🔍 Read the full analysis: The Binance Hack: Reconstructing The Evening Billions Left on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact from an attack that drained assets from its wallets across several blockchains on Oct. 29. The exchange says it will cover losses and user funds are safe; the total is preliminary, and attribution to a North Korean-linked group has not been independently confirmed by Binance or a government.
Binance said early Oct. 30 that an attack on its wallets had an estimated impact of about $6.3 billion, after assets moved across multiple blockchains on the evening of Oct. 29. The exchange said it would cover losses and that user funds were safe; it also reported that roughly $3 billion had been frozen, while deposits and withdrawals were suspended during its response.
The most clearly documented transfer occurred at 20:24 UTC on Oct. 29, when a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance hot wallet identified as “Binance 14”. Blockworks valued that transaction at about $2.5 billion. Public Ethereum records show the transfer; the broader total includes reported outflows from Binance wallets on several networks.
Binance’s estimate is not a final audited loss figure. Other preliminary tallies differed: Blockaid put the impact at at least $5.5 billion as of 22:00 UTC, Arkham at $6.01 billion, and TRM Labs at about $6.36 billion. The figures depend on the time and asset prices used. Binance said about $3 billion had been frozen, while earlier reporting put the verified frozen amount at $2.54 billion.
Blockchain security firm Blockaid said one Ethereum transaction carried 50 pre-signed EIP-7702 permissions for Binance 14, with one matching the wallet’s current transaction number. The permission allowed attacker-controlled code to operate through the wallet. TRM Labs reported that other Binance wallets sent assets through ordinary signed transfers during the same period. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals, while reporting no evidence that a wallet private key had leaked.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Cost of a Multichain Breach
The incident involved a reported financial impact and activity across multiple blockchain networks, requiring investigators to track transfers across different systems. Stablecoin issuers can freeze tokens they control; they cannot reverse transfers or freeze assets such as ETH and bitcoin. TRM estimated that about $2.4 billion was beyond issuer freezes, though that figure, like the overall tally, is preliminary.
Binance suspended withdrawals while it investigated and said it would cover losses. The exchange’s statements do not establish a final amount or resolve the technical questions. The incident involved EIP-7702 permissions, a feature that allows externally owned accounts to authorize code to act on their behalf, though the precise role of the feature in the attack remains under investigation.
Products Worth Considering
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Wallet Permission to Outflows
The attack’s on-chain activity began before the main drain. According to TRM and the source’s review of Ethereum records, an operator wallet received small withdrawals from Tornado Cash on Oct. 28. On Oct. 29, the operator tested code on small wallets, deployed a contract and rehearsed it before the transfers from Binance began.
At about 20:05 UTC, outflows from Binance wallets appeared on several chains. At 20:20:59, the transaction containing 50 EIP-7702 permissions affected Binance 14; the major sweep followed at 20:24:23. Additional transfers followed, including 28,005.6 ETH from another Binance wallet 24 seconds after the main transaction. Binance later said it revoked the affected address authorization. Ethereum’s Pectra upgrade, which introduced EIP-7702, went live in May 2025; the feature lets an externally owned account authorize code to act on its behalf.
“The attack was attributed with high confidence to TraderTraitor.”
— TRM Labs
The Total and Attribution Remain Open
The $6.3 billion estimate is preliminary, and the source material does not establish a final net loss after frozen assets, recoveries or further tracing. Analysts’ estimates vary, and the amount frozen was reported at different points in the response. It is also unclear how much of the transferred value can ultimately be recovered.
Binance’s description of a compromised laptop is a possible explanation, not a completed account of the intrusion. The exchange said a post-mortem was still to come. TRM’s attribution to TraderTraitor is an intelligence assessment; neither Binance nor a government had publicly confirmed it in the supplied material. The exact route by which the attacker obtained the permissions and signed transactions on other chains also remains unresolved.
Incident Review and Withdrawal Resumption
Binance said it was investigating, had revoked the affected address authorization and would publish more information after its review. The next key update is a fuller technical account explaining how access was obtained, which wallets and systems were affected, and how the exchange calculated its impact estimate.
On Oct. 30, Yi He said withdrawals were expected to begin resuming within 48 hours of her post. That was a forecast, not a confirmed reopening time. Customers should rely on Binance’s official channels for status updates and treat unsolicited refund or support messages cautiously, as the source material warns that scams may exploit the incident.
Key Questions
How much did the Binance attack cost?
Binance estimated an impact of about $6.3 billion. The figure was preliminary, and independent tracking estimates ranged from at least $5.5 billion to about $6.36 billion.
Were customer funds lost?
Binance said user funds were safe and that it would cover all losses. The supplied reporting does not include a final independently audited loss calculation.
How did the attacker access Binance 14?
Blockaid said an EIP-7702 permission transaction enabled attacker-controlled code to operate through the Ethereum wallet. Binance said a compromised DevOps engineer’s laptop may have provided access to a service container, but its investigation was ongoing.
Was the attack confirmed to be linked to North Korea?
No. TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. The supplied reporting says Binance and government officials had not confirmed that attribution.
When would Binance withdrawals resume?
On Oct. 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. The material does not confirm that withdrawals had reopened.
Source: ThorstenMeyerAI.com
