🔍 Read the full analysis: How The Binance Hack Developed Over One Evening on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
On Oct. 29, funds left Binance wallets across several blockchains in a coordinated attack, including a large Ethereum transaction that drained the wallet known as Binance 14. Binance estimated the impact at about $6.3 billion, said user funds were safe and promised to cover losses; the total remains preliminary, and the investigation is ongoing.
Binance said an attack moved an estimated $6.3 billion in assets from its wallets across several blockchains on Thursday, Oct. 29, including a major Ethereum wallet drain. The exchange said user funds were safe and that it would cover losses, while deposits and withdrawals were suspended as it investigated.
The most visible transfer occurred at 20:24 UTC, when a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance hot wallet labeled Binance 14 to a newly created receiving wallet. Blockworks valued that transfer at roughly $2.5 billion. Public Ethereum records show that, 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same address.
The incident was not limited to Ethereum. Blockchain analytics firm TRM Labs said Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and smaller networks also sent assets to the attacker through signed transfers. Outflows began around 20:05 UTC, according to TRM, and a further wave involving Avalanche and Polygon wallets was reported at about 23:05. Transfers from Binance 14 continued until 23:56.
Binance’s Oct. 30 update put the estimated total impact at about $6.3 billion and the amount frozen at about $3 billion. Other estimates differed: Blockaid put the impact at at least $5.5 billion as of 22:00 UTC, Arkham estimated $6.01 billion, and TRM put it at about $6.36 billion. These were preliminary figures that can change with asset prices and the scope of transfers counted.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
A Multi-Chain Exchange Security Failure
The incident matters because it involved assets moving across multiple networks, not just one compromised token or one isolated blockchain. Binance’s estimate, if sustained, would make the event one of the largest reported crypto thefts. The supplied source compares it with the $1.5 billion Bybit hack of February 2025, but the Binance figure is still an estimate, not a final audited loss.
Some stolen stablecoins were potentially recoverable because their issuers can freeze tokens. Binance and outside analysts reported that issuers froze roughly $2.5 billion to $3 billion. That does not cover all assets: TRM estimated about $2.4 billion was in ETH and bitcoin beyond an issuer’s freeze control. The split between frozen, recoverable and inaccessible funds will shape the ultimate financial impact.
For customers, Binance’s assurance that user funds were safe and its promise to cover losses are central, but the exchange also paused withdrawals while responding. The incident highlights the tension between maintaining access to customer assets and securing the systems that authorize transfers. It also creates a risk of fake refund and support messages aimed at affected users; no one should treat unsolicited recovery offers as verified assistance.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Ledger Flex + Folio Crypto Hardware Wallet
Ledger Nano X Bluetooth Crypto Wallet
As an affiliate, we earn on qualifying purchases.
Binance identified a possible route into its systems in an Oct. 30 update. The exchange said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions. Binance also said it had found no evidence that a wallet private key had leaked. The explanation is provisional: a full post-mortem had not yet been released.
Blockchain analysts described the Ethereum wallet takeover as involving EIP-7702, an Ethereum authorization feature introduced with the Pectra upgrade in May 2025. In broad terms, the feature lets a wallet authorize code to act on its behalf. Blockaid reported that one transaction included 50 signed permissions tied to consecutive transaction numbers, or nonces, for Binance 14; one matched the wallet’s current nonce and took effect.
After the authorization, the wallet executed the transfer of its holdings. The supplied account says the attacker had tested related code on smaller wallets earlier that day and deployed the contract later used in the attack. Those details draw on public Ethereum records and analyst reports, while the broader account of how the attacker accessed Binance’s systems remains under investigation.
“TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea.”
— TRM Labs
Losses and Attribution Remain Open
The final loss total is not settled. Estimates from Binance and analytics firms were published at different times and used differing counts and asset prices. The final amount stolen, the value recovered or frozen, and any losses ultimately borne by Binance cannot be confirmed from the available update.
It also remains unclear exactly how the attacker gained the ability to authorize transactions. Binance’s laptop and service-container explanation is explicitly tentative, and its statement that it found no evidence of a private-key leak does not, by itself, establish the full path of access. TRM Labs’ attribution to TraderTraitor is an analyst assessment, not a confirmed identification by Binance or a government.
Binance said the affected authorization had been revoked by the morning of Oct. 30, and the wallet was no longer running the attacker’s code. That addresses the reported Ethereum authorization, but the public material does not provide a complete forensic account of every affected network or establish whether all funds can be recovered.
Forensic Review and Withdrawal Resumption
Binance said deposits were continuing to operate and that withdrawals were expected to begin resuming within 48 hours of co-CEO Yi He’s Oct. 30 post. That was an expectation, not confirmation that withdrawals had already restarted. Customers should check the exchange’s official channels for service updates and be alert to scams posing as refunds, recovery services or customer support.
The next major development is a fuller investigation report explaining how the attacker obtained the authority to submit transfers, which systems and wallets were affected, and how Binance calculated its impact estimate. Further updates from Binance, blockchain analysts and stablecoin issuers may also clarify how much was frozen or otherwise recovered. Until that information is published, the reported sums and the attacker attribution remain subject to revision.
Key Questions
What happened to Binance on Oct. 29?
Funds were sent from Binance wallets across several blockchains to addresses associated with an attacker. The largest reported transaction drained Binance 14 on Ethereum, transferring ETH, USDT and other tokens.
How much was involved?
Binance estimated the total impact at about $6.3 billion. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, so the final figure is not yet established.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover all losses. The supplied update does not include a completed post-mortem or final accounting of the incident.
How did the Ethereum wallet get drained?
Blockaid’s analysis says an attacker used EIP-7702 authorization to make Binance 14 run attacker-controlled code, then swept its assets. Binance’s account of how the attacker accessed its systems was still provisional.
Who was responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government authority in the supplied material.
Source: ThorstenMeyerAI.com
