🔍 Read the full analysis: What We Still Don’t Know About The Binance Hack on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says a security incident on Oct. 29 had an estimated impact of about $6.3 billion and that it will cover user losses. Blockchain analysts traced major outflows across several networks, but the exact loss, how the attacker gained access and who was responsible remain unconfirmed.
Binance says a security incident on Oct. 29 had an estimated impact of about $6.3 billion, after cryptocurrency left wallets across multiple blockchains. The exchange says user funds are safe and it will cover losses, but its investigation has not established exactly how the attacker gained access, the final amount lost or who was responsible.
Public Ethereum records show that at 20:24 UTC on Oct. 29, a transaction emptied a Binance hot wallet identified as “Binance 14.” It transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens to a wallet created hours earlier. Blockworks valued that transaction at roughly $2.5 billion. Analysts at TRM Labs also reported outflows from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks.
The reported total varies by estimate and time of calculation. Binance put the estimated impact at about $6.3 billion in its Oct. 30 update. TRM Labs estimated about $6.36 billion, Arkham reported $6.01 billion, and Blockaid put the amount at at least $5.5 billion as of 22:00 UTC on Oct. 29. These are preliminary figures, not a settled accounting of losses.
Binance said a compromised DevOps engineer’s laptop may have provided access to a service container that could submit unauthorized withdrawal transactions. The company said it had found “no evidence of any wallet private key leak.” It also said deposits and withdrawals were suspended during its response; co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her Oct. 30 post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Outflows Affect Customers
The size and reach of the reported incident matter because it involved multiple Binance wallets and blockchain networks, not just the large Ethereum transfer. A precise accounting will determine how much of the estimated impact represents assets taken, assets frozen or other categories in Binance’s calculation. The available figures should not be treated as a final loss total.
Binance says it will cover all losses and that user funds are safe. That is the exchange’s stated position; the source material does not provide a completed post-incident audit to independently establish the final financial effect. For customers, the immediate practical issue is service availability: Binance reported suspending withdrawals while it addressed the incident, with resumption expected to be gradual.
Some stolen tokens may be recoverable or blocked. The source reports that stablecoin issuers froze roughly $2.5 billion to $3 billion within hours. That does not mean all assets were recoverable: TRM estimated about $2.4 billion was beyond any issuer’s ability to freeze, including assets such as ETH and bitcoin. Those amounts remain estimates, and the recovery status of every asset is not specified.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
DJI Osmo Mobile 7P Phone Gimbal with Mic Mini Transmitter, Infinity Black
As an affiliate, we earn on qualifying purchases.
The Wallet Permission at Issue
The clearest documented transaction involved Binance 14 and EIP-7702, an Ethereum feature that allows an externally owned account to authorize code to act for it. The source says one transaction carried 50 pre-signed permissions tied to consecutive transaction numbers, or nonces. Blockaid’s analysis says one permission matched the wallet’s current nonce, allowing the attacker’s code to run and the wallet to be swept.
That on-chain sequence explains how the transfer was authorized, but it does not by itself establish who created or submitted the permissions, or how they obtained the ability to sign them. Binance’s possible laptop-and-service-container explanation is a preliminary company finding, not a published final forensic report. The source also describes other transfers as ordinary signed transactions, making it unclear whether every outflow followed the same method.
Binance said it revoked the affected address authorization by the morning of Oct. 30. The source also records a series of stablecoin issuer freezes after the incident, followed by Binance’s public updates that it was investigating and that withdrawals would resume once the issue was resolved.
“The attack was attributed “with high confidence” to TraderTraitor, a unit TRM links to North Korea.”
— TRM Labs
Key Questions Still Open
The final impact and recovery total are not settled. The published estimates differ, and the source does not give a final reconciliation explaining the gap between assets taken, assets frozen and any other amounts included in Binance’s estimate. It also does not establish how much of the frozen cryptocurrency will ultimately be returned or remain inaccessible to the attacker.
The precise access path remains under investigation. Binance’s laptop theory is qualified as something that “may” have enabled access, while the company’s statement that it found no evidence of a private-key leak does not identify what credentials or systems were involved. A full post-mortem has not yet been released in the source material.
Responsibility is also unconfirmed. TRM Labs made a high-confidence attribution to TraderTraitor, which it associates with North Korea, but that assessment has not been confirmed by Binance or a government in the material provided. The scope of the attacker’s access, whether all affected transfers came from one compromise, and whether any additional assets or systems were exposed are not established.
Forensic Findings and Withdrawal Resumption
The next key development is Binance’s promised post-incident accounting and forensic explanation. Readers should look for details on how the company calculated the $6.3 billion estimate, which transfers it includes, how many assets were frozen and what losses, if any, remain after recovery efforts. The source gives no publication date for a complete post-mortem.
Binance’s co-CEO said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. That was an expectation, not confirmation that withdrawals had already reopened; the source does not report whether the timetable was met. The company had said deposits continued to operate normally, while withdrawals were paused during its response.
Investigators and blockchain analysts may publish further findings about the wallet permissions, the possible service-container access and the movement of funds across chains. Until then, the attacker’s identity, the final loss and the full technical cause remain unresolved. Binance users should rely on the exchange’s official service updates and treat unsolicited messages claiming to offer refunds or support with caution; the source warns that such scams may appear.
Key Questions
How much cryptocurrency was involved?
Binance estimated the incident’s total impact at about $6.3 billion in its Oct. 30 update. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion. The final total has not been established.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover all losses. That is the exchange’s stated position; a final independent accounting is not included in the source material.
How did the attacker access the Ethereum wallet?
On-chain analysis indicates that a permission using EIP-7702 enabled code to act for Binance 14 and move its assets. Binance said a compromised engineer’s laptop may have provided a route into a service container, but it has not published a final explanation.
Who was responsible for the attack?
TRM Labs attributed the incident with high confidence to TraderTraitor, which it links to North Korea. The source says neither Binance nor a government had confirmed that attribution.
When were withdrawals expected to resume?
Binance co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. The source does not confirm whether withdrawals reopened within that period.
Source: ThorstenMeyerAI.com
