🔍 Read the full analysis: From First Alert To Aftermath: The Binance Hack Timeline on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says an attack on Oct. 29 affected about $6.3 billion across its wallets, including a hot-wallet sweep enabled by an Ethereum transaction. The exchange says user funds are safe and it will cover losses; the amount remains preliminary, and attribution to a North Korean-linked group has not been confirmed by Binance or a government.
Binance says an attack on Oct. 29 affected about $6.3 billion in assets across its wallets, after a transaction used an Ethereum wallet permission feature to sweep a major hot wallet and funds also left wallets on other networks. The exchange says user funds are safe and it will cover losses, but the impact estimate is preliminary and the full incident review is still pending.
At 20:24 UTC on Oct. 29, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from the wallet identified as Binance 14 to a newly created address, according to the public Ethereum record and the source’s review of it. Blockworks valued that transaction at roughly $2.5 billion. About 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same address in a separately signed transfer.
Binance’s incident update, issued at 02:23 UTC on Oct. 30, put the estimated total impact at about $6.3 billion. Other early estimates differed: Blockaid reported at least $5.5 billion, Arkham about $6.01 billion, and TRM Labs about $6.36 billion. The figures are preliminary and reflect different counting times and asset prices. TRM said funds also left Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and smaller networks through ordinary signed transfers.
Binance said it found that a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawal transactions. The exchange said it found no evidence that a wallet private key was leaked. Binance reported that roughly $3 billion had been frozen by the time of its update; the account says stablecoin issuers froze roughly $2.5 billion to $3 billion. Binance also said deposits and withdrawals were suspended, while co-CEO Yi He later said deposits continued to operate normally and withdrawals were expected to begin resuming within 48 hours of her post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Outflows Affect Users
The reported scale makes this incident significant for exchange security and customer access, not just for the value moved on-chain. Binance’s assurance that user funds are safe and its commitment to cover losses address immediate concerns about customer balances, while the temporary withdrawal pause could leave users unable to move assets until the exchange restores the service.
The incident also shows the different limits on recovering cryptocurrency. Stablecoin issuers can freeze tokens they control, and several issuers reportedly did so within hours. ETH and bitcoin cannot be frozen by an issuer in the same way. TRM estimated about $2.4 billion was beyond any issuer’s ability to freeze. These are reported figures, not a final accounting of what can be recovered.
For customers, the cause matters as much as the headline amount. Binance’s preliminary account points to possible access through an employee’s device and a service container, while the unusual Ethereum permission transaction affected a specific hot wallet. The company has not yet released a full post-mortem explaining how access was obtained or how controls failed.
Products Worth Considering
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
As an affiliate, we earn on qualifying purchases.
The October 29 Attack Sequence
According to TRM Labs and the source’s review of public blockchain records, the operator wallet received three small withdrawals from Tornado Cash on Oct. 28. On Oct. 29, it tested sweeper code on two small wallets, then deployed a contract and rehearsed it on another wallet. Those steps preceded the main outflows from Binance wallets, which began at about 20:05 UTC, according to TRM.
At 20:20:59 UTC, a transaction carried 50 EIP-7702 permissions for Binance 14, with one matching the wallet’s current transaction number, or nonce. The source says the permission allowed the wallet to run attacker-controlled code. The large sweep followed at 20:24:23. Later that evening, Binance smart-account funds were also moved, and another reported wave affected wallets on Avalanche and Polygon. Binance said it had revoked the affected address authorization by the morning of Oct. 30.
Binance first acknowledged reports of a potential security issue at 21:29 UTC on Oct. 29, saying it was investigating and that user funds were safe. At 22:15, it said withdrawals would resume once the issue was resolved. The incident update the next day gave the wider impact estimate and described the possible laptop connection.
“The attack is attributed with high confidence to TraderTraitor.”
— TRM Labs
Final Losses and Attribution
The $6.3 billion impact estimate is not final. Estimates from Binance and blockchain analysts vary, and the source notes that totals depend on when assets were counted and the prices used. The amount ultimately stolen, frozen, recovered or otherwise accounted for has not been established in a final public report.
Binance’s explanation of the possible laptop and service-container access remains under investigation. The exchange said it found no evidence of a private-key leak, but its full post-mortem was still to come. TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea; that attribution was not confirmed by Binance or a government in the available material.
It is also not clear when withdrawals fully resumed or whether all affected services and wallets had returned to normal. Binance’s stated timeframe was an expectation, not confirmation that withdrawals had already reopened.
Binance’s Review and Withdrawals
Binance said withdrawals would resume once the security issue was resolved; Yi He later forecast that they would begin resuming within 48 hours of her Oct. 30 post. Customers should look for official Binance service updates for confirmation of availability and any limits. The exchange’s full post-mortem is also expected to clarify how the attacker gained access, how the affected wallets were secured and how the final losses are calculated.
Investigators and blockchain analysts may continue tracing funds and updating estimates as assets move or are frozen. The source warns that users should be alert to fake refund or support messages posing as responses to the incident. No recovery outcome or final attribution is confirmed in the material available as of Oct. 30.
Key Questions
How much did the Binance attack affect?
Binance estimated the impact at about $6.3 billion in its Oct. 30 update. Other early estimates ranged from at least $5.5 billion to about $6.36 billion. These are preliminary figures, not a final loss total.
Were Binance customer funds lost?
Binance said user funds are safe and that it will cover all losses. The full accounting and recovery status had not been published in the source material.
How did the attacker access Binance 14?
The reported Ethereum transaction used an EIP-7702 permission to make Binance 14 run attacker-controlled code. Binance said a compromised DevOps engineer’s laptop may have allowed access to a service container, but it had not issued a final post-mortem.
Was the attack confirmed to be linked to North Korea?
No. TRM Labs attributed it with high confidence to TraderTraitor, which TRM links to North Korea. Binance and government officials had not confirmed that attribution in the material provided.
When will Binance withdrawals resume?
Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. That was a stated expectation; the source material does not confirm the time withdrawals actually resumed.
Source: ThorstenMeyerAI.com
