’s official channels for account updates. The source report warns that incidents of this kind can prompt fraudulent messages posing as customer support or refund offers. No refund process or recovery offer is confirmed in the supplied material.
Key Questions
How much did the Binance incident affect?
Binance estimated the impact at about $6.3 billion in its October 30 update. Outside estimates cited in the source report ranged from at least $5.5 billion to about $6.36 billion. The figures are preliminary and differ by timing, prices and counting method.
Did Binance say customer funds were safe?
Yes. Binance said user funds are safe and that it would cover losses. These are the exchange’s statements; the supplied material does not include a completed independent post-mortem or final loss accounting.
How was Binance 14 reportedly accessed?
The source report, citing Blockaid’s analysis, says a transaction included 50 EIP-7702 permissions for consecutive transaction numbers, and one matched Binance 14’s current nonce. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container, but the full method has not been confirmed in a post-mortem.
Who carried out the attack?
TRM Labs attributed the incident with high confidence to TraderTraitor, which it links to North Korea. That attribution was not confirmed by Binance or a government authority in the supplied material.
When were withdrawals expected to resume?
On October 30, Binance co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. This was an expected timeframe, not confirmation that withdrawals had resumed.
Source: ThorstenMeyerAI.com
