🔍 Read the full analysis: Binance’s Evening Hack: How Billions Left, Minute By Minute on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance reported an estimated $6.3 billion impact from an attack on its wallets on Oct. 29, 2026, and said it would cover user losses. The company attributed the incident to unauthorized withdrawals and said a compromised engineer laptop may have provided access; those details remain preliminary. Stablecoin issuers froze about $3 billion, while Binance said deposits continued and withdrawals were expected to resume within 48 hours of an Oct. 30 update.
Binance said an attack on its wallets had an estimated $6.3 billion impact after funds moved across multiple blockchains on Oct. 29, prompting the exchange to suspend withdrawals and investigate. The company said user funds were safe and it would cover losses, while identifying a compromised DevOps engineer’s laptop as a possible route into a service container—not a confirmed explanation of how the attacker gained control.
The largest publicly described movement began at 20:24 UTC, when an Ethereum transaction transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance hot wallet identified as “Binance 14.” Blockworks valued that transaction at roughly $2.5 billion. Public blockchain records show the funds went to a wallet created only hours earlier, according to the source’s review of the Ethereum record.
Outflows from Binance wallets on several networks had begun around 20:05 UTC, according to blockchain analytics firm TRM Labs. TRM said transfers also involved Bitcoin, Tron, the XRP Ledger, Solana and other networks. Binance’s estimated total impact was about $6.3 billion; other preliminary estimates cited in the source ranged from at least $5.5 billion to about $6.36 billion, reflecting different counting methods, timing and token prices.
Binance’s Oct. 30 incident update said roughly $3 billion had been frozen, while an earlier verified figure was $2.54 billion. Issuers including Circle and Tether announced freezes, followed by other firms. Binance said deposits continued to operate normally, but withdrawals were suspended. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her Oct. 30 post; that was an expectation, not confirmation that service had resumed.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of the Wallet Loss
The reported amount would make the incident one of the largest known crypto thefts if Binance’s preliminary estimate holds. The source compares the roughly $6.3 billion impact with the $1.5 billion Bybit hack reported in February 2025. That comparison depends on Binance’s estimate being validated and on the incidents being counted on comparable terms.
The split between frozen and unfrozen assets matters to recovery prospects. Stablecoin issuers can restrict tokens they control, and companies said they froze roughly $2.5 billion to $3 billion. ETH and bitcoin cannot be frozen by a token issuer; TRM estimated about $2.4 billion was beyond issuer freeze controls. These are preliminary figures, and freezing assets does not by itself establish that they have been returned to Binance or its users.
For customers, the immediate confirmed effect was a pause in withdrawals, while Binance said deposits remained available. The company’s promise to cover losses addresses user balances, but the incident may still affect access to funds and confidence in exchange custody. The company had not yet published a full post-mortem in the supplied material.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Anker SOLIX C1000 Gen 2 Portable Power Station
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
How EIP-7702 Entered the Attack
Binance and analysts described a compromise involving “Binance 14,” a hot wallet used to hold funds for operational transactions. The public Ethereum record shows a transaction at 20:20:59 UTC carrying 50 EIP-7702 permissions for the wallet. Blockaid said one permission matched the wallet’s current transaction number, allowing the attacker’s code to run; the subsequent sweep followed at 20:24:23.
EIP-7702 is an Ethereum feature introduced with the Pectra upgrade in May 2025. In this incident, the permissions were associated with successive transaction numbers, or nonces. Blockaid’s account says the 50 permissions covered consecutive nonces, so one could be valid when it was processed. The source reports that the wallet’s own key—or the system holding it—would be needed to produce such permissions. That points to a serious access-control failure, but does not establish precisely how the attacker obtained authorization.
Binance also said other transfers were made through ordinary signed transactions. The source’s timeline records a transfer of 28,005.6 ETH from another Binance wallet 24 seconds after the main sweep, as well as later losses from a Binance smart account. The incident therefore involved more than the single Ethereum transaction that first drew attention.
“With high confidence,” the activity was attributed to TraderTraitor, a group TRM links to North Korea.”
— TRM Labs
Key Forensic Questions Remain
The $6.3 billion figure is preliminary, and estimates differ according to the assets counted, valuation time and method. Binance had not provided a complete public accounting of every affected wallet and transaction in the supplied material. The reported frozen amount also does not establish how much will ultimately be recovered.
It remains unclear how the attacker obtained the authority needed to submit the transactions. Binance said a DevOps engineer’s laptop may have provided access to a service container, but also said it found no evidence that a wallet private key had leaked. Those statements do not resolve whether the laptop, the container, signing controls or another part of the withdrawal process was compromised.
TRM Labs’ attribution to TraderTraitor is an analyst assessment, not an independently confirmed finding by Binance or a government. The full post-mortem, the eventual recovery total, and the precise timing of restored withdrawals were not available in the source material.
Withdrawal Restoration and Investigation
Binance said it had revoked the affected address authorization by the morning of Oct. 30 and expected withdrawals to begin resuming within 48 hours of Yi He’s post. The exchange had not confirmed in the supplied material that withdrawals were fully restored, so the operational status remained subject to further updates.
The next major information point is Binance’s promised post-incident account, which should clarify the access route, affected wallets, final loss calculation and recovery efforts. Issuer freezes and blockchain tracing may help recover some assets, but the final amount recovered is not yet known. Customers should rely on Binance’s official channels for account notices and treat unsolicited messages claiming to offer refunds or support with caution.
Key Questions
How much did Binance say was affected?
Binance estimated the total impact at about $6.3 billion in its Oct. 30 update. The figure was preliminary, and other estimates cited in the source ranged from at least $5.5 billion to about $6.36 billion.
Were Binance users’ funds lost?
Binance said user funds were safe and that it would cover losses. The exchange had paused withdrawals, and its full accounting and post-mortem were still pending in the supplied material.
How much was frozen?
Binance reported roughly $3 billion frozen; an earlier verified figure was $2.54 billion. The source also cites a range of about $2.5 billion to $3 billion frozen by stablecoin issuers and other firms. Frozen assets are not necessarily recovered assets.
Who carried out the attack?
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government in the source material.
When were withdrawals expected to resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. The supplied material does not confirm that they had resumed.
Source: ThorstenMeyerAI.com
