🔍 Read the full analysis: What We Know About The Evening Billions Left Binance on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an Oct. 29 security incident affected about $6.3 billion in assets across its wallets, while stablecoin issuers froze about $3 billion. The exchange says user funds are safe and it will cover losses, but the total loss, attack attribution and full technical cause have not been independently confirmed.
The clearest early transaction occurred at 20:24 UTC on Oct. 29, when a wallet labeled Binance 14 sent 167,464 ETH, 1.615 billion USDT and 62 other tokens to a newly created address, according to the public Ethereum record cited by ThorstenMeyerAI.com. Blockworks valued that transfer at about $2.5 billion. Other transfers followed, including a 28,005.6 ETH transaction from Binance 16 about 24 seconds later.
Binance’s estimate of roughly $6.3 billion in impact covers activity across multiple chains and is not a confirmed final loss figure. Early estimates differed: Blockaid put the amount at at least $5.5 billion as of 22:00 UTC, Arkham at $6.01 billion and TRM Labs at about $6.36 billion. The source material describes these as preliminary estimates using different counting times and prices, so they should not be treated as directly comparable final totals.
Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. The company said it found “no evidence of any wallet private key leak.” Its detailed post-mortem had not yet been released. Binance also reported that about $3 billion had been frozen by the morning of Oct. 30; the amount and the assets still beyond recovery remained subject to verification.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale of the Wallet Outflows
The incident matters because it affected a major exchange’s operational wallets across multiple blockchain networks, not just one Ethereum address. The reported total is a preliminary estimate, but at roughly $6.3 billion it would rank among the largest crypto thefts if confirmed as stolen funds. Binance’s comparison with the 2025 Bybit hack depends on the final accounting and should not be treated as settled.
For customers, the immediate impact was service disruption: Binance said deposits and withdrawals were suspended as its teams responded. The company said user balances were safe and it would absorb losses, but customers were still waiting for withdrawals to resume. The episode also highlights a distinction between assets that issuers can freeze and decentralized assets such as ETH and bitcoin, which cannot be frozen by a stablecoin issuer in the same way.
The uncertainty around the cause also has wider implications. If the laptop and service-container account is borne out, the incident would involve access to systems that submit transactions, even though Binance reported no evidence that wallet private keys themselves were exposed. That distinction is central to understanding how the transfers were authorized and what controls may need review.
Products Worth Considering
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
As an affiliate, we earn on qualifying purchases.
How the Ethereum Wallet Was Used
According to the source’s account of Binance statements and reports from blockchain firms, transfers from Binance wallets began at about 20:05 UTC on Oct. 29. At 20:20:59, one Ethereum transaction carried 50 EIP-7702 permissions for Binance 14. Blockaid’s analysis, as reported in the source, says one permission matched the wallet’s current transaction number, allowing attacker-controlled code to run. The subsequent sweep was recorded at 20:24:23.
EIP-7702 is an Ethereum feature introduced with the Pectra upgrade in May 2025. In simplified terms, it lets an account authorize code to act on its behalf. The source says the transaction contained permissions tied to 50 consecutive nonce values; one matched the wallet’s current nonce. This explanation is attributed to Blockaid’s analysis and the source’s review of public Ethereum records, rather than a completed Binance forensic report.
TRM Labs reported transfers from wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks. The source also reports that stablecoin issuers, including Circle and Tether, announced freezes later that evening, followed by other issuers. Binance’s Oct. 30 update put the frozen amount at about $3 billion; earlier figures in the source included a verified total of $2.54 billion around 23:30 UTC.
Losses and Attribution Still Unsettled
The final amount lost or recovered was not established in the source material. The estimates ranged from at least $5.5 billion to about $6.36 billion, and Binance’s roughly $6.3 billion figure was described as estimated impact. Frozen assets are not necessarily equivalent to recovered funds, and the source does not provide a final accounting of what remained under attacker control.
TRM Labs attributed the attack with “high confidence” to TraderTraitor, a group it links to North Korea. That attribution was not confirmed by Binance or a government in the material provided. The reported use of Tornado Cash by the operator wallet and the observed transaction pattern do not, on their own, establish who carried out the attack.
Binance had not released its full post-mortem, and the precise relationship between the reported laptop compromise, service-container access and transfers on other networks was still unclear. The source reports that Binance 14 no longer ran the attacker’s code by the morning of Oct. 30, after the exchange said it had revoked the affected address authorization.
Withdrawal Recovery and the Post-Mortem
Binance co-CEO Yi He said on Oct. 30 that deposits continued to operate normally and withdrawals were expected to begin resuming within 48 hours of her post. That was a forecast; the source material does not confirm that withdrawals had resumed. Binance said service restoration depended on resolving the security issue.
The next key development is a technical post-mortem explaining how access was obtained, which systems and wallets were affected, and how Binance reached its impact estimate. A fuller accounting of frozen, recovered and unrecoverable assets would help establish the financial consequences. Independent confirmation of the reported attacker attribution is also outstanding.
Customers should rely on Binance’s official channels for service updates. The source warns that scams posing as refunds or customer support may appear after a high-profile incident. There was no confirmed refund process described in the material; users should treat unsolicited recovery offers as unverified.
Key Questions
How much money left Binance?
Binance estimated an impact of about $6.3 billion. Preliminary estimates from blockchain firms ranged from at least $5.5 billion to about $6.36 billion. The figures used different timing and pricing, and a final loss total was not available.
Did Binance say customer funds were safe?
Yes. Binance said user funds were safe and that it would cover losses. The source material does not include a completed independent audit or final post-mortem confirming the full accounting.
How was Binance 14 compromised?
Binance said a compromised DevOps engineer’s laptop may have provided access to a service container used to submit unauthorized withdrawals. The exchange said it found no evidence of a wallet private key leak. Its full explanation was still pending.
Who does TRM Labs say was responsible?
TRM Labs attributed the incident with “high confidence” to TraderTraitor, a group it links to North Korea. Binance and government authorities had not confirmed that attribution in the source material.
When would withdrawals resume?
Binance co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. This was an expected timeframe, not confirmation that withdrawals had restarted.
Source: ThorstenMeyerAI.com
