🔍 Read the full analysis: A Timeline Of Binance’s Hack, From The First Minutes To The Aftermath on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an attack on Oct. 29 affected about $6.3 billion across its wallets, including a major theft from its Ethereum hot wallet. The exchange says user funds are safe and it will cover losses; stablecoin issuers froze about $3 billion, while the total and the attacker’s identity remain preliminary or unconfirmed.
Binance said on Oct. 30 that an attack on its wallets the previous evening had an estimated impact of about $6.3 billion, prompting the exchange to suspend deposits and withdrawals while it investigated. The attack included a major drain from an Ethereum hot wallet; Binance said user funds were safe and it would cover losses, but the impact estimate and the full sequence of events remained under review.
The largest single outflow described in the available account occurred at 20:24 UTC on Oct. 29. A transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance hot wallet identified as “Binance 14” to a newly created address. Blockworks valued that transaction at roughly $2.5 billion. About 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same destination in a separately signed transfer.
Other outflows began around 20:05 UTC across multiple blockchains, according to blockchain analytics firm TRM Labs. TRM said wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks sent funds through ordinary signed transfers. It also reported a second wave involving Avalanche and Polygon at about 23:05. Binance’s Oct. 30 update put the estimated total impact at around $6.3 billion and said about $3 billion had been frozen. Those figures are estimates, not a final accounting.
Binance’s timeline says withdrawals were paused as the incident was investigated. At 21:29 UTC on Oct. 29, the company wrote on X: “Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.” At 02:23 UTC on Oct. 30, it issued a security update citing the estimated impact, frozen funds and a possible laptop compromise. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. Binance also said it had revoked the affected address authorization by the morning of Oct. 30.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Wallet Drain Affected Users
The incident matters because it involved billions of dollars in assets held across several networks and temporarily disrupted access to exchange services. Binance said customers’ funds were safe and that it would cover losses. That assurance is the company’s stated position; the supplied account does not include a completed independent audit or a final loss calculation.
Some stolen stablecoins could be frozen by their issuers, while assets such as ETH and bitcoin cannot be frozen by a central issuer. The source reports that issuers froze roughly $2.5 billion to $3 billion within hours. TRM estimated about $2.4 billion remained beyond issuer control. The amounts are preliminary and depend on which assets and prices are counted. The freeze response may limit the attacker’s ability to move some funds, but it does not establish that all affected assets will be recovered.
For customers, the immediate practical effect was the suspension of deposits and withdrawals while Binance worked to secure the affected systems. The service interruption also created an opening for fraudulent refund or support messages. Customers should rely on Binance’s official channels for incident updates rather than unsolicited offers, though the supplied reporting does not document specific scam cases.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
As an affiliate, we earn on qualifying purchases.
From EIP-7702 to the Sweep
The public Ethereum record and reporting cited by the source indicate that preparations predated the main outflows. TRM and Blockworks reported that an operator wallet received three small withdrawals from Tornado Cash on Oct. 28. On Oct. 29, the operator tested sweeper code on two small wallets between 13:51 and 14:24 UTC, then deployed a contract at 15:59 and rehearsed it on another wallet until 16:47, according to the source’s review of on-chain data.
The reported mechanism used EIP-7702, an Ethereum feature that lets an externally owned account authorize code to act for it. The source says one transaction at 20:20:59 carried 50 permissions for Binance 14, each associated with a different consecutive transaction number, or nonce. Blockaid’s analysis says one permission matched the wallet’s current nonce, allowing the attacker’s code to run and sweep the assets. The account says this permission required a signature associated with the wallet, but the precise access path has not been publicly established.
At 20:38:47, about 195,460 ETH—valued in the source at roughly $450 million—moved to another newly created wallet. The source says that address had not sent a transaction by the morning of Oct. 30. Binance later said a compromised DevOps engineer’s laptop “may” have provided access to a service container used to submit unauthorized withdrawals. It also said it had found no evidence of a wallet private-key leak. These are preliminary company statements, not a published final forensic report.
“TRM attributed the attack “with high confidence” to TraderTraitor, a unit it links to North Korea.”
— TRM Labs
The Total and Entry Route
The final value of the losses is not settled. The source lists estimates ranging from at least $5.5 billion from Blockaid at 22:00 UTC to about $6.01 billion from Arkham, about $6.36 billion from TRM and around $6.3 billion from Binance. These are estimates made at different times and using different methods or prices; they should not be treated as directly comparable final figures.
It is also not yet clear exactly how the attacker obtained the ability to authorize code for Binance 14 or sign transfers from other wallets. Binance’s laptop and service-container explanation is tentative, and its statement that it found no evidence of a private-key leak does not by itself resolve the access question. The supplied source says a post-mortem was still to come.
Attribution remains unconfirmed by Binance or a government in the source material. TRM’s assessment linking the attack to TraderTraitor and North Korea is an attributed analytical judgment, not an official determination. The ultimate recovery of frozen or otherwise moved assets is also unknown.
Incident Review and Withdrawal Resumption
Binance said withdrawals were expected to begin resuming within 48 hours of Yi He’s Oct. 30 post, after the company had earlier said they would return once the security issue was resolved. The source does not confirm whether that timetable was met. Binance’s next key step is a fuller incident report explaining the wallet authorization, the suspected laptop compromise, the scope of affected systems and the final accounting of assets.
Customers should watch Binance’s official service notices for the status of deposits and withdrawals. The recovery picture will depend in part on continued tracing and cooperation with stablecoin issuers and other relevant parties. Until Binance publishes its post-mortem and a reconciled total, the cause, final loss figure and amount recoverable remain open.
Key Questions
When did the Binance attack happen?
Reported outflows began around 20:05 UTC on Oct. 29, 2026. The largest described Ethereum transaction occurred at 20:24 UTC. Binance issued a detailed incident update on Oct. 30.
How much money was affected?
Binance estimated the total impact at about $6.3 billion. Other estimates in the source range from at least $5.5 billion to about $6.36 billion. The figures are preliminary and use different counting times or methods.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover losses. The supplied account does not include a final independent audit or final loss calculation.
How much of the stolen money was frozen?
Binance reported about $3 billion frozen; the source also cites a verified figure of $2.54 billion at about 23:30 UTC on Oct. 29. Stablecoin issuers can freeze some tokens, but not ETH or bitcoin. The totals remain preliminary.
Who was responsible?
TRM Labs attributed the attack “with high confidence” to TraderTraitor, which it links to North Korea. The source says Binance and government authorities had not confirmed that attribution.
Source: ThorstenMeyerAI.com
