🔍 Read the full analysis: How The Binance Hack Unfolded, One Minute At A Time on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says attackers moved an estimated $6.3 billion in crypto from its wallets on October 29, 2026, including a major Ethereum hot-wallet sweep enabled by an EIP-7702 authorization. The estimate is preliminary, attribution to a North Korean-linked group is an analyst assessment, and Binance says it will cover losses while withdrawals remain suspended pending a restart.
Binance says an attack on October 29 affected about $6.3 billion in cryptocurrency held across its wallets, after an Ethereum hot wallet was given attacker-controlled code and assets were moved on several blockchains. The exchange says user funds are safe and it will cover losses; withdrawals were suspended as it investigated, with co-CEO Yi He saying they were expected to begin resuming within 48 hours of her October 30 post.
The clearest publicly traced movement came from an Ethereum wallet labelled Binance 14. At 20:20:59 UTC, a transaction carried 50 permissions tied to consecutive transaction numbers, or nonces, for that wallet. Blockchain security firm Blockaid reported that one permission matched the wallet’s current nonce. The wallet then executed attacker-supplied code.
At 20:24:23 UTC, Binance 14 sent 167,464 ETH, 1.615 billion USDT and 62 other tokens to a receiving wallet. The source article’s author says they checked the Ethereum transactions in the public record. Twenty-four seconds later, another Binance wallet sent 28,005.6 ETH to the same address in an ordinary signed transaction. Later movements included 195,460 ETH transferred to a new wallet at 20:38:47 UTC.
The Ethereum sweep was part of a wider incident. TRM Labs reported outflows from Binance wallets on as many as ten networks, including Bitcoin, Tron, the XRP Ledger and Solana, with many beginning around 20:05 UTC. Binance’s October 30 update put the estimated impact at about $6.3 billion. Other preliminary estimates differed: Blockaid reported at least $5.5 billion by 22:00 UTC, Arkham estimated $6.01 billion and TRM Labs about $6.36 billion. These figures depend on the assets counted, valuation time and prices used.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Frozen Assets and Paused Withdrawals
The incident matters both for the scale of the reported losses and for the effect on customers trying to access the exchange. Binance said deposits and withdrawals were suspended while it addressed the security issue. Yi He later said deposits continued to operate normally and that withdrawals were expected to begin resuming within 48 hours of her post; that was an expectation, not confirmation that withdrawals had restarted.
According to the source report, stablecoin issuers froze roughly $2.5 billion to $3 billion within hours. Issuers can freeze some tokens under their control, but ETH and bitcoin cannot be frozen by a token issuer. TRM estimated about $2.4 billion remained beyond issuer freezes. Those figures are estimates, and the amount ultimately recovered or inaccessible has not been established.
Binance said it would cover losses and that user funds were safe. That assurance is material for customers, but the public material provided here does not include a completed post-mortem or an independently verified accounting of the incident’s total financial impact.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell 24 Plus Monitor S2425HSM – 23.8 FHD (1920×1080) 144Hz 1ms, 2 x 3W Speakers, HDMI, Height/Tilt/Pivot/Swivel Adjustability, AMD FreeSync
As an affiliate, we earn on qualifying purchases.
The reported method involved EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. It allows an externally owned account to authorize code to run on its behalf. In practical terms, a valid authorization can let a wallet execute a program rather than only make a conventional transfer.
According to Blockaid’s analysis, the attacker submitted 50 signed permissions for consecutive nonces because Binance 14’s transaction number was changing. A permission only works for the matching nonce; one of the 50 was valid. The source report says this allowed the wallet to run the attacker’s code and transfer its holdings. This account of the mechanism comes from the security analysis and on-chain record, rather than a complete public technical post-mortem by Binance.
The preparation described in the source began before the main outflows. TRM and the report’s author say the operator wallet received three small withdrawals from Tornado Cash on October 28, tested sweeper code on small wallets the next day, then deployed and rehearsed a contract before the Binance transfers. Those steps are attributed to blockchain analysis and transaction records; they do not, by themselves, establish who operated the wallets.
“with high confidence”
— TRM Labs
Attribution and Losses Still Open
The final loss total is not settled. Binance’s roughly $6.3 billion estimate and the figures from Blockaid, Arkham and TRM are preliminary and differ in scope, timing and valuation. The source material does not establish how much of the affected value was ultimately recovered, frozen or permanently lost.
Binance said a compromised DevOps engineer’s laptop may have enabled an attacker to enter a service container and submit unauthorized withdrawal transactions. It also said it found no evidence of a wallet private-key leak. The company’s full post-mortem was still pending, so the precise access path and any security failures behind it remain unclear.
TRM Labs attributed the operation “with high confidence” to TraderTraitor, which it links to North Korea. That is an analyst assessment, not a confirmed finding from Binance or a government. The source material also does not provide a final account of which affected transfers were stopped or the amount customers may have lost.
Binance’s Restart and Investigation
Binance said it was investigating, had revoked the affected address authorization and would cover losses. Its co-CEO said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post. The source material does not confirm when withdrawals actually restarted, so that stated timeframe should not be read as a completed restoration.
The next substantive update is expected to include Binance’s post-mortem: how access was obtained, how the wallet authorizations and cross-chain transfers were executed, and what controls will change. Issuers and investigators may also provide further information about frozen assets and tracing. Until those updates are available, the attack’s final financial impact, recovery total and attribution remain open.
Key Questions
How much did the Binance attack affect?
Binance estimated the impact at about $6.3 billion on October 30, 2026. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion; the figures use different counting and valuation methods.
How did the Ethereum wallet get drained?
Blockaid reported that a transaction carried 50 EIP-7702 permissions for Binance 14, each tied to a consecutive nonce. One matched the wallet’s current nonce, allowing attacker-controlled code to run and move assets. Binance had not published a full post-mortem in the source material.
Were customer funds safe?
Binance said user funds were safe and that it would cover losses. Withdrawals were paused during the response, and the source material does not provide a completed independent accounting of the incident or a final recovery figure.
Who was responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That attribution was not confirmed by Binance or a government in the source material.
When were withdrawals expected to resume?
Co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post. The source material does not confirm that the restart occurred within that window.
Source: ThorstenMeyerAI.com
