🔍 Read the full analysis: Binance’s Evening Of Losses: The Hack And What Remains Unclear on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance reported an estimated $6.3 billion impact from an attack that began with a sweep of its Ethereum hot wallet and included transfers from wallets on other networks. The exchange says user funds are safe and it will cover losses; about $3 billion was frozen, while the full amount lost and how the attacker gained access remain uncertain.
Binance said on October 30 that a security incident had an estimated impact of about $6.3 billion, after an attacker emptied a major Ethereum hot wallet and other Binance wallets sent assets across several blockchains. The exchange said user funds are safe and it will cover losses, but the estimate is preliminary and the method used to gain access remains under investigation.
The incident began on the evening of October 29. At 20:24 UTC, an Ethereum transaction transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created address. Blockworks valued that transaction at about $2.5 billion. Blockchain security firms also reported outflows from Binance wallets on other networks, including Bitcoin, Tron, the XRP Ledger and Solana.
Estimates of the total impact vary by source and measurement time. Binance put it at about $6.3 billion; TRM Labs estimated roughly $6.36 billion, Arkham about $6.01 billion, and Blockaid reported at least $5.5 billion as of 22:00 UTC. These are preliminary figures, not a final accounting of unrecoverable losses. Binance said about $3 billion had been frozen by the time of its update. Stablecoin issuers can freeze some tokens, but not assets such as ETH and bitcoin.
Binance said its investigation found that a DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions. The company also said it had found no evidence of a wallet private-key leak. It paused deposits and withdrawals while addressing the incident. Binance reported that deposits continued to operate, and co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her October 30 post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Customer Funds and Exchange Operations
The incident puts the security of centralized exchange hot wallets under scrutiny: these wallets hold assets that exchanges need to move, making their access systems a high-stakes target. Binance’s assurance that users’ balances are safe and its commitment to cover losses address immediate concerns, but the scale of the reported impact makes the final accounting and recovery effort important to customers and the wider crypto market.
The incident also shows the difference between assets that can be frozen and those that cannot. According to the source account, issuers froze roughly $2.5 billion to $3 billion in assets within hours. TRM Labs estimated about $2.4 billion remained beyond issuer control. Those figures are estimates and may change as investigators trace funds; a freeze does not by itself establish that assets have been returned to Binance.
For customers, the pause in withdrawals is a direct operational effect even if Binance’s statement that user funds are safe stands. The exchange’s expected restart window was a forecast from its co-CEO, not confirmation that all withdrawals had resumed. Users should distinguish official Binance updates from unsolicited messages: the source warns that attackers may pose as support staff or offer fake refunds.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Dell XPS 13 9350 AI Professional Laptop 13.4 120Hz FHD+ Display
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
How the Ethereum Wallet Was Used
Blockchain analysts cited in the source describe the Ethereum transaction as using EIP-7702, a feature that allows an externally owned account to authorize code to act for it. The source says the attacker attached code to Binance 14 and used it to move the wallet’s assets. This is a technical account of the observed transaction, not a completed explanation of how the attacker obtained the ability to authorize it.
Blockaid’s analysis said the transaction carried 50 pre-signed permissions tied to consecutive transaction numbers, or nonces. One permission matched the wallet’s current nonce and was accepted. The source says that only the wallet’s own key, or the system holding that key, could produce those permissions. Binance’s statement that it found no evidence of a private-key leak leaves open how the permissions were produced and whether a compromised system or process was involved.
The sequence was not limited to the initial Ethereum sweep. TRM Labs reported that Binance wallets on multiple chains sent assets through ordinary signed transfers during the same period, with a later wave involving Avalanche and Polygon. Binance said by the morning of October 30 that it had revoked the affected address authorization. The company’s full post-mortem had not yet been published in the source material.
The Attack Route and Final Loss
The final amount lost is not established. The reported impact figures differ, are preliminary and do not necessarily equal assets that Binance cannot recover. The source says roughly $3 billion was frozen, but it does not establish how much of that amount will be returned or how much of the remaining assets can be traced or recovered.
It is also unclear exactly how the attacker gained the authority to act on Binance 14 or how the other chain-specific transfers were authorized. Binance’s laptop and service-container theory is qualified as something that “may” have happened, while its statement says it found no evidence of a wallet private-key leak. Those statements do not resolve whether the intrusion involved employee credentials, access to an operational system, or another route.
TRM Labs attributed the operation “with high confidence” to TraderTraitor, a group it links to North Korea. That attribution is an assessment by the analytics firm; neither Binance nor a government had confirmed it in the supplied material. The full investigation, attacker identity and whether any customer balances were affected beyond the reported wallet activity remain open questions.
Withdrawal Restart and Binance Review
The immediate milestone is the resumption of withdrawals. Yi He said on October 30 that they were expected to begin returning within 48 hours, while Binance had earlier said it would restore service once the security issue was resolved. The source does not confirm that the restart occurred, so customers should rely on current notices from Binance for service status.
Binance’s promised post-mortem is another key next step. It can clarify how the attacker obtained permission to move assets, what systems were affected, how the exchange calculated the estimated impact and what safeguards it plans to change. Updates from stablecoin issuers and blockchain investigators may also show whether frozen assets can be recovered.
Until those details are published, the incident’s scale and attribution should be treated as provisional. Binance says it will cover losses and that user funds are safe; the extent of any unrecovered losses, the full technical cause and the timing of normal operations remain to be confirmed.
Key Questions
How much did Binance say the incident affected?
Binance estimated an impact of about $6.3 billion in its October 30 update. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, depending on the source and measurement time. The figures are not a final count of unrecoverable losses.
Did Binance say customer funds were safe?
Yes. Binance said user funds are safe and that it would cover losses. The source material does not provide an independent audit of that assurance or a final accounting of the incident.
What happened to Binance’s Ethereum wallet?
A transaction on October 29 moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from the wallet identified as Binance 14. Analysts cited in the source said the transaction used EIP-7702 permissions to run code for the wallet.
Has Binance confirmed how the attacker got in?
No. Binance said a compromised DevOps engineer’s laptop may have provided access to a service container, and said it found no evidence of a wallet private-key leak. The full cause remains under investigation.
When were withdrawals expected to resume?
Co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours. That was an expectation at the time of her post, not confirmation that withdrawals had restarted.
Source: ThorstenMeyerAI.com
