🔍 Read the full analysis: Binance’s Hack: The Evening Billions Moved And Questions Remained on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact after funds moved from its hot wallets across multiple blockchains on Oct. 29. The company says user funds are safe and it will cover losses; stablecoin issuers froze about $3 billion, while the incident’s cause and final accounting remain under investigation.
Binance said an Oct. 29 security incident had an estimated impact of about $6.3 billion after cryptocurrency moved from its hot wallets across multiple blockchains. The company said user funds are safe and it will cover losses, while stablecoin issuers froze about $3 billion of the transferred assets and Binance suspended deposits and withdrawals as it investigated.
The most visible on-chain event came at 20:24 UTC on Oct. 29, when a transaction transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created address. Blockworks valued that transaction at roughly $2.5 billion. Blockchain records also show a separate transfer of 28,005.6 ETH from another Binance wallet to the same receiving address shortly afterward.
Outflows were reported from Binance wallets on several networks over the following hours. TRM Labs said transfers occurred on Bitcoin, Tron, the XRP Ledger, Solana and other chains; it also reported a later wave involving Avalanche and Polygon. Binance’s estimate of the overall impact was about $6.3 billion. Other preliminary estimates varied: Blockaid put the amount at at least $5.5 billion, Arkham at $6.01 billion and TRM at about $6.36 billion. These figures depend on timing, asset prices and what transactions are counted.
Binance’s Oct. 30 incident update said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. The company said it had found no evidence that a wallet private key was leaked. It reported about $3 billion frozen, including a verified total of $2.54 billion cited the previous evening. Binance said it had revoked the affected address authorization and that the wallet no longer ran the attacker’s code by the morning of Oct. 30.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
What the Frozen Funds Mean
The incident matters because the reported sums are large enough to test how exchanges, blockchain networks and asset issuers respond when funds leave a major trading platform. Stablecoin issuers can freeze tokens they control, and Binance said about $3 billion had been frozen. That intervention may restrict the movement of some assets, but it does not reverse the transfers or recover every token.
TRM Labs estimated that about $2.4 billion was beyond issuer freeze controls, including ETH and bitcoin. That figure is an analyst estimate, not a final loss determination. Binance said it would cover losses and that user funds were safe, but the company had not yet published a full post-mortem or a final accounting in the supplied information.
The episode also puts attention on wallet authorization systems and the operational controls around them. A permission associated with Binance 14 appears to have allowed code to act on the wallet, while other reported outflows were ordinary signed transfers. The precise route into Binance’s systems remains unconfirmed, so the transactions alone do not establish how the attacker gained access.
Products Worth Considering
Ring Alarm 8-Piece Kit (2nd Gen) Home Security System
eufy Security Essential 7-Piece Alarm System
Ring Alarm 5-Piece Wireless Security System
As an affiliate, we earn on qualifying purchases.
How Binance 14 Was Used
Ethereum’s EIP-7702, introduced with the Pectra upgrade in May 2025, lets an externally owned account authorize code to run on its behalf. The source account signs the authorization, which is tied to a transaction number, or nonce. Blockaid’s analysis said a transaction carried 50 permissions for consecutive nonces associated with Binance 14; one matched the wallet’s current nonce, allowing the authorization to take effect. The blockchain record establishes that the transaction occurred, but the mechanism does not by itself establish who produced the authorization or how it was obtained.
According to the source account’s timeline, an operator wallet received small withdrawals from Tornado Cash on Oct. 28, and code was tested on smaller wallets the next day. The attacker’s contract was deployed and rehearsed before Binance wallet outflows began at about 20:05 UTC. At 20:24:23, the large Binance 14 transfer followed. Those preparatory steps and their attribution come from the cited researchers’ analysis, rather than Binance’s public incident statement.
Binance first said on X at 21:29 UTC that it was investigating reports of a potential security issue and that user funds were safe. It later said withdrawals would resume when the issue was resolved. On Oct. 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. The source material describes the suspension as applying to deposits and withdrawals in Binance’s incident update, while her post said deposits continued to operate normally; the precise status may have changed over that period.
“with high confidence”
— TRM Labs
Cause, Losses and Attribution
The full amount lost or recovered is not settled. Published estimates range from at least $5.5 billion to about $6.36 billion, and Binance’s approximately $6.3 billion figure is an estimate of impact rather than a final audited loss total. The supplied reporting does not provide a completed accounting of which assets were recovered, remain frozen or were moved again.
Binance has not released the post-mortem described in its update. The company’s suggestion that an engineer’s laptop may have provided access is preliminary, and its statement that it found no evidence of a private-key leak does not establish the precise access path. TRM Labs attributed the activity with high confidence to TraderTraitor, which it links to North Korea, but neither Binance nor a government confirmed that attribution in the source material.
It is also unclear whether all affected transactions have been identified, how much of the frozen cryptocurrency can ultimately be returned, and whether customer services have resumed across every network. The difference between Binance’s update about suspended deposits and withdrawals and Yi He’s statement that deposits continued to operate normally reflects reports made at different times; the current service status is not established here.
Binance’s Recovery and Review
Binance said it was working to resolve the security issue and that it would cover losses. Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post; the supplied information does not confirm whether that timetable was met. Customers should check Binance’s official service notices for current deposit and withdrawal availability rather than rely on messages claiming to offer refunds or support.
The next major information point is Binance’s full post-mortem, including a clearer explanation of the suspected access route, the wallets and networks affected, and the final accounting of funds frozen or recovered. Further updates from stablecoin issuers and blockchain analysts may clarify how much of the transferred value remains traceable or subject to controls. Until those details are published, both the cause and the final financial impact remain provisional.
Key Questions
How much cryptocurrency was affected?
Binance estimated an impact of about $6.3 billion. Other early estimates ranged from at least $5.5 billion to about $6.36 billion, reflecting different timing, pricing and counting methods. A final accounting was not available in the source material.
Did the incident affect user funds?
Binance said user funds were safe and that it would cover losses. The supplied information does not include a completed independent assessment or a final breakdown of the incident’s financial effects.
How much was frozen?
Binance reported about $3 billion frozen; an earlier verified total was $2.54 billion. Stablecoin issuers can freeze tokens they control, but ETH and bitcoin cannot be frozen by an issuer in the same way.
Has Binance confirmed how the attacker got in?
No. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container, and said it found no evidence of a wallet private key leak. The company’s full post-mortem was still pending in the supplied reporting.
When were withdrawals expected to resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. The source material does not confirm whether that timetable was met or give the current service status.
Source: ThorstenMeyerAI.com
