🔍 Read the full analysis: The Binance Hack Timeline: Key Moments From One Evening on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says an attack on 29 October affected about $6.3 billion in assets across its wallets, including a large Ethereum hot-wallet sweep and transfers on other networks. The company says user funds are safe and it will cover losses; investigators’ totals and attribution remain preliminary, and Binance has yet to publish its post-mortem.
The key Ethereum transaction occurred at 20:24:23 UTC on October 29. According to the public Ethereum record reviewed by ThorstenMeyerAI.com, it transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from Binance 14 to a newly created receiving wallet. Blockworks valued that transaction at roughly $2.5 billion. About 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same address in a separately signed transfer.
The incident extended beyond Ethereum. TRM Labs reported outflows from Binance wallets on as many as 10 blockchain networks, including Bitcoin, Tron, the XRP Ledger and Solana. It said most began around 20:05 UTC, with another wave involving Avalanche and Polygon later in the evening. The source account describes Binance wallet transfers on those networks as ordinary signed transactions; the precise mechanism behind each transfer has not been established publicly.
Asset-loss estimates varied by source and reporting time. Blockaid put the impact at at least $5.5 billion by 22:00 UTC, Arkham estimated $6.01 billion, and TRM put it at about $6.36 billion. Binance reported an estimated total of around $6.3 billion. These are preliminary figures, not a finalized accounting. Binance said about $3 billion had been frozen; the source account cites an earlier verified frozen figure of $2.54 billion. Stablecoin issuers can freeze some tokens, but ETH and bitcoin cannot be frozen by those issuers.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
A Multi-Chain Test for Exchange Security
The reported scale makes the incident consequential for Binance customers and the wider crypto market. A compromise involving one exchange hot wallet was followed by movements across several networks, complicating efforts to trace and contain assets. The difference between the preliminary estimates also shows why the total remains subject to reconciliation as investigators identify transfers, valuations and recoveries.
Binance’s assurance that customers will not bear losses is a company statement about its response, not a completed independent accounting. The incident also highlights the operational importance of systems that authorize hot-wallet transactions: Binance has pointed to a potentially compromised engineer’s laptop and access to a service container, while saying it found no evidence that a wallet private key was leaked. The company’s forthcoming post-mortem may clarify how those systems were accessed and what controls failed.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
As an affiliate, we earn on qualifying purchases.
From Wallet Tests to the Main Sweep
TRM Labs and the source account’s review of on-chain records describe preparations before the large transfer. On October 28, the operator wallet received three small withdrawals from Tornado Cash, according to TRM and Blockworks. On October 29, it tested sweeper code on two small wallets, then deployed a contract and rehearsed it on a third wallet, according to the cited on-chain analysis.
At 20:20:59 UTC, a transaction submitted 50 EIP-7702 permissions for Binance 14, according to Blockaid’s analysis. The source account says one permission matched the wallet’s current transaction number, or nonce, allowing the wallet to run attacker-controlled code. The large sweep followed minutes later. Binance said it had revoked the affected address authorization by the morning of October 30.
Binance first acknowledged reports at 21:29 UTC, saying it was investigating and that user funds were safe. It said withdrawals would resume once the issue was resolved. Between 21:18 and 22:56, several stablecoin issuers announced freezes, according to the source account. Binance’s incident update at 02:23 UTC on October 30 gave the roughly $6.3 billion estimate and said deposits and withdrawals were suspended.
“with high confidence”
— TRM Labs, on its attribution assessment as quoted by ThorstenMeyerAI.com
Attribution, Losses and Access Path
Several major questions remain open. The total impact is an estimate, and the figures differ among Binance and analytics firms. The amount ultimately unrecoverable is also not settled: issuers froze some assets, while other crypto assets cannot be frozen by those issuers. The source account gives an estimate of roughly $2.4 billion beyond issuer control, but that is not a final loss figure.
Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions. The wording is tentative, and Binance has not yet published a post-mortem. Its statement that it found no evidence of a private-key leak does not, on its own, establish precisely how the attacker obtained the permissions or how the multi-chain transfers were authorized.
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. That attribution remains an analyst assessment: the source material says neither Binance nor a government had confirmed it. It is also not yet clear how much of the reported frozen total will be recovered or whether all affected wallets and services have been fully reviewed.
Withdrawal Restart and Binance Review
Binance’s stated immediate priority was restoring withdrawals after resolving the security issue. Co-CEO Yi He said at 04:17 UTC on October 30 that withdrawals were expected to begin resuming within 48 hours; the source material does not confirm whether that timetable was met. Binance also said deposits continued to operate normally, although its incident update had reported deposits and withdrawals suspended.
The next major disclosure is Binance’s promised post-mortem, which should address the access route, the affected systems, the full wallet-by-wallet accounting and the safeguards added afterward. Investigators and the exchange will also need to update recovery figures as frozen assets and transfers are traced. Until then, the total impact, final unrecovered amount and attacker attribution should be treated as provisional.
Customers should rely on official Binance channels for service notices. The source account warns that scams posing as refunds or support may follow the incident; there is no confirmed refund process described in the available material.
Key Questions
How much did Binance say the incident affected?
Binance reported an estimated impact of about $6.3 billion. Analytics firms gave preliminary estimates ranging from at least $5.5 billion to about $6.36 billion, so the figure is not a finalized loss total.
What happened to Binance 14?
An Ethereum transaction submitted 50 EIP-7702 permissions for the hot wallet, according to Blockaid’s analysis. One matched the wallet’s current transaction number, and the subsequent sweep moved 167,464 ETH, 1.615 billion USDT and 62 other tokens, according to the public record cited by ThorstenMeyerAI.com.
Were customer funds lost?
Binance said user funds are safe and that it would cover all losses. The incident’s final accounting and the amount of assets that may remain unrecovered were still unclear in the source material.
Who carried out the attack?
TRM Labs attributed it with high confidence to TraderTraitor, a group it links to North Korea. The attribution was not confirmed by Binance or a government, according to the source account.
When were withdrawals expected to resume?
Co-CEO Yi He said at 04:17 UTC on October 30 that withdrawals were expected to begin resuming within the next 48 hours. The source material does not confirm whether withdrawals restarted on that schedule.
Source: ThorstenMeyerAI.com
