🔍 Read the full analysis: How The Binance Hack Sent Billions Out Over The Course Of An Evening on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact after an attacker drained its hot wallets across several blockchains on Oct. 29. The exchange says user funds are safe and it will cover losses; stablecoin issuers froze about $3 billion, while the total and the cause remain under investigation.
Binance reported an estimated $6.3 billion impact from an attack that drained funds from its wallets across multiple blockchains on the evening of Oct. 29, making it potentially the largest cryptocurrency theft on record if the preliminary estimate holds. The exchange said user funds are safe and it will cover losses, while deposits and withdrawals were suspended during its response.
The central transaction came at 20:24 UTC, when an attacker swept 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance hot wallet identified as “Binance 14,” according to the public Ethereum record reviewed by the source report. Blockworks valued that transfer at about $2.5 billion. Other Binance wallets also sent assets to attacker-controlled addresses across several networks, according to blockchain security firm TRM Labs.
The total remains an estimate, with published figures varying by source and calculation time. Binance put the impact at about $6.3 billion; TRM estimated roughly $6.36 billion, Arkham $6.01 billion and Blockaid at least $5.5 billion as of 22:00 UTC. Binance said about $3 billion had been frozen. The report says stablecoin issuers froze roughly $2.5 billion to $3 billion, while assets such as ETH and bitcoin cannot be frozen by those issuers.
Binance said its investigation found that a compromised DevOps engineer’s laptop “may” have enabled an attacker to access a service container and submit unauthorized withdrawal transactions. The company reported no evidence of a wallet private-key leak. It had not published a full post-mortem by the time of the Oct. 30 update. Binance also said it revoked the affected address authorization; the attacker’s code was no longer running on Binance 14 by the morning of Oct. 30.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
A Multi-Chain Loss and Recovery
The reported scale matters to customers and the wider crypto market because this was not limited to one asset or one blockchain. Funds moved from Binance wallets on Ethereum, Bitcoin, Tron, the XRP Ledger and Solana, among other networks, according to TRM Labs. A loss of this size would exceed the $1.5 billion Bybit hack of February 2025, though the Binance estimate is still preliminary and the comparison depends on final valuations.
Binance’s assurance that users will not bear the losses is central to the immediate response, but the suspension of withdrawals temporarily limited customers’ access to funds. Freezes by stablecoin issuers may help contain part of the outflow; they cannot recover every asset or establish how the attacker gained access. The incident also puts attention on the controls around exchange hot wallets and the systems authorized to initiate transactions.
TRM Labs attributed the attack “with high confidence” to TraderTraitor, a group it links to North Korea. That is an attribution by a private analytics firm, not a confirmed finding by Binance or a government. The identity of the attacker and the full route taken by the funds remain unsettled.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
DJI Osmo Mobile 7P Phone Gimbal with Mic Mini Transmitter, Infinity Black
As an affiliate, we earn on qualifying purchases.
The source report identifies EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025, as the mechanism used to take control of Binance 14. The feature lets an externally owned account authorize code to act for it. According to Blockaid’s analysis, one transaction carried 50 pre-signed permissions tied to 50 consecutive transaction numbers, or nonces. One matched the wallet’s current nonce, allowing the attacker’s code to run.
On-chain records reviewed by the report show tests with small wallets earlier on Oct. 29 and deployment of the contract later that afternoon. Outflows from Binance wallets began at about 20:05 UTC. The large Binance 14 sweep followed at 20:24:23. A separate Binance wallet sent 28,005.6 ETH to the same address 24 seconds later in an ordinary signed transaction, according to the report. These timing details come from public blockchain records and analysis; they do not by themselves establish who controlled the wallets or how Binance’s internal systems were accessed.
Binance first said on X at 21:29 UTC that it was investigating reports of a potential security issue and that user funds were safe. It later said withdrawals would resume once the issue was resolved. Its Oct. 30 incident update gave the $6.3 billion estimate and described the laptop as a possible entry point.
“The attack is attributable with high confidence to TraderTraitor.”
— TRM Labs
Final Losses and Attribution Remain Open
The $6.3 billion impact is preliminary, and published totals differ according to the assets counted, valuation prices and time of calculation. The source report does not establish a final amount of unrecoverable losses. Although issuers froze billions in stablecoins, the status and eventual recovery of other assets are not fully known.
Binance’s account of a potentially compromised laptop is also provisional: the company said the device “may” have provided access to a service container and reported no evidence that private keys were leaked. A full technical post-mortem, including the exact access path and the roles of the affected wallets, was still pending. TRM’s attribution to TraderTraitor has not been independently confirmed by Binance or a government.
Withdrawals and the Post-Mortem
Binance said deposits continued to operate normally and that withdrawals were expected to begin resuming within 48 hours of Yi He’s Oct. 30 post. That was a stated expectation, not confirmation of a completed restart. Customers should check Binance’s official channels for service status; the source report also warns that scammers may impersonate support or offer supposed refunds.
The next major milestone is Binance’s full incident post-mortem, which should clarify the access route, the scope of affected systems, the final loss calculation and how much of the assets can be recovered. Until those details are released, both the financial estimate and the explanation for the attack remain subject to revision.
Key Questions
How much did the Binance attack cost?
Binance estimated an impact of about $6.3 billion in its Oct. 30 update. Other estimates ranged from at least $5.5 billion to about $6.36 billion, depending on the source and calculation time. The final amount has not been established.
Are Binance customers’ funds safe?
Binance said user funds are safe and that it will cover all losses. Withdrawals were suspended during the response, so customers’ access to funds was temporarily affected. The exchange’s assurance does not resolve the open questions about the attack’s final cost or technical cause.
How did the attacker take control of Binance 14?
Analysis cited in the source report says the attacker used an EIP-7702 authorization on Ethereum to make the wallet run attacker-controlled code. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container, but it had not issued a full post-mortem.
How much money was frozen?
Binance reported about $3 billion frozen; the source report says stablecoin issuers froze roughly $2.5 billion to $3 billion. That does not cover all the assets involved, and the amount ultimately recoverable remains unclear.
Who was responsible for the attack?
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government in the information available for this report.
Source: ThorstenMeyerAI.com
