🔍 Read the full analysis: Billions Left Binance: A Timeline Of The Evening’s Hack on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance reported an estimated $6.3 billion impact after funds left its wallets across multiple blockchains on October 29. Blockchain researchers say an attacker took over the Binance 14 Ethereum hot wallet using EIP-7702, while Binance says user funds are safe and it will cover losses. About $3 billion was reportedly frozen, but the incident’s full cause and final loss remain under investigation.
Binance said an October 29 security incident had an estimated impact of about $6.3 billion, after cryptocurrency moved from the exchange’s wallets across several blockchains. Blockchain analysts and public Ethereum records indicate that a single transaction drained the Binance 14 hot wallet, while Binance says user funds are safe and that it will cover losses; the total remains preliminary.
At 20:24 UTC on October 29, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from Binance 14 to a newly created wallet, according to the public Ethereum record cited in the source report. Blockworks valued that transfer at roughly $2.5 billion. Other Binance wallets also sent assets during the incident. TRM Labs reported activity on up to ten blockchains, including Bitcoin, Tron, the XRP Ledger and Solana.
Estimates differ by source and timing. Binance put the estimated total impact at about $6.3 billion; TRM Labs estimated about $6.36 billion, while Arkham reported $6.01 billion and Blockaid counted at least $5.5 billion as of 22:00 UTC. These are preliminary estimates, not a final audited loss figure. The source report says issuers froze roughly $2.5 billion to $3 billion in assets. Binance reported about $3 billion frozen in its October 30 update.
Binance said a compromised DevOps engineer’s laptop may have allowed access to a service container used to submit unauthorized withdrawal transactions. The company said it found no evidence that a wallet private key had leaked. It suspended deposits and withdrawals during its response, while its co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her October 30 post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of the Wallet Breach
The reported figure would make the incident one of the largest crypto thefts if confirmed. The source compares Binance’s estimate of about $6.3 billion with the $1.5 billion Bybit hack reported in February 2025. That comparison depends on Binance’s preliminary estimate holding; investigators have not published a final accounting.
The incident also shows the difference between assets that can be frozen by an issuer and assets that cannot be recalled through a central administrator. Tether, Circle and other issuers froze some stablecoins, according to the source report. ETH and bitcoin cannot be frozen by those issuers, leaving a portion of the reported outflows beyond that particular response. The disruption also matters directly to customers because Binance temporarily suspended withdrawals while it investigated.
Binance’s assurance that user funds are safe is the company’s statement, not an independently established finding in the material provided. A completed post-mortem and a final account of losses, recoveries and customer access will be needed to clarify the incident’s operational and financial consequences.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Apple iMac 2024 All-in-One Desktop with M4 Chip, 24‑inch Retina Display, 16GB Unified Memory, 256GB SSD, Silver
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
How the October 29 Transfers Unfolded
The timeline in the source report begins with small withdrawals from Tornado Cash on October 28, which TRM Labs and Blockworks described as funding for an operator wallet. On October 29, the wallet tested code on smaller accounts before deploying a contract and rehearsing its use. TRM Labs reported that Binance outflows began at about 20:05 UTC, with many occurring within roughly 20 minutes.
At 20:20:59 UTC, a transaction carried 50 EIP-7702 permissions for Binance 14. Blockaid’s analysis says one permission matched the wallet’s current transaction number, allowing the attacker’s code to run. Four minutes later, the large transfer of ETH, USDT and other tokens followed. The public Ethereum record cited in the report also shows another Binance wallet sending 28,005.6 ETH to the same address 24 seconds later.
Additional outflows continued that evening. The report records losses from a Binance smart account at 20:41 and 20:59, a second wave involving Avalanche and Polygon at about 23:05, and sweep transactions from Binance 14 continuing until 23:56. Binance announced that it was investigating at 21:29 UTC and said withdrawals would resume once the issue was resolved. The company’s incident update followed at 02:23 UTC on October 30.
Losses and Attribution Still Under Review
The reported amounts vary because analysts used different counting methods, prices and cut-off times. The final amount lost or recovered is not established in the material available, and Binance’s $6.3 billion figure is described as an estimate. It is also unclear how much of the frozen amount will ultimately be returned or how much of the remaining assets can be recovered.
Binance said a compromised engineer’s laptop may have provided access to a service container, but the exact route into the withdrawal process has not been confirmed publicly. The company said it found no evidence of a private-key leak. The source report says a post-mortem is still to come. TRM Labs attributed the operation to TraderTraitor with high confidence, but that remains an analyst assessment rather than a confirmed finding by Binance or a government.
The source report also describes the attacker’s method based on Blockaid’s analysis of EIP-7702 permissions and on-chain transactions. That account explains how the Ethereum wallet could be made to run attacker-controlled code, but it does not by itself establish the full cause of the broader activity across multiple networks.
Withdrawal Resumption and Binance Review
Binance said deposits and withdrawals had been suspended while it addressed the incident. Yi He’s October 30 post gave an expectation that withdrawals would begin resuming within 48 hours, but the material does not confirm that service had restarted by the time of publication. Customers should distinguish that estimate from a completed restoration.
The next significant update is expected to include Binance’s fuller incident review, including how the service container was accessed, how the activity across chains was coordinated, and the final amounts affected and frozen. Investigators and analysts may also report further tracing of the transferred assets. Until those details are published, both the cause and the financial outcome remain subject to revision.
Key Questions
How much cryptocurrency was affected?
Binance estimated an impact of about $6.3 billion. Other preliminary estimates in the source report range from at least $5.5 billion to about $6.36 billion. A final audited total was not provided.
What happened to Binance 14?
Blockchain analysts say a transaction used EIP-7702 permissions to make Binance 14 run attacker-controlled code, after which a large transfer moved ETH, USDT and other tokens out of the wallet. Binance later said it revoked the affected address authorisation.
Were customer funds lost?
Binance said user funds are safe and that it would cover all losses. That is the exchange’s assurance; the source material does not include an independent final account of losses or customer reimbursements.
How much was frozen?
The source report says issuers froze roughly $2.5 billion to $3 billion. Binance put the frozen total at about $3 billion in its October 30 update. The amount that can ultimately be recovered remains unclear.
Has anyone confirmed who was responsible?
No confirmed attribution is reported. TRM Labs linked the attack to TraderTraitor with high confidence and associates the group with North Korea, but the source says Binance and government authorities had not confirmed that finding.
Source: ThorstenMeyerAI.com
