🔍 Read the full analysis: How Billions Left Binance In One Evening: A Minute-by-Minute Account on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact after funds left its wallets across several blockchains on Oct. 29. The exchange says users’ funds are safe and it will cover losses; stablecoin issuers froze about $3 billion, while the attack’s attribution and full technical cause remain unconfirmed.
Binance reported an estimated $6.3 billion impact after an attacker moved funds from the exchange’s wallets across several blockchains on the evening of Oct. 29. The company said user funds are safe and it will cover losses, but withdrawals were suspended as it investigated what it described as a security incident.
The most prominent transfer occurred at 20:24 UTC, when a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created wallet. Blockworks valued that transfer at about $2.5 billion. A separate Binance wallet sent 28,005.6 ETH to the same destination 24 seconds later, according to the public blockchain record cited in the source account.
Other outflows had started at about 20:05 UTC across multiple networks. TRM Labs reported transfers from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other chains. Binance’s Oct. 30 update put the estimated total impact at about $6.3 billion. Estimates differed: Blockaid reported at least $5.5 billion, Arkham about $6.01 billion, and TRM about $6.36 billion. These were preliminary figures, not a settled accounting.
Blockchain security firm Blockaid said the Ethereum transaction carried 50 EIP-7702 permissions for Binance 14, one of which matched the wallet’s current transaction number and allowed attacker-controlled code to run. Binance said it found no evidence that a wallet private key had leaked. The company’s preliminary account said a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawal transactions. That explanation remains under investigation.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Cost of a Multi-Chain Breach
The reported scale makes the incident consequential for exchange customers and the wider crypto market. If Binance’s estimate holds, the impact would exceed the $1.5 billion Bybit hack reported in February 2025; the comparison remains conditional because Binance’s total is preliminary and counting methods differ. The incident also shows how a compromise involving one exchange’s systems can be followed by transfers across several blockchain networks, complicating efforts to trace and recover assets.
Some stolen assets could be frozen by issuers, but others cannot be stopped in the same way. Binance said about $3 billion had been frozen; TRM’s estimate for funds beyond issuer control was about $2.4 billion. Those figures describe different categories and may change as investigators track transfers. Binance’s promise to cover losses is relevant to customers, but the source material does not provide a complete accounting of affected wallets or explain how reimbursement would be carried out.
Popular right now
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
TCL QM64L 85-Inch QD-Mini LED 4K Smart Fire TV
Ninja Hot & Iced XL Coffee Maker with Rapid Cold Brew, Black, CM371
As an affiliate, we earn on qualifying purchases.
From Wallet Tests to Outflows
According to the source account’s review of public Ethereum records and reports from TRM Labs and Blockaid, the operator’s wallet received three small withdrawals from Tornado Cash on Oct. 28. On Oct. 29, it tested software on small wallets, deployed a contract, and rehearsed with it before the larger transfers began. These steps are part of the reported timeline; they do not by themselves establish who carried out the attack.
The reported Ethereum method involved EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025. Blockaid’s analysis says the attacker supplied permissions tied to 50 consecutive transaction numbers, or nonces, because Binance 14 was active and its current number could change. One permission matched. The source account says the wallet was later no longer running the attacker’s code and Binance reported revoking the affected address authorization.
Binance first acknowledged reports of a potential security issue at 21:29 UTC on Oct. 29, saying it was investigating and that user funds were safe. It later said withdrawals would resume once the issue was resolved. Its formal incident update came at 02:23 UTC on Oct. 30, reporting the estimated impact, frozen funds and suspension of deposits and withdrawals.
Attribution and Losses Remain Open
The final amount lost is not established. The reported estimates range from $5.5 billion to about $6.36 billion, and the source account says the totals depend on who counted, when they counted and the prices used. Binance’s $6.3 billion figure is described as an estimated impact, not a final audited loss.
Responsibility is also unconfirmed. TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea, but neither Binance nor a government had confirmed that attribution in the supplied material. Binance’s proposed laptop and service-container access route is also preliminary: the company said a compromised engineer’s laptop may have enabled unauthorized withdrawals, while reporting no evidence of a wallet key leak.
The source material does not establish how much of the unrecoverable or frozen funds will ultimately be returned, whether all affected transfers have been identified, or when normal withdrawals resumed. The cited figures are time-sensitive snapshots, and further investigation could revise them.
Investigation and Withdrawals
Binance said it would publish a post-mortem, but the supplied account gives no release date. That report is expected to clarify the access route, the systems involved, the final asset accounting and what changes the exchange plans to make. Binance also said the affected authorization had been revoked.
On Oct. 30, co-CEO Yi He expected withdrawals to begin resuming within 48 hours of her post; that was a forecast, not confirmation of a completed restart. The timing and scope of restored withdrawals remain unclear in the available material. Customers should rely on Binance’s official channels for status updates and be wary of messages claiming to offer refunds or support, as the source account warned that impersonation scams could follow the incident.
Key Questions
How much did Binance say was affected?
Binance estimated the total impact at about $6.3 billion in its Oct. 30 update. Other preliminary estimates ranged from $5.5 billion to about $6.36 billion, so the final figure remains unsettled.
Were customer funds affected?
Binance said user funds are safe and that it would cover all losses. The supplied material does not include a final customer-loss accounting or details on how any reimbursement would work.
How did the attacker move funds?
Blockaid said a transaction used an EIP-7702 permission to run attacker-controlled code through Binance 14. Other reported outflows across multiple chains used ordinary signed transfers, according to TRM Labs.
Who was behind the attack?
TRM Labs attributed it with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government in the supplied material.
When were withdrawals expected to resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. The supplied information does not confirm when service actually resumed.
Source: ThorstenMeyerAI.com
