🔍 Read the full analysis: How Billions Left Binance: Following The Hack Through One Evening on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says attackers drained assets from its hot wallets across several blockchains on Oct. 29, with an estimated impact of about $6.3 billion. Blockchain analysts traced a major Ethereum transfer to a wallet takeover using EIP-7702 permissions, while Binance says user funds are safe and it will cover losses. The totals, attribution and full cause remain subject to investigation.
Binance says a security incident on Oct. 29 affected about $6.3 billion in assets, after an attacker took control of its Ethereum hot wallet Binance 14 and funds also left company wallets on other blockchains. The exchange says user funds are safe and it will cover losses, but withdrawals were suspended while it responded and the damage estimates remain preliminary.
The most visible transfer occurred at 20:24 UTC on Oct. 29. In a single Ethereum transaction, 167,464 ETH, 1.615 billion USDT and 62 other tokens moved from Binance 14 to a newly created wallet. Blockworks valued that transfer at roughly $2.5 billion. Public Ethereum records reviewed by the source show that 24 seconds later another Binance wallet sent 28,005.6 ETH to the same receiving address.
The incident extended beyond Ethereum. TRM Labs reported outflows from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks, including transfers made through ordinary signed transactions. Binance’s Oct. 30 update put the estimated total impact at about $6.3 billion. Other early estimates differ: Blockaid reported at least $5.5 billion, Arkham about $6.01 billion and TRM about $6.36 billion. They are preliminary figures calculated at different times and prices.
Binance said an investigation found that a compromised DevOps engineer’s laptop may have given the attacker access to a service container used to submit unauthorized withdrawal transactions. The company also said it had found no evidence of a wallet private-key leak. Stablecoin issuers froze assets worth roughly $2.5 billion to $3 billion, according to the source’s summary of issuer actions and tracking reports. Those freezes do not apply to assets such as ETH and bitcoin.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Losses Affect Customers
The incident matters because it involved assets held in exchange wallets, not just a single user’s account, and because transfers were reported across multiple networks. Binance says customer balances will be protected and it will cover losses; the source material does not identify any customer loss or provide a final accounting. The scale cited by Binance, if confirmed, would make this a major test of the exchange’s ability to secure hot wallets and restore services.
Freezes by stablecoin issuers can limit how much of a stolen balance remains usable, but not all crypto assets can be frozen by an issuer. TRM estimated that about $2.4 billion was beyond issuer control. That figure is an analyst estimate, not a final measure of what the attacker can spend or retain. The incident also shows how a wallet authorization feature can create risk if a signing system or the infrastructure around it is compromised.
For customers, the immediate practical concern is service availability and reliable information. Binance said deposits continued to operate normally, but withdrawals were paused pending resolution. The source warns users to be alert to fake refund and support messages; no customer should treat unsolicited claims of reimbursement as verified without checking Binance’s official channels.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
As an affiliate, we earn on qualifying purchases.
The Ethereum Permission Behind the Sweep
Blockchain analyst Blockaid’s account of the Ethereum transaction centers on EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act for it. In the incident, the source says, the attacker attached a program to Binance 14 through signed permissions, then used it to move the wallet’s assets.
According to Blockaid, the transaction carried 50 permissions tied to consecutive transaction numbers, or nonces. Only the permission matching Binance 14’s current nonce could take effect. The source reports that one matched, allowing the wallet to run the attacker’s code. This is an account of the on-chain mechanism from analysts, not a complete explanation of how the attacker obtained the required authorization.
The source’s timeline says small test withdrawals from Tornado Cash reached the operator wallet on Oct. 28, followed by tests of the sweeping code on smaller wallets on Oct. 29. Outflows began from Binance wallets at about 20:05 UTC, before the main Binance 14 transaction at 20:24. Binance announced that it was investigating at 21:29 and said at 22:15 that withdrawals would resume after the issue was resolved. By the morning of Oct. 30, Binance said it had revoked the affected address authorization.
Damage Totals and Attribution Remain Open
The final loss total is not settled. Binance’s estimate of about $6.3 billion is close to TRM’s estimate but differs from other early counts. The source notes that estimates used different cut-off times and asset prices, so they should not be treated as directly comparable final figures. It is also unclear how much of the transferred value can ultimately be recovered or how much remains accessible to the attacker.
The precise access path is still under investigation. Binance said a compromised laptop may have provided access to a service container, while also reporting no evidence that a wallet private key was leaked. The supplied material does not establish how the laptop was compromised, what controls were bypassed, or whether the service container itself was the sole route to the unauthorized transactions.
TRM’s attribution to TraderTraitor is an analyst assessment, not a confirmed finding by Binance or a government. The source also says Binance planned a post-mortem; no completed report or independently verified breakdown of affected wallets and losses is included in the material available for this article.
Withdrawal Restoration and the Audit
Binance said deposits were operating normally and that withdrawals were expected to begin resuming within 48 hours of Yi He’s Oct. 30 post. That was a target, not a confirmed reopening time. Customers should check the exchange’s official service notices for current status rather than rely on third-party messages or purported refund offers.
The next major disclosure is expected to be Binance’s post-incident account, including how the attacker gained authorization, the final value affected, the extent of any recovery and what safeguards have changed. Until that information is published and independently assessed, the company’s explanation, the aggregate estimates and the attribution should be treated as developing.
Key Questions
How much did Binance say was affected?
Binance estimated the incident’s total impact at about $6.3 billion in its Oct. 30 update. Analysts reported different preliminary totals, and the final accounting remains unclear.
Were customer funds lost?
Binance said user funds are safe and that it will cover losses. The supplied material does not include an independent audit or a final report establishing the full impact on customer balances.
How did the Ethereum wallet get drained?
Blockaid said the attacker used EIP-7702 permissions to make Binance 14 run unauthorized code and sweep its assets. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container, but the exact entry route is still under investigation.
Who is believed to be responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. The supplied material says neither Binance nor a government had confirmed that attribution.
When will Binance withdrawals resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. The source does not confirm that withdrawals had resumed, so customers should check Binance’s current official notices.
Source: ThorstenMeyerAI.com
