🔍 Read the full analysis: How To Make Sense Of The Binance Hack’s Minute-by-Minute Events on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A Binance hot wallet was drained on Oct. 29, while other Binance wallets sent funds across several blockchains, according to on-chain records and blockchain analysts. Binance estimates the total impact at about $6.3 billion, says users’ funds are safe and is investigating how the wallets were accessed; the figure and cause remain preliminary.
On Oct. 29, 2026, an attacker drained Binance’s Ethereum hot wallet known as Binance 14 and funds moved from other Binance wallets across multiple blockchains. Binance put the estimated impact at about $6.3 billion in an Oct. 30 update, said users’ funds were safe and said it would cover losses; the total remains preliminary and the cause is still under investigation.
The clearest timestamp in the public Ethereum record is 20:24:23 UTC, when a transaction sent 167,464 ETH, 1.615 billion USDT and 62 other tokens from Binance 14 to a newly created wallet. Blockworks valued that transaction at about $2.5 billion. Twenty-four seconds later, a separate Binance wallet sent 28,005.6 ETH to the same destination in an ordinary signed transaction, according to the source’s review of the chain record.
Blockchain security firms describe activity before and after that transfer. TRM Labs reported outflows from Binance wallets on several chains beginning around 20:05 UTC, with many occurring within about 20 minutes. It also reported a later wave involving Avalanche and Polygon. The article’s author says the Ethereum transactions were checked against the public record; the multichain timeline and estimates are attributed to analysts.
Estimates vary by source and timing: Blockaid put the impact at at least $5.5 billion as of 22:00 UTC, Arkham at $6.01 billion, TRM at about $6.36 billion and Binance at around $6.3 billion. These are preliminary valuations, not a settled accounting. Binance said about $3 billion had been frozen by Oct. 30; the source reports that stablecoin issuers froze assets, while ETH and bitcoin cannot be frozen by issuers in the same way.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Wallet Outflows Spread
The incident matters because the reported loss spans multiple blockchains, and the disputed total is large enough to affect how customers, exchanges and regulators assess the risks of holding assets in centralized platforms. Binance said user funds were safe and that it would cover losses, but that assurance does not yet explain how the transactions were authorized or establish a final loss figure.
The reported freezes also show the difference between assets controlled by issuers and decentralized tokens. According to the source’s account of analyst estimates, roughly $2.5 billion to $3 billion was frozen, while about $2.4 billion in ETH and bitcoin was beyond issuer freeze controls. Those figures are estimates, and the amount ultimately recoverable remains unknown.
For customers, the immediate practical issue was service disruption: Binance said deposits and withdrawals were suspended while it addressed the incident. Co-CEO Yi He later said withdrawals were expected to begin resuming within 48 hours of her Oct. 30 post. Customers should treat unsolicited messages promising refunds or offering support cautiously; the source specifically warned that scams could exploit the incident.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
As an affiliate, we earn on qualifying purchases.
TRM Labs and Blockaid attributed the Ethereum wallet drain to the use of EIP-7702, a feature that lets an account authorize code to act on its behalf. The feature was introduced with Ethereum’s Pectra upgrade in May 2025. In this incident, Blockaid’s analysis says a transaction carried 50 pre-signed permissions for 50 consecutive transaction numbers, or nonces, associated with Binance 14. One matched the wallet’s current nonce, allowing the attacker’s code to run.
The source says the operator tested sweeper code on small wallets on Oct. 29, deployed the contract later that afternoon, and rehearsed it before the main outflows. At 20:38:47 UTC, 195,460 ETH moved to another newly created wallet. The source’s author reported that this destination had made no transactions by the morning of Oct. 30. These details describe a reconstruction from transaction records and analyst reports; they do not establish who operated the wallets.
Binance’s Oct. 30 update said a compromised DevOps engineer’s laptop may have allowed access to a service container used to submit unauthorized withdrawals. The company said it had found no evidence of a wallet private-key leak. TRM attributed the attack with high confidence to TraderTraitor, which it links to North Korea, but neither Binance nor a government had confirmed that attribution in the source material.
Open Questions on Cause and Losses
The final amount stolen, frozen or recoverable remains unsettled. The estimates range from at least $5.5 billion to about $6.36 billion and reflect different sources, timestamps and valuation methods. Binance’s approximately $6.3 billion figure is an estimate, not a completed audit of losses.
Binance has not yet published the post-mortem described in the source material. Its account of a potentially compromised laptop is not a confirmed explanation, and its statement that investigators found no evidence of a private-key leak leaves open how the attacker obtained valid authorizations. The source also reports TRM’s attribution to TraderTraitor, but that identification has not been independently confirmed by Binance or a government.
It is also not clear how much of the assets sent to attacker-controlled wallets will ultimately be recovered. Issuers froze some stablecoins, but the source says ETH and bitcoin cannot be frozen by those issuers. The reported frozen totals and the status of assets on different networks may change as investigators trace the funds.
Recovery and the Binance Post-Mortem
Binance said deposits and withdrawals had been suspended while the security issue was addressed. On Oct. 30, Yi He said withdrawals were expected to begin resuming within 48 hours of her post; the source does not confirm that service had resumed by the time of its report. The timing and scope of any reopening should be checked against Binance’s subsequent updates.
The next major development is the company’s promised fuller account of the incident. A post-mortem could clarify the authorization path, the role of the reported laptop and service container, the final loss calculation, and what changes Binance made to affected wallets. Until then, Binance’s estimates, analyst tracing and attribution claims should be treated as provisional.
Key Questions
What happened to Binance on Oct. 29?
A Binance Ethereum hot wallet known as Binance 14 was drained, while other Binance wallets sent funds across several blockchains, according to the source’s on-chain review and reports from blockchain analysts.
How much was taken?
Binance estimated the incident’s total impact at about $6.3 billion. Other reported estimates ranged from at least $5.5 billion to about $6.36 billion. The figures are preliminary and depend on valuation time and methodology.
How did the Ethereum wallet get drained?
Blockaid’s analysis says a transaction carried 50 pre-signed EIP-7702 permissions tied to consecutive wallet nonces; one matched the active nonce and allowed code to run. Binance has not yet published a final explanation of how those permissions were obtained.
Did Binance confirm who was responsible?
No. TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. The source says neither Binance nor a government had confirmed that attribution.
When were withdrawals expected to resume?
On Oct. 30, Binance co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. That was an expectation, not confirmation that withdrawals had already resumed.
Source: ThorstenMeyerAI.com
