🔍 Read the full analysis: One Evening, Billions Gone From Binance: What We Still Don’t Know on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Binance says a security incident on October 29 had an estimated $6.3 billion impact, after funds left wallets across multiple blockchains. The exchange says user funds are safe and it will cover losses; the total remains preliminary, and the attacker’s identity has not been independently confirmed.
Binance says an attack on its wallets on October 29 had an estimated total impact of about $6.3 billion, after an attacker took control of a major Ethereum hot wallet and funds also left wallets on several other blockchains. The exchange says user funds are safe and that it will cover losses, but the total is preliminary and key details about how access was obtained remain unresolved.
The first major transfer identified in the source material occurred at 20:24 UTC on October 29. A transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance wallet labelled “Binance 14” to a newly created address. Blockworks valued that transaction at roughly $2.5 billion. Other Binance wallets sent funds out across multiple networks during the incident, according to blockchain security firm TRM Labs.
Reported totals differ by source and timing. Binance put the estimated impact at about $6.3 billion in its October 30 update. TRM Labs estimated about $6.36 billion, Arkham reported $6.01 billion, and Blockaid counted at least $5.5 billion as of 22:00 UTC on October 29. These are preliminary estimates, not a final accounting of realized losses.
Binance said it had found that a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawal transactions. The company also said it had found “no evidence of any wallet private key leak”. The exchange reported that about $3 billion had been frozen, while the source material says some ETH and bitcoin could not be frozen by issuers. Binance had suspended deposits and withdrawals while responding to the incident.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Cost and Reach of the Attack
The scale matters because the reported sums are large enough to affect confidence in the custody and security practices of a major exchange. Binance’s statement that it will cover losses is relevant to customers, but it does not by itself establish the final amount lost, recovered or frozen. Those figures will need to be reconciled as the exchange and investigators publish more detail.
The incident also involved more than one blockchain and more than one type of transfer, according to TRM Labs. That makes the response more complicated: some assets can be frozen by the issuer, while others cannot be blocked in the same way. The source material puts the amount beyond issuer intervention at about $2.4 billion, according to TRM. That is an estimate, and the status of those funds may change as investigators trace them.
For customers, the immediate issue is service access as well as asset security. Binance said withdrawals would resume after the security issue was resolved, and co-CEO Yi He later said they were expected to begin resuming within 48 hours of her October 30 post. Customers should treat messages promising refunds or requesting account information with caution; the source material warns that scammers may pose as Binance support.
Popular right now
TCL T7 Series 85-Inch 4K 144Hz QLED Smart Google TV
Ninja CREAMi 7-in-1 Ice Cream Maker, NC299AMZ
KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Almond Cream (KSM150PS)
As an affiliate, we earn on qualifying purchases.
How the Ethereum Wallet Was Used
Blockchain records reviewed in the source material show preparations before the main transfers. The operator wallet received small withdrawals from Tornado Cash on October 28, and the following day it tested code on smaller wallets before deploying a contract used in the attack, according to TRM Labs and the cited on-chain analysis.
Blockaid’s account says the attacker used EIP-7702, an Ethereum feature that lets an externally controlled account authorize code to act on its behalf. A transaction carried 50 signed permissions for consecutive transaction numbers, or nonces, for Binance 14. One matched the wallet’s current nonce, allowing the attacker’s code to run and move assets. The source describes this as a permission mechanism; it does not establish that the feature itself was defective.
Binance said it later revoked the affected address authorization, and by the morning of October 30 Binance 14 no longer ran the attacker’s code. Binance’s initial public post on October 29 said it was investigating reports of a potential security issue and that user funds were safe. Its October 30 update gave the larger impact estimate and described the laptop finding.
“With high confidence, the attack was carried out by TraderTraitor.”
— TRM Labs
The Open Questions on Losses and Access
The final financial impact is not established. Estimates range from at least $5.5 billion to about $6.36 billion, with different firms using different cutoffs and counting methods. Binance’s $6.3 billion figure is also described as an estimate. The supplied information does not provide a final breakdown of funds stolen, frozen, recovered or still under attacker control.
Binance has not yet published the promised post-mortem. Its laptop and service-container explanation is qualified as a possibility, and the company says it found no evidence of a private-key leak. The available material does not explain precisely how the laptop was compromised, what permissions the service container had, or how transfers across multiple networks were authorized.
The attacker attribution is also unconfirmed. TRM Labs linked the activity with high confidence to TraderTraitor, a group it associates with North Korea, but that remains an analyst assessment in the information provided. No government confirmation is cited. The destination and eventual disposition of all assets are also not clear.
Binance’s Response and Next Updates
Binance said it was working to resolve the security issue and restore deposits and withdrawals. Yi He, a co-CEO, said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post; the supplied material does not confirm whether that timetable was met. Customers should check Binance’s official channels for current service status rather than relying on reposted claims.
The next major development is a fuller incident report from Binance, including a clearer account of the access route, the scope of affected wallets and the status of funds. Investigators and blockchain analysts may also update their estimates as assets are traced and freezes are confirmed. Until those details are published, the $6.3 billion figure, recovery totals and attribution should be treated as provisional or attributed claims.
Key Questions
How much money was affected?
Binance estimated the impact at about $6.3 billion. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, depending on the source and reporting time. A final accounting was not available in the supplied material.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover losses. Those are the exchange’s statements; the supplied information does not include a completed post-mortem or final loss breakdown.
How did the attacker access the Ethereum wallet?
Blockchain analysts say the attacker used an EIP-7702 authorization to let code act through Binance 14. Binance said a compromised DevOps engineer’s laptop may have provided access to a service container, but the exact route has not been fully established publicly.
Who was responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. The supplied material says Binance and government authorities had not confirmed that attribution.
When would withdrawals resume?
On October 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. The supplied material does not confirm whether withdrawals resumed on that schedule, so users should check Binance’s current official service notices.
Source: ThorstenMeyerAI.com
