🔍 Read the full analysis: What We Still Don’t Know After Billions Left Binance on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an attack on Oct. 29 caused an estimated $6.3 billion in outflows across its wallets, with about $3 billion frozen and user funds covered by the exchange. Investigators have described how an Ethereum wallet was taken over, but the final loss figure, the full access path and the attacker’s identity have not been independently confirmed.
Binance says an attack on Oct. 29 caused about $6.3 billion in estimated outflows from its wallets across multiple blockchains, in what could be the largest recorded crypto theft if the preliminary figure holds. The exchange said user funds are safe and it will cover losses, while investigators continue to examine how the wallets were accessed and how much can be recovered.
The largest documented transfer came from an Ethereum wallet labelled Binance 14. At 20:24 UTC, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens to a newly created wallet. Blockworks valued that transfer at roughly $2.5 billion. Blockchain security firm Blockaid said the transaction used Ethereum’s EIP-7702 feature to authorize attacker-controlled code for the wallet.
The incident was not limited to Ethereum. TRM Labs reported that Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks sent funds in ordinary signed transfers during the same period. Binance’s stated estimated impact is about $6.3 billion. Other preliminary estimates differed: Blockaid put the figure at at least $5.5 billion, Arkham at $6.01 billion and TRM at about $6.36 billion. These totals depend on timing and asset prices and have not been finalized.
Binance said roughly $3 billion had been frozen by early Oct. 30. Stablecoin issuers including Tether and Circle announced freezes; TRM estimated that about $2.4 billion in assets could not be frozen by issuers, including ETH and bitcoin. Binance said it found no evidence that a wallet private key had leaked and that a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. That explanation remains the company’s preliminary account.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of the Reported Loss
If Binance’s estimate is borne out, the incident would exceed the $1.5 billion Bybit hack reported in February 2025 and rank as the largest crypto theft on record. The comparison is provisional: Binance’s total is an estimate, and asset prices and recovery efforts may change the eventual accounting.
The episode also shows why a large exchange’s security incident can extend beyond one blockchain or one compromised wallet. The reported outflows crossed multiple networks and asset types, while the ability to freeze funds varied by token. Stablecoin issuers could block some assets, but there is no comparable issuer mechanism for assets such as ETH and bitcoin. For customers, the immediate issues are access to deposits and withdrawals, the exchange’s ability to meet its commitments, and the reliability of updates as the investigation proceeds.
Binance said users’ funds are safe and that it will cover losses. That statement is the company’s assurance, not an independently published audit of all balances and liabilities. The incident’s full effect on customers and the exchange therefore depends on a final accounting and further evidence about the controls involved.
Popular right now
Dyson Car+Boat Cordless Handheld Vacuum
Shark HydroVac MessMaster Corded Wet/Dry Vacuum, Mop & Self-Clean (WD161)
De'Longhi Rivelia Automatic Espresso Machine with Milk Frother
As an affiliate, we earn on qualifying purchases.
How the Wallet Was Taken Over
The central Ethereum transfer used EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025. It lets an account authorize code to act on its behalf. According to Blockaid’s analysis, one valid permission in a transaction gave attacker-controlled code authority over Binance 14, allowing funds to be swept. The transaction carried 50 permissions tied to consecutive nonce numbers; Blockaid said one matched the wallet’s current number.
The public chain record reviewed by ThorstenMeyerAI.com shows the main sweep at 20:24:23 UTC on Oct. 29. Twenty-four seconds later, another Binance wallet sent 28,005.6 ETH to the same receiving address in an ordinary signed transaction. Subsequent movements and further outflows continued into the evening, including activity involving Binance’s smart account and wallets on additional networks.
Binance acknowledged the security issue at 21:29 UTC and said withdrawals would resume once it was resolved. Its early Oct. 30 update put the estimated impact at about $6.3 billion and said deposits and withdrawals were suspended. Co-CEO Yi He later said withdrawals were expected to begin resuming within 48 hours of her post. Binance also said it had revoked the affected address authorization.
“With high confidence” the attack was linked to TraderTraitor.”
— TRM Labs
What the Investigation Has Not Settled
The final value of the losses remains unsettled. The published totals range from at least $5.5 billion to about $6.36 billion, and the source reports describe them as preliminary. It is not yet clear how much of the reported outflow represents a lasting loss, how much can be recovered, or whether all figures use the same valuation time and accounting method.
The route into Binance’s systems is also unconfirmed. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container, while also saying it found no evidence of a private-key leak. The company had not yet published a full post-mortem explaining what was compromised, how access was gained, or whether other systems were affected.
TRM Labs attributed the attack to TraderTraitor with high confidence, but that remains an analyst assessment. The source material provides no public confirmation by Binance or a government agency. It is also unclear how much of the frozen amount will ultimately be returned and whether all affected wallets and networks have been identified.
Withdrawal Resumption and Forensic Findings
The next immediate milestone is Binance’s restoration of withdrawals. Yi He said on Oct. 30 that they were expected to begin resuming within 48 hours of her post; that was a forecast, not confirmation that withdrawals had restarted. Deposits and withdrawals had been suspended during the incident, while Binance said deposits continued to operate normally.
Readers should watch for Binance’s promised post-incident accounting and technical review, including a clearer breakdown of the outflows, frozen assets, recoveries and any remaining customer impact. Blockchain investigators and issuers may also publish updates on funds traced or frozen. Until those findings are available, the headline loss, the access route and attribution should be treated as provisional.
Binance and security firms also warned indirectly of the risks that follow a high-profile theft: scammers may pose as support staff or offer fake refunds. Customers should rely on verified Binance channels for service updates and should not share credentials or recovery phrases with anyone claiming to help.
Key Questions
How much money left Binance?
Binance estimated the impact at about $6.3 billion. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion. The final figure has not been established.
Were Binance customer funds affected?
Binance said user funds are safe and that it would cover losses. The source material does not include an independent audit confirming the full balance and liability picture.
How did the attacker take control of the Ethereum wallet?
Blockaid said a transaction used EIP-7702 permissions to authorize attacker-controlled code for Binance 14. Binance’s full account of how the attacker gained access to the systems involved was still pending.
Has the attacker been identified?
TRM Labs attributed the incident with high confidence to TraderTraitor, a group it links to North Korea. That attribution had not been confirmed by Binance or a government agency in the source material.
When will Binance withdrawals resume?
Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her Oct. 30 post. That was an expected timeline, not confirmation that withdrawals had restarted.
Source: ThorstenMeyerAI.com
