🔍 Read the full analysis: Following The Binance Hack Through A Pivotal Evening on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance reported an estimated $6.3 billion impact from an attack that began with the compromise of its Ethereum hot wallet Binance 14 on 29 October. The exchange says user funds are safe and it will cover losses; stablecoin issuers froze about $3 billion, while the amount and the attacker’s identity remain subject to investigation.
Binance says an attack on its hot wallets on 29 October had an estimated impact of about $6.3 billion, after an attacker took control of an Ethereum wallet and moved assets across several blockchains. The exchange says user funds are safe and it will cover losses, but withdrawals were suspended while the incident was addressed and the total remains preliminary.
Public Ethereum records show that at 20:24 UTC, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created address. Blockworks valued the transaction at roughly $2.5 billion. About 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same recipient, according to the records cited in the source report.
TRM Labs reported that withdrawals from Binance wallets on multiple chains began around 20:05 UTC, including Bitcoin, Tron, the XRP Ledger and Solana. It also reported a later wave involving Avalanche and Polygon. The source’s review of on-chain activity says transfers from Binance 14 continued until 23:56 UTC. These transactions and the exchange’s wider impact estimate describe different measures: Binance’s $6.3 billion figure is an estimated total impact, not the value of the single Ethereum transaction.
Estimates differed as the incident developed. The source cites Blockaid at at least $5.5 billion as of 22:00 UTC, Arkham at $6.01 billion and TRM Labs at about $6.36 billion; Binance later put the impact at about $6.3 billion. The figures are preliminary and vary by timing, valuation and what each tally includes. Binance said on 30 October that about $3 billion had been frozen. The source report says stablecoin issuers froze roughly $2.5 billion to $3 billion, while assets such as ETH and bitcoin cannot be frozen by issuers.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Scale of the Reported Losses
The incident matters because of its reported scale and the concentration of assets in exchange-controlled wallets. Binance’s estimate, if it holds, would place the event among the largest reported cryptocurrency thefts; the source compares it with the $1.5 billion Bybit hack in February 2025. That comparison depends on Binance’s still-preliminary total, not a final audited loss figure.
For customers, the immediate practical concern is service access and confidence in the exchange’s custody controls. Binance said users’ funds were safe and that it would cover losses, but it suspended deposits and withdrawals during its response. The reported freezes may limit what can be moved from certain stablecoin addresses, while ETH and bitcoin transfers cannot be reversed by a token issuer. The incident also raises questions about the security of systems that authorize transactions, not only the protection of private keys themselves.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
As an affiliate, we earn on qualifying purchases.
How Binance 14 Was Taken Over
According to the source report’s account of Binance statements and analysis by Blockaid, the attacker used EIP-7702, an Ethereum feature that lets an externally owned account authorize code to run on its behalf. The attack transaction carried 50 pre-signed permissions tied to consecutive transaction numbers, or nonces. Blockaid’s analysis says one permission matched Binance 14’s current nonce, allowing the attacker’s code to take control of the wallet and sweep assets.
The source report says the operator wallet received small withdrawals from Tornado Cash on 28 October, tested code on other wallets the following day and deployed the contract used in the attack before the large transfers. These preparatory steps are attributed to the report’s review of public blockchain records and to TRM Labs; they do not, by themselves, identify the person or group behind the operation.
Binance said a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawal transactions. The exchange said it found no evidence of a wallet private-key leak. That explanation is not a completed forensic finding: Binance said a post-mortem was still to come.
Key Questions Still Open
The final loss, the value of assets ultimately recovered or frozen, and the exact scope of affected wallets remain unsettled. The published estimates range from at least $5.5 billion to about $6.36 billion, and the source does not provide a final reconciled accounting. Binance’s claim that customer funds are safe is its stated position; the available material does not include an independent audit confirming the full impact or repayment arrangements.
It is also not yet clear how the attacker gained the ability to submit the permissions, whether the laptop and service-container explanation will be confirmed, or whether other access routes were involved. TRM Labs attributed the attack to TraderTraitor with high confidence, but that remains an analyst assessment rather than a confirmed government finding. The source says no government or Binance had confirmed the attribution at the time of reporting.
Withdrawal Restart and Forensic Review
Binance co-CEO Yi He said on 30 October that deposits continued to operate normally and withdrawals were expected to begin resuming within 48 hours of her post. The exchange had earlier said withdrawals would resume once the security issue was fully resolved. The timing was an expectation, not confirmation that all services had reopened.
Binance said it had revoked the affected address authorization by the morning of 30 October. Readers should look for the exchange’s promised post-incident account to clarify the entry point, the final loss calculation, the status of frozen assets and any changes to wallet controls. Until those details are published, the attacker attribution, exact recovery total and full effect on users remain developing.
Key Questions
How much did the Binance attack cost?
Binance estimated the total impact at about $6.3 billion on 30 October. Other preliminary estimates cited in the source ranged from at least $5.5 billion to about $6.36 billion, so the final figure has not been established.
Were Binance customer funds affected?
Binance said user funds are safe and that it would cover losses. The source material does not include an independent audit of that assurance, and Binance’s final accounting was still pending.
How did the attacker move the Ethereum assets?
Blockaid’s analysis, as described in the source, says the attacker used EIP-7702 permissions to make code run through Binance 14. One of 50 pre-signed permissions matched the wallet’s current transaction number, enabling the sweep.
Were any stolen assets frozen?
Binance reported about $3 billion frozen, while the source says stablecoin issuers froze roughly $2.5 billion to $3 billion. Issuers can freeze some stablecoins, but they cannot freeze ETH or bitcoin through the same mechanism.
Who was responsible for the attack?
TRM Labs attributed it with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government in the source material.
Source: ThorstenMeyerAI.com
