🔍 Read the full analysis: The Binance Hack: How Events Unfolded And What’s Still Unknown on ThorstenMeyerAI.com
TL;DR
Binance reported an attack affecting about $6.3 billion in assets across its wallets on Oct. 29, 2026, and said it would cover user losses. Blockchain analysts described an Ethereum wallet takeover using EIP-7702 alongside transfers from wallets on other networks; the attack method’s full scope, the attacker’s identity and the final loss figure remain unconfirmed.
Binance said an attack affected about $6.3 billion in assets across its cryptocurrency wallets on Oct. 29, 2026, after a transaction took control of a major Ethereum hot wallet and funds moved from other Binance wallets. The exchange said user funds are safe and it will cover losses, but the total impact is preliminary, withdrawals were suspended, and the attacker’s identity has not been independently confirmed.
The most visible transaction came at 20:24 UTC on Oct. 29, when 167,464 ETH, 1.615 billion USDT and 62 other tokens left a wallet identified as Binance 14. Blockworks valued the transaction at roughly $2.5 billion. Public Ethereum records show that funds went to a newly created receiving wallet. Binance 16 sent another 28,005.6 ETH to the same address 24 seconds later.
Blockchain security firms described activity beyond Ethereum. TRM Labs reported transfers from Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks. It said outflows began around 20:05 UTC, with a later wave involving Avalanche and Polygon. These are analysts’ findings; the source report does not provide a complete, independently verified accounting of every transfer.
The stated totals differ by source and time of estimate. Blockaid put the impact at at least $5.5 billion as of 22:00 UTC, Arkham estimated $6.01 billion, TRM about $6.36 billion, and Binance about $6.3 billion. The source report says stablecoin issuers froze roughly $2.5 billion to $3 billion. Binance’s Oct. 30 update put the frozen amount at about $3 billion. These figures are preliminary and should not be treated as a final loss calculation.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
User Funds and Frozen Assets
The incident matters because it involved large-scale movement of customer-facing exchange assets and led Binance to suspend deposits and withdrawals while it investigated. The exchange’s promise to cover losses is a statement about its response; the available material does not provide a completed accounting or independent verification of the eventual financial impact.
Freezing some assets may limit what an attacker can move, but it does not apply equally across crypto networks. The source report says issuers froze stablecoins, while ETH and bitcoin cannot be frozen by an issuer. TRM estimated about $2.4 billion remained beyond any issuer’s ability to freeze. That figure, too, is an analyst estimate rather than a final measure of recoverable funds.
The disruption also has practical consequences for customers. Binance said withdrawals would resume once the security issue was resolved, and co-CEO Yi He later said they were expected to begin resuming within 48 hours of her Oct. 30 post. Until the exchange confirms services are restored, customers should distinguish official updates from unsolicited messages claiming to offer refunds or support.
Popular right now
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
Ninja CREAMi 7-in-1 Ice Cream Maker, NC299AMZ
Ninja Foodi DualZone 10-Qt Air Fryer, 6-in-1, Black (DZ302)
As an affiliate, we earn on qualifying purchases.
How the Wallet Was Taken Over
The source report says the attacker used Ethereum’s EIP-7702 feature to make Binance 14 execute attacker-controlled code. The feature allows an externally owned account to authorize code to run for it. According to Blockaid’s analysis, a single transaction carried 50 pre-signed permissions tied to consecutive transaction numbers, or nonces. One matched the wallet’s current nonce and was accepted.
On-chain records cited in the report show preparation before the main transfer: the operator wallet received three small withdrawals from Tornado Cash on Oct. 28; the attacker tested code on smaller wallets on Oct. 29; and a contract was deployed and rehearsed before the Binance 14 transaction. These details describe the reported on-chain sequence, but do not by themselves establish who controlled the operator wallet or how the attacker obtained authorization.
Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. It also said it found no evidence of a wallet private-key leak. The company had not yet published the promised post-mortem in the source material, leaving the reported laptop theory unconfirmed as a full explanation.
The Attacker and Final Loss
The final amount affected and the amount ultimately lost remain unclear. Estimates range from $5.5 billion to about $6.36 billion, with different firms and Binance reporting at different times and using their own calculations. The source material does not establish how much was recovered, frozen permanently or moved beyond recovery.
TRM Labs attributed the attack with “high confidence” to TraderTraitor, a group it links to North Korea. That attribution has not been confirmed by Binance or a government, according to the source material. Binance’s possible laptop-and-service-container explanation also remains subject to its forthcoming post-mortem; it is not yet clear whether it accounts for activity across all the affected networks.
The material reports that Binance had revoked the affected address authorization by the morning of Oct. 30, and that Binance 14 no longer ran the attacker’s code. It does not settle how access was obtained, whether other systems were affected, or whether the paused services would restart on the timetable given by Yi He.
Post-Mortem and Withdrawal Restart
The next key developments are Binance’s full incident post-mortem, a clearer reconciliation of the competing asset totals, and confirmation of whether frozen funds can be returned. Binance also needs to provide an operational update on deposits and withdrawals. Yi He’s Oct. 30 estimate was that withdrawals would begin resuming within 48 hours of her post; it was an expectation, not confirmation of a completed restart.
Customers should rely on Binance’s official channels for service notices and avoid sharing credentials or paying anyone who claims to arrange a refund. The source report warns that scam messages may pose as support or recovery offers. The incident’s full scope and recovery outlook remain developing until the exchange and relevant investigators publish further findings.
Key Questions
When did the Binance incident happen?
The major Ethereum transaction occurred at 20:24 UTC on Oct. 29, 2026. The source report says outflows from Binance wallets on several networks began around 20:05 UTC, with additional activity later that evening.
How much was affected?
Binance estimated the impact at about $6.3 billion. Other preliminary estimates cited in the source range from $5.5 billion to about $6.36 billion, so the final figure is not established.
Did Binance say customers would lose their funds?
No. Binance said user funds were safe and it would cover losses. That is the exchange’s stated position; the source material does not include a final independent accounting of losses or recoveries.
How did the attacker move funds from Binance 14?
Blockaid’s analysis says a transaction used EIP-7702 permissions to authorize attacker-controlled code for the Ethereum wallet. The precise route by which the attacker obtained the ability to submit those permissions remains under investigation.
Has Binance confirmed who was responsible?
No. TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea, but the source says neither Binance nor a government confirmed that attribution.
Source: ThorstenMeyerAI.com
