🔍 Read the full analysis: The Binance Hack: What We Know About The Evening Billions Left on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says attackers drained its hot wallets across multiple blockchains on Oct. 29, putting the estimated impact at about $6.3 billion. The exchange says user funds are safe and it will cover losses, but the total is preliminary, attribution is unconfirmed, and withdrawals were suspended while the incident was addressed.
Binance reported an estimated $6.3 billion impact after attackers drained its Ethereum hot wallet and moved funds from wallets on several other blockchains on the evening of Oct. 29. The exchange said user funds are safe and it will cover losses, while deposits and withdrawals were suspended during its response; the reported total remains preliminary.
The first major on-chain transaction came at 20:24 UTC, when 167,464 ETH, 1.615 billion USDT and 62 other tokens moved from a wallet labelled Binance 14 to a newly created address. Blockworks valued that transfer at about $2.5 billion. Binance 14 had been made to run code supplied by the attacker using an Ethereum transaction feature known as EIP-7702, according to blockchain security firm Blockaid’s analysis cited by ThorstenMeyerAI.com.
The incident was not limited to Ethereum. TRM Labs reported that Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks also sent funds to addresses controlled by the attacker. Binance’s stated estimated total impact is about $6.3 billion. Other preliminary estimates cited by the source ranged from at least $5.5 billion to about $6.36 billion, reflecting different counting times and asset prices; they are not a settled final accounting.
Binance said it found no evidence that a wallet private key had leaked. Its preliminary explanation was that a compromised DevOps engineer’s laptop may have provided access to a service container that could submit unauthorized withdrawal transactions. The exchange said it would cover losses. The company’s incident update also said deposits and withdrawals had been suspended, while co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Cost of a Hot-Wallet Compromise
The reported scale makes this incident consequential for Binance customers and the wider digital-asset market. A hot wallet is connected to systems that process transactions, making it operationally useful but exposed to risks involving software, access controls and signing processes. The incident shows how a failure in the systems around a wallet can matter even when an exchange says it has found no evidence of a private-key leak.
For users, the immediate effects include paused withdrawals and uncertainty about when normal service will return. Binance’s assurance that it will cover losses is significant, but the company’s estimated impact is not the same as a final audited loss figure, and the provided information does not give a completed accounting of assets recovered, frozen or permanently lost.
The response also illustrates limits to freezing stolen crypto. Stablecoin issuers can freeze tokens they control under their systems, and the source reports that issuers froze roughly $2.5 billion to $3 billion. ETH and bitcoin cannot be frozen by a stablecoin issuer in the same way. TRM estimated about $2.4 billion was beyond any issuer’s reach; that figure is an analyst estimate, not a final recovery tally.
Popular right now
Ninja Foodi 10-Qt DualZone Smart XL Air Fryer, 6-in-1, DZ550
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
De'Longhi Rivelia Automatic Espresso Machine with Milk Frother
As an affiliate, we earn on qualifying purchases.
How the Ethereum Wallet Was Drained
According to the source’s reconstruction, the attacker prepared in advance: an operator wallet received small withdrawals from Tornado Cash on Oct. 28, and the attacker tested code on smaller wallets the following day. The source says the attacker deployed a contract and rehearsed its use before the main Binance 14 transaction. These details draw on public Ethereum records and reports from TRM Labs and Blockaid, as presented by ThorstenMeyerAI.com.
EIP-7702 allows an externally owned Ethereum account to authorize code to act for it. Blockaid’s analysis, as summarized by the source, found one transaction carrying 50 pre-signed permissions tied to consecutive transaction numbers, or nonces. One permission matched Binance 14’s current nonce, allowing the wallet to execute the attacker’s code and move assets. This description explains the reported Ethereum transaction; it does not by itself establish how the attacker obtained the ability to create the permissions.
Binance first posted on X at 21:29 UTC on Oct. 29 that it was investigating reports of a potential security issue and said user funds were safe. Its early Oct. 30 update put the estimated impact at about $6.3 billion and said about $3 billion had been frozen. By the morning of Oct. 30, Binance said it had revoked the affected address authorization, and the source reported that Binance 14 no longer ran the attacker’s code.
The Final Loss and Attribution
The final amount lost has not been established. Binance’s roughly $6.3 billion figure is an estimate, and other firms’ preliminary totals differ. The source does not provide a finalized breakdown of the assets taken, what was frozen, what may be recoverable or the amount Binance ultimately must cover.
The method of access also remains under investigation. Binance said a compromised employee laptop may have enabled access to a service container, but the company had not published a post-mortem explaining the suspected intrusion, the relevant controls or how the attacker produced permissions for Binance 14. TRM Labs attributed the operation with high confidence to TraderTraitor, which it links to North Korea; that attribution was not confirmed by Binance or a government in the material available.
It is also not yet clear when withdrawals fully resumed or whether service restrictions affected every Binance product and region in the same way. The available update described a target window, not confirmation that all withdrawals had restarted.
Binance’s Recovery and Investigation
Binance said it would continue investigating, address the security issue and publish more information in a post-incident review. The next key indicators are a confirmed schedule for restoring withdrawals, a final accounting of affected assets and a clearer explanation of how the attacker gained the ability to authorize transactions across multiple networks.
Customers should distinguish official Binance notices from unsolicited messages. The source specifically warns that scammers may pose as support staff or offer refunds. Binance’s stated commitment to cover losses does not make messages requesting passwords, recovery phrases or wallet access legitimate.
For now, the exchange’s public figures, the analyst estimates and the proposed explanation of the intrusion should be treated as developing information. A full post-mortem and evidence of the final recovery and loss figures have not yet been provided in the source material.
Key Questions
How much did the Binance incident cost?
Binance estimated the impact at about $6.3 billion. That figure is preliminary. Other estimates cited by the source ranged from at least $5.5 billion to about $6.36 billion, using different times and asset prices.
Were customer funds lost?
Binance said user funds are safe and that it will cover losses. The source does not include a final audited account of the incident or a completed breakdown of assets lost and recovered.
How did the attackers move funds from Binance 14?
Blockaid’s analysis, summarized by the source, says a transaction used EIP-7702 permissions to make Binance 14 run attacker-supplied code. One of 50 pre-signed permissions matched the wallet’s current transaction number and enabled the sweep.
Who was behind the attack?
TRM Labs attributed the operation with high confidence to TraderTraitor, a group it links to North Korea. The source says neither Binance nor a government had confirmed that attribution.
When will Binance withdrawals resume?
On Oct. 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. The source does not confirm that all withdrawals had restarted by the time of its report.
Source: ThorstenMeyerAI.com
