🔍 Read the full analysis: Billions Left Binance In One Evening: Here’s The Timeline on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says a security incident on October 29 caused an estimated $6.3 billion in outflows from its wallets across multiple blockchains. Blockchain analysts report that stablecoin issuers froze about $3 billion, while Binance says users’ funds are safe and it will cover losses. The figures remain preliminary, and the exchange has not released its promised post-mortem.
Binance said on October 30 that a security incident the previous evening had an estimated total impact of about $6.3 billion, after cryptocurrency moved out of its wallets across several blockchains. The company said user funds are safe and it will cover losses; the total remains preliminary, and Binance has not yet published a full post-mortem.
The largest reported movement came at 20:24 UTC on October 29, when a transaction swept 167,464 ETH, 1.615 billion USDT and 62 other tokens from a Binance hot wallet identified as Binance 14. Blockworks valued that transaction at roughly $2.5 billion. A separate transfer of 28,005.6 ETH from another Binance wallet followed 24 seconds later, according to the public Ethereum record cited in the source report.
Outflows had begun across several networks at about 20:05 UTC, according to blockchain security firm TRM Labs. TRM said Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks also sent assets to the attacker through signed transfers. A second wave involving Avalanche and Polygon was reported at about 23:05 UTC. The timing and totals vary by analyst and valuation method: Blockaid put the impact at at least $5.5 billion at 22:00 UTC, Arkham at $6.01 billion, and TRM at about $6.36 billion. Binance’s estimate was about $6.3 billion.
Binance’s October 30 update said it had found that a DevOps engineer’s compromised laptop may have enabled access to a service container used to submit unauthorized withdrawal transactions. The company said it had found no evidence that a wallet private key was leaked. Binance also said it revoked the affected address authorization. Deposits and withdrawals were suspended during the response; co-CEO Yi He later said withdrawals were expected to begin resuming within 48 hours of her October 30 post.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Frozen Funds and User Access
The incident matters because it involved very large outflows from an exchange that serves customers globally, and because Binance’s own estimate places the impact among the largest reported crypto thefts. The source report compares the preliminary $6.3 billion figure with the $1.5 billion Bybit hack of February 2025, but the Binance figure is not yet final and the comparison depends on how losses are counted and valued.
Some assets may be recoverable or unusable by the attacker. The source report says stablecoin issuers froze roughly $2.5 billion to $3 billion within hours, with Binance putting the verified frozen amount at $2.54 billion around 23:30 UTC. Issuers can freeze some stablecoins, but the report says ETH and bitcoin cannot be frozen in the same way; TRM estimated about $2.4 billion was beyond issuer freezing. Those are separate preliminary assessments, not a final accounting of recovered funds.
For customers, the immediate practical issue is access: Binance paused withdrawals while investigating. The company’s assurance that user funds are safe and its pledge to cover losses are important statements, but customers still need clear information about when normal withdrawals resume and how the company will account for the incident.
Products Worth Considering
Sonos Era 100 SL Compact, Microphone-Free Speaker – Black
DJI Mini 5 Pro Fly More Combo Plus with DJI RC 2
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
How the Wallet Was Redirected
The central transaction used Ethereum’s EIP-7702 feature, according to the source report’s account of analysis by Blockaid and the public chain record. EIP-7702 allows an externally owned account to authorize code to act for it. In this case, the report says a transaction included 50 pre-signed permissions tied to consecutive transaction numbers, or nonces, for Binance 14. One permission matched the wallet’s current nonce, allowing the attacker’s code to run and sweep assets.
The report places preparatory activity before the main outflows. On October 28, the attacker’s operator wallet received three small withdrawals from Tornado Cash, according to TRM and Blockworks. On October 29, the operator tested sweeper code on small wallets, then deployed and rehearsed a contract. The source says Binance 14’s code was redirected at 20:20:59 UTC, followed by the major sweep at 20:24:23 UTC. These details come from the source report’s review of on-chain data and attributed security-firm analysis.
Binance first acknowledged reports of a potential security issue in a post on X at 21:29 UTC on October 29, saying it was investigating and that user funds were safe. At 22:15 UTC, it said withdrawals would resume once the issue was resolved. Its fuller incident update followed at 02:23 UTC on October 30.
Open Questions on Attribution and Losses
The final financial impact is not settled. Binance and several analytics firms published different estimates, reflecting different cut-off times, asset prices and counting methods. The source report describes all the figures as preliminary; it does not establish how much was ultimately recovered, how much remained accessible to the attacker, or whether every reported outflow represents a realized loss.
Binance’s explanation of the suspected laptop and service-container access remains provisional. The company said it found no evidence of a wallet private key leak, but has not released its promised post-mortem detailing how the unauthorized transactions were approved, what systems were affected, or what security changes followed. It is also not clear from the supplied material when all customer withdrawals returned to normal.
TRM Labs attributed the attack with “high confidence” to TraderTraitor, a group it links to North Korea. That attribution has not been confirmed by Binance or a government in the source material, so it should be treated as an analyst assessment rather than an established finding.
Post-Mortem and Withdrawal Status
The next developments to watch are Binance’s full post-mortem, a finalized loss and recovery accounting, and confirmation of normal withdrawal service. Yi He’s October 30 statement set an expectation that withdrawals would begin resuming within 48 hours of her post; it did not confirm that the process was complete. Binance’s later service updates will determine whether that timeline was met.
Further on-chain tracing and updates from stablecoin issuers may clarify which assets were frozen and whether any additional funds can be contained. The source report also warns customers to be alert for scams posing as refunds or support. Binance had not, in the material provided, published a detailed customer reimbursement process beyond saying user funds were safe and it would cover losses.
Key Questions
How much did Binance say was affected?
Binance estimated an impact of about $6.3 billion in its October 30 update. That is a preliminary estimate, not a final confirmed loss. Analysts’ figures ranged from at least $5.5 billion to about $6.36 billion in the source report.
What happened to the Binance 14 wallet?
According to the source report’s account of the on-chain record and Blockaid analysis, an EIP-7702 authorization allowed attacker-controlled code to act for Binance 14. The wallet then sent out 167,464 ETH, 1.615 billion USDT and 62 other tokens in a transaction at 20:24 UTC on October 29.
Were Binance customer funds safe?
Binance said user funds are safe and that it would cover losses. Those are the company’s assurances; the supplied material does not include a final post-mortem or a complete accounting of the incident’s financial effects.
How much money was frozen?
The source report says stablecoin issuers froze roughly $2.5 billion to $3 billion. Binance put the verified frozen total at $2.54 billion around 23:30 UTC on October 29. The figures are preliminary, and some assets, including ETH and bitcoin, cannot be frozen by stablecoin issuers.
Has Binance confirmed who carried out the attack?
No. TRM Labs attributed the incident with high confidence to TraderTraitor, which it links to North Korea, but the supplied material says neither Binance nor a government confirmed that attribution.
Source: ThorstenMeyerAI.com
