🔍 Read the full analysis: What We Know—and Don’t Know—About Billions Leaving Binance on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance reported an estimated $6.3 billion impact after funds left its wallets across several blockchains on October 29. The exchange says user funds are safe and it will cover losses, while investigators and the company have not publicly established a final loss total or confirmed who carried out the attack.
Binance reported an estimated $6.3 billion impact after funds were taken from its wallets across multiple blockchains on October 29, in what the exchange described as a security incident. Binance said user funds are safe and it would cover losses, but the total amount ultimately lost, the attacker’s identity and the exact route into the wallets remain unresolved.
The most visible outflow began at 20:24 UTC on October 29, when a transaction emptied a major Ethereum hot wallet labeled Binance 14. The transaction transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens to a wallet created a few hours earlier. Blockworks valued that transaction at about $2.5 billion. Public Ethereum records show another Binance wallet sent 28,005.6 ETH to the same destination 24 seconds later.
Other transfers were reported across multiple networks. TRM Labs said Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and smaller chains sent funds to attacker-controlled addresses, with outflows starting around 20:05 UTC. The figures are preliminary and differ by source and counting time: Blockaid estimated at least $5.5 billion as of 22:00 UTC; Arkham counted $6.01 billion; TRM put the impact at about $6.36 billion; and Binance reported approximately $6.3 billion.
Binance said roughly $3 billion had been frozen by the time of its October 30 update. Stablecoin issuers, including Tether and Circle, announced freezes during the incident. TRM estimated about $2.4 billion was beyond any issuer’s ability to freeze, including assets such as ETH and bitcoin. Binance said deposits continued to operate, while withdrawals were suspended during its response.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Customer Access and Frozen Funds
The incident matters both for the scale of the reported outflows and for the role Binance plays as a major exchange where customers hold and move digital assets. A large security failure can disrupt withdrawals and deposits, put pressure on confidence in exchange custody, and complicate efforts to trace or recover funds across networks. The reported totals are not the same as a confirmed final loss: frozen assets may be recoverable or remain inaccessible, and the published estimates were made at different times and prices.
Binance’s assurance that customer funds are safe and its pledge to cover losses are significant statements from the company, not an independent audit of the incident. The distinction matters to users trying to understand whether their balances are affected and when ordinary withdrawals will resume. While some stablecoins can be frozen by their issuers, other assets generally cannot be stopped in the same way, leaving investigators to follow transactions and any later attempts to move or convert them.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
How Binance 14 Was Drained
Blockchain analyst Blockaid said the attacker used Ethereum’s EIP-7702 feature to make Binance 14 execute code controlled by the attacker. EIP-7702 permits an account to authorize program code to act on its behalf. The account’s authorization is tied to a transaction number, or nonce, which increases as transactions are processed. Blockaid reported that one transaction included 50 pre-signed permissions for consecutive nonce values; one matched the wallet’s current number, allowing the attacker’s code to run.
That mechanism describes the on-chain method, but it does not by itself explain how the permissions were obtained. Binance said a compromised DevOps engineer’s laptop may have given an attacker access to a service container used to submit unauthorized withdrawal transactions. The company said it had found no evidence of a wallet private-key leak. These points are Binance’s account and remain subject to a fuller post-incident review.
Binance’s public updates on October 29 first acknowledged reports of a potential security issue and said the company was investigating. It later said withdrawals would resume after the issue was resolved. In an update early October 30, Binance put the estimated impact at about $6.3 billion and said deposits and withdrawals had been suspended. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post.
“with high confidence”
— TRM Labs
Losses, Access and Attribution
The final amount lost remains unclear. The estimates range from at least $5.5 billion to about $6.36 billion, reflecting different timestamps, valuations and counting methods. Binance’s estimate of about $6.3 billion is not a final audited accounting in the source material, and the amount frozen does not establish how much will be recovered or how much represents an enduring loss.
The precise path from the reported laptop compromise to the wallet authorizations has not been publicly documented in a post-mortem. Binance said the laptop may have provided access to a service container, while also saying it found no evidence of a private-key leak. It is not yet clear what systems or credentials were accessed, how many accounts or customers were directly affected, or whether all affected wallet activity has been identified.
TRM Labs attributed the incident with high confidence to TraderTraitor, a group it links to North Korea. That remains an analyst assessment: neither Binance nor a government had confirmed the attribution in the material available. The subsequent movement or recovery of assets, and the status of withdrawals after the promised resumption window, also require further updates.
Binance’s Recovery and Review
Binance said it had revoked the affected address authorization and expected withdrawals to begin resuming within 48 hours of Yi He’s October 30 post. That was a stated expectation, not confirmation that service had resumed. The exchange’s next key steps are to report whether withdrawals have restarted, clarify which services remain affected and publish a fuller account of the security failure.
Investigators and blockchain analysts will continue tracking the wallets that received the funds, while stablecoin issuers may provide further details about frozen assets. Readers should distinguish official exchange notices from claims made through unsolicited messages: the source report warned that scams posing as refunds or customer support could target users during the disruption. The final loss total, recovery outcome and confirmed attribution remain dependent on further reporting and Binance’s post-mortem.
Key Questions
How much money left Binance?
Binance estimated an impact of about $6.3 billion. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, using different timestamps and counting methods. A final loss figure was not available.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover losses. Those are the company’s statements; the source material does not include an independent audit of the incident’s financial impact.
How were the wallets accessed?
Blockaid said an attacker used Ethereum’s EIP-7702 authorization feature to run code from Binance 14. Binance said a compromised DevOps engineer’s laptop may have provided access to a service container, but the exact route has not been fully explained publicly.
Who carried out the attack?
TRM Labs attributed it with high confidence to TraderTraitor, a group it links to North Korea. The attribution was not confirmed by Binance or a government in the source material.
When were withdrawals expected to resume?
Binance co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post. The source material does not confirm that withdrawals had restarted.
Source: ThorstenMeyerAI.com
