🔍 Read the full analysis: Binance’s Hack: The Key Minutes Behind Billions Leaving on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an attacker exploited its Binance 14 hot wallet on Oct. 29 and that the incident had an estimated impact of about $6.3 billion across multiple blockchains. The company says user funds are safe and it will cover losses; preliminary estimates differ, about $3 billion was frozen, and the cause and attribution have not been independently confirmed.
Binance reported an estimated $6.3 billion impact from a security incident that began on Oct. 29, when an attacker drained assets from a major Ethereum hot wallet and transfers followed across other blockchain networks. The exchange said user funds are safe and it will cover losses, while deposits and withdrawals were suspended as it investigated.
At 20:24 UTC on Oct. 29, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from the wallet identified as Binance 14 to a recently created address. Blockworks valued that transaction at roughly $2.5 billion. Public Ethereum records also show that another Binance wallet sent 28,005.6 ETH to the same address 24 seconds later. These transactions are part of the publicly visible record; the identity of whoever controlled the receiving wallets is not established by that record alone.
TRM Labs reported that outflows from Binance wallets began on several networks shortly before the Ethereum sweep, with transfers also involving Bitcoin, Tron, the XRP Ledger, Solana and other chains. Its account says some transfers used ordinary signed transactions. Binance’s incident update put the estimated total impact at about $6.3 billion; other preliminary estimates cited in the source ranged from at least $5.5 billion to about $6.36 billion. The figures vary by analyst, timing and valuation, so they are not a final audited loss total.
Binance said it had suspended deposits and withdrawals while it responded. Its Oct. 30 update said about $3 billion had been frozen, including funds frozen by stablecoin issuers. The exchange said an internal review found that a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. Binance also said it had found no evidence that a wallet private key was leaked. A full post-mortem had not yet been published in the supplied material.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Cost of a Hot-Wallet Breach
The reported scale makes this a major test of how a large exchange protects assets held in wallets connected to online systems. A hot wallet supports routine transfers, but its availability also means that a compromise of the wallet, its signing process or associated infrastructure can expose substantial funds. Binance’s account points to a possible route through an employee device and service container; that explanation remains provisional, not a confirmed forensic conclusion.
The response also shows why crypto incidents can have different outcomes across asset types. The source reports that stablecoin issuers froze roughly $2.5 billion to $3 billion, limiting the movement of some assets. ETH and bitcoin cannot be frozen by a single issuer in the same way; TRM estimated about $2.4 billion remained beyond issuer freeze controls. Those figures are preliminary and depend on the assets and valuations counted. For customers, the immediate practical issues are access to withdrawals, the exchange’s stated commitment to cover losses, and whether the investigation changes its explanation of the breach.
The estimated total, if confirmed, would place the incident among the largest reported crypto thefts. The comparison in the source is with the approximately $1.5 billion Bybit hack in February 2025, but Binance’s figure remains an estimate rather than a final, independently established loss. The distinction matters: the total value moved, the amount ultimately lost and the amount recovered are not necessarily the same.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
How EIP-7702 Entered the Timeline
Binance’s wallet activity was traced in part to EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. The feature allows an externally owned account to authorize code to act on its behalf. In the account provided by blockchain security firm Blockaid, one transaction included 50 permissions, each tied to a consecutive transaction nonce for Binance 14. One permission matched the wallet’s current nonce and took effect, allowing the attacker’s code to operate on the wallet. That technical reading is attributed to Blockaid; the supplied material does not include a completed Binance forensic report confirming every step.
The source’s timeline says the operator wallet received small withdrawals from Tornado Cash on Oct. 28, then tested code on smaller wallets on Oct. 29. It reports that a contract was deployed and rehearsed before Binance outflows began at about 20:05 UTC. After the large Ethereum transfer at 20:24, additional transfers and later outflows followed, including a second wave involving Avalanche and Polygon. Binance said it revoked the affected address authorization by the morning of Oct. 30.
Binance first acknowledged reports of a potential security issue at 21:29 UTC on Oct. 29, saying it was investigating and that user funds were safe. It later said withdrawals would resume once the issue was resolved. On Oct. 30, co-CEO Yi He said deposits continued to operate and withdrawals were expected to begin resuming within 48 hours of her post. That was an expectation, not confirmation that withdrawals had restarted.
Losses, Attribution and Root Cause
The exact amount lost remains unsettled. Binance’s estimate, analyst estimates and the value of assets moved are not interchangeable: some funds were frozen, and the eventual amount recovered or permanently lost was not established in the source material. The estimates also use different snapshots and pricing, so the gap between them cannot be treated as a measured change in losses.
Binance said it found no evidence of a wallet private-key leak and described the laptop route as something that may have enabled unauthorized withdrawals. It has not yet released the promised full post-mortem, leaving key questions about the service container, authorization controls and the sequence of approvals unresolved. TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That is an analyst attribution; neither Binance nor a government had confirmed it in the supplied reporting.
It is also unclear how much of the assets that could not be frozen has since moved, whether all affected transfers have been identified, and whether the exchange will revise its impact estimate. The public ledger records transactions, but it does not by itself identify the people behind the wallets or establish their motives.
Withdrawal Restart and Forensic Review
Binance’s stated near-term priority is restoring withdrawals after resolving the security issue. Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post; customers should treat that as a forecast until Binance confirms availability. The company had said deposits continued to operate, while its earlier incident update described deposits and withdrawals as suspended.
Readers should watch for Binance’s post-mortem, a final accounting of affected assets and any updates on frozen or recovered funds. Further findings could confirm, refine or change the company’s preliminary account of how access was obtained. Until then, the total impact, cause and attribution remain subject to investigation.
The source material also warns that users may face scams impersonating Binance support or offering refunds. Customers should rely on official exchange channels for account and withdrawal updates, and should not treat unsolicited refund messages as evidence that funds are being returned.
Key Questions
What happened to Binance on Oct. 29?
Binance reported a security incident in which Binance 14, an Ethereum hot wallet, was drained. Analysts also reported transfers from Binance wallets on several other networks.
How much money was affected?
Binance estimated the impact at about $6.3 billion. Preliminary estimates from analysts varied, and the final amount lost, recovered or frozen had not been established in the source material.
Did Binance say customers’ funds were safe?
Yes. Binance said user funds were safe and that it would cover losses. The exchange also suspended deposits and withdrawals while investigating, according to its updates.
How did the attacker access the Ethereum wallet?
Blockaid’s analysis points to an EIP-7702 authorization that allowed code to act on Binance 14. Binance said a compromised DevOps engineer’s laptop may have provided access to a service container, but its full post-mortem was still pending.
When will Binance withdrawals resume?
On Oct. 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. The supplied material does not confirm that withdrawals restarted.
Source: ThorstenMeyerAI.com
