🔍 Read the full analysis: Inside The Binance Hack: Following The Money Minute By Minute on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an attack on its hot wallets had an estimated impact of about $6.3 billion, with withdrawals suspended while it investigates. Blockchain analysts traced outflows across multiple networks, and issuers froze about $3 billion in assets, but the total remains preliminary and attribution to a North Korean-linked group is unconfirmed by Binance or a government.
Binance reported an estimated $6.3 billion impact from an attack that moved assets out of its hot wallets across several blockchains on Oct. 29, suspending deposits and withdrawals while it investigated. The exchange said user funds are safe and it will cover losses; the figure is preliminary, and the attack’s full scope and attribution remain unresolved.
The largest visible transfer came at 20:24 UTC, when a transaction swept 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created address. Blockworks valued that transfer at about $2.5 billion. Binance 16 sent another 28,005.6 ETH to the same address 24 seconds later, according to the public Ethereum record described in the source account.
Outflows were also reported from Binance wallets on Bitcoin, Tron, the XRP Ledger and Solana, among other networks. TRM Labs said transfers began around 20:05 UTC, with a later wave involving Avalanche and Polygon. Estimates differed by source and time: Blockaid put the impact at at least $5.5 billion as of 22:00 UTC, Arkham at $6.01 billion, and TRM at about $6.36 billion. Binance’s estimate was about $6.3 billion. These are preliminary estimates, not a final audited loss.
Binance said a compromised DevOps engineer’s laptop may have given an attacker access to a service container used to submit unauthorized withdrawals. The company said it had found no evidence that a wallet private key was leaked. It suspended deposits and withdrawals as it responded, and said it revoked the affected address authorization by the morning of Oct. 30.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Wallet Attack Affected Users
The scale and spread of the reported outflows make this an operational and financial test for one of the world’s largest crypto exchanges. Binance’s assurance that it will cover losses is relevant to customers, but the incident may still affect access to funds while withdrawals are paused and the company works to secure its systems.
Some assets could be frozen by their issuers. Binance put the amount frozen at about $3 billion; the source account says stablecoin issuers froze roughly $2.5 billion to $3 billion within hours. That does not mean all affected funds are recoverable: assets such as ETH and bitcoin cannot be frozen by a stablecoin issuer. TRM estimated about $2.4 billion was beyond issuer control. The figures may use different counting methods and remain subject to revision.
The incident also highlights risks tied to wallet permissions and the systems that authorize transactions. The reported mechanism involved EIP-7702 permissions on Ethereum, while other network outflows were described as ordinary signed transfers. The precise route into Binance’s systems has not been established publicly.
Products Worth Considering
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Oct. 29 Outflow Timeline
According to the source account’s review of public Ethereum records and reports from TRM Labs and Blockaid, the operator wallet received small withdrawals from Tornado Cash on Oct. 28. On Oct. 29, it tested sweeper code on smaller wallets and deployed the contract later used in the Binance 14 activity. Those steps are reported by analysts and the account author; they do not by themselves establish who controlled the operator wallet.
At 20:20:59 UTC, a transaction carried 50 EIP-7702 permissions for Binance 14, with one matching the wallet’s current transaction number, or nonce, according to Blockaid’s analysis. The subsequent sweep happened at 20:24:23. Other reported transfers followed, including movements from Binance’s Hot Wallet 34 at 20:41 and 20:59. Binance publicly acknowledged reports of a possible security issue at 21:29 UTC and said it was investigating.
Later that night, Circle and Tether announced freezes, followed by actions attributed in the source material to Ripple, World Liberty Financial with BitGo, and Paxos. Binance’s incident update came at 02:23 UTC on Oct. 30. The timeline combines on-chain observations, analyst findings and company statements; those categories do not carry the same level of confirmation.
Loss Estimates and Attribution Remain Open
The final amount affected is not established. Estimates range from at least $5.5 billion to about $6.36 billion, and may reflect different asset prices, chains, cut-off times or counting methods. Binance’s $6.3 billion figure is described as an estimated total impact, not a finalized loss after recovery or insurance calculations.
It is also unclear how the attacker obtained the ability to authorize the transactions. Binance said a compromised employee laptop may have enabled access to a service container, while reporting no evidence of a private-key leak. The company’s wording is provisional, and its post-mortem had not yet been released.
TRM Labs attributed the activity with high confidence to TraderTraitor, which it links to North Korea. That attribution remains an analyst claim in the supplied material; neither Binance nor a government had confirmed it. The amount ultimately recovered, the full list of affected wallets and the timing of normal withdrawals also remained uncertain.
Binance Recovery and Investigation Steps
Binance said deposits and withdrawals were suspended during its response. Yi He said withdrawals were expected to begin resuming within 48 hours of her Oct. 30 post, while an earlier Binance statement said withdrawals would resume once the security issue was fully resolved. That timetable was an expectation, not a confirmed reopening notice.
The next key disclosures are Binance’s post-mortem, a more settled accounting of assets affected and recovered, and an update on the cause of the unauthorized activity. Readers should distinguish those future findings from the current estimates and analyst assessments. Binance also warned that withdrawals or refund-related scams may target users; customers should rely on official exchange channels rather than unsolicited messages.
Key Questions
How much was taken from Binance?
Binance estimated the total impact at about $6.3 billion. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion. The figures are not a final audited loss.
Were Binance users’ funds affected?
Binance said user funds are safe and that it would cover losses. Deposits and withdrawals were suspended during the response, and the company had not yet published its full post-mortem in the supplied material.
How did the attacker access the hot wallet?
Analysts said an EIP-7702 permission transaction caused Binance 14 to run attacker-controlled code. Binance said a compromised DevOps engineer’s laptop may have provided access to a service container, but the cause remains under investigation.
How much of the stolen crypto was frozen?
Binance reported about $3 billion frozen. The source material says stablecoin issuers froze roughly $2.5 billion to $3 billion, but not all assets can be frozen by issuers, and the recoverable total is still unclear.
Who carried out the attack?
TRM Labs attributed it with high confidence to TraderTraitor, a group it links to North Korea. That remains an analyst assessment; Binance and government authorities had not confirmed the attribution in the source material.
Source: ThorstenMeyerAI.com
