🔍 Read the full analysis: Why Did Billions Leave Binance In One Evening? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance reported an estimated $6.3 billion impact from an attack that moved funds from its wallets across several blockchains on Oct. 29. The company says user funds are safe and it will cover losses, while blockchain analysts say stablecoin issuers froze billions; the final amount lost and the attack’s cause are still uncertain.
Binance says an attack on its wallets had an estimated $6.3 billion impact after funds moved across several blockchains on Oct. 29, including a roughly $2.5 billion Ethereum transfer from a hot wallet. The exchange says customer funds are safe and it will cover losses; the total financial loss and the precise cause of the incident remain under review.
At 20:24 UTC on Oct. 29, a transaction moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance wallet identified as “Binance 14” to a newly created wallet. Blockworks valued that transaction at about $2.5 billion. Binance’s incident update, issued at 02:23 UTC on Oct. 30, put the estimated total impact across the incident at about $6.3 billion.
The reported totals vary by source and were preliminary. Blockaid put the impact at at least $5.5 billion at 22:00 UTC; Arkham estimated $6.01 billion; TRM Labs estimated about $6.36 billion. The figures reflect different times, valuations and counting methods, so they should not be treated as a settled amount lost.
TRM Labs reported outflows from Binance wallets on multiple networks, including Bitcoin, Tron, the XRP Ledger and Solana, as well as Ethereum. Binance said deposits and withdrawals were suspended during its response. Co-CEO Yi He said deposits continued to operate normally and withdrawals were expected to begin resuming within 48 hours of her Oct. 30 post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Customer Funds and Frozen Assets
The incident puts the exchange’s wallet security and ability to keep customer services running under scrutiny. Binance says users’ funds are safe and that it will cover losses, but withdrawals were paused while the company addressed the security issue. For customers, that means access to funds may be delayed even as deposits continue, according to Yi He.
Some assets could be blocked after leaving the exchange, but not all. Binance and blockchain analysts reported that stablecoin issuers froze roughly $2.5 billion to $3 billion in assets. TRM estimated about $2.4 billion was in assets, including ETH and bitcoin, that issuers could not freeze in the same way. These figures are estimates, and a freeze does not by itself establish that funds have been recovered or returned.
The scale also matters to the wider crypto market because the reported impact is large enough to prompt questions about custody controls, operational security and how quickly a major exchange can resume withdrawals. Comparisons with other incidents depend on final loss figures and consistent valuation methods; Binance’s estimate is not yet a confirmed measure of unrecoverable losses.
Popular right now
Roborock F25 Ultra Steam Wet Dry Vacuum Mop
Sony BRAVIA 5 85-Inch Mini LED 4K HDR Smart TV (K-85XR50)
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How Binance 14 Was Compromised
Binance attributed the incident to a possible compromise of a DevOps engineer’s laptop. In its account, that access may have allowed an attacker into a service container and enabled unauthorized withdrawal transactions. The company said it had found “no evidence of any wallet private key leak” and said a post-mortem would follow. That explanation is Binance’s preliminary account, not an independently established finding.
The Ethereum transaction used EIP-7702, a feature that lets an externally owned account authorize code to run on its behalf. According to Blockaid’s analysis, the transaction carried 50 pre-signed permissions tied to consecutive transaction numbers, or nonces, for Binance 14. One permission matched the wallet’s current nonce, allowing the attacker’s code to take control of the wallet’s activity. The remaining permissions did not match.
Public blockchain records show the large sweep at 20:24:23 UTC. Twenty-four seconds later, another Binance wallet sent 28,005.6 ETH to the same receiving address in an ordinary signed transaction. Binance’s wallets also sent funds on other chains, according to TRM Labs. The chronology and on-chain transfers are observable; they do not alone identify who operated the wallets or establish how the attacker gained access.
“The firm attributed the attack “with high confidence” to TraderTraitor, a group it links to North Korea.”
— TRM Labs
Losses and Attribution Still Open
The $6.3 billion figure is an estimated impact, not a confirmed final loss. The source reports differing estimates from Binance and analytics firms, while some assets were frozen. It remains unclear how much was permanently lost, how much can be recovered, and whether the reported totals count the same assets at the same prices and times.
Binance’s laptop and service-container explanation is preliminary. The company said it found no evidence of a private-key leak, but the available account does not establish how access was obtained or whether other systems were affected. A promised post-mortem had not yet been published in the supplied material.
TRM Labs’ attribution to TraderTraitor is also not a confirmed official finding. The source says neither Binance nor a government had confirmed the link. The destination and movement of funds may change as investigators and asset issuers continue to track them.
Withdrawal Resumption and Investigation
Binance said withdrawals would resume once the security issue was resolved. Yi He forecast that withdrawals would begin resuming within 48 hours of her Oct. 30 post, while Binance said deposits continued to operate normally. The source material does not confirm that withdrawals had restarted, so users should treat that timeline as an expectation rather than a completed step.
The next key developments are Binance’s promised post-mortem, a clearer accounting of funds frozen or recovered, and any updated estimate of the incident’s financial impact. Further information from blockchain investigators or authorities could also clarify how the attack was carried out and who was responsible.
Binance warned that withdrawals were paused, and the source advises customers to watch for scams posing as refunds or support. Any claim that a customer must pay a fee or share account credentials to recover funds should be treated with caution; the supplied information does not describe a Binance refund process.
Key Questions
How much was taken from Binance?
Binance estimated the incident’s total impact at about $6.3 billion. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion. The final unrecovered loss has not been established.
Were customer funds affected?
Binance said user funds are safe and that it would cover all losses. The company paused withdrawals while responding to the incident; the supplied material does not independently verify the exchange’s assurance.
How did the attacker move funds from Binance 14?
Blockaid said the transaction used EIP-7702 permissions to authorize code for Binance 14. One of 50 pre-signed permissions matched the wallet’s current transaction number, allowing the sweep, according to the firm’s analysis.
Were any of the assets frozen?
Yes. Binance and blockchain analysts reported that stablecoin issuers froze roughly $2.5 billion to $3 billion. Those estimates do not mean all the assets were recovered, and ETH and bitcoin cannot be frozen by an issuer in the same way.
Who was responsible for the attack?
TRM Labs attributed it “with high confidence” to TraderTraitor, which the firm links to North Korea. That attribution was not confirmed by Binance or a government in the supplied source material.
Source: ThorstenMeyerAI.com
