🔍 Read the full analysis: What The Binance Hack Timeline Shows—and What It Doesn’t on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
On Oct. 29, an attacker used an Ethereum wallet authorization to take control of Binance hot wallet Binance 14 and move assets, while outflows also occurred from Binance wallets on other networks. Binance estimates the impact at about $6.3 billion and says user funds are safe, but totals remain preliminary and the proposed North Korean link has not been confirmed by Binance or any government.
Binance reported an estimated $6.3 billion impact from an attack that began on Oct. 29, when a transaction changed the code authorization for its Ethereum hot wallet, Binance 14, before assets were swept out. Blockchain records and reports by security firms also show outflows from Binance-linked wallets on other networks, but the total remains preliminary and the attacker’s identity has not been independently confirmed.
At 20:20 UTC, a transaction carried 50 permissions tied to consecutive transaction numbers for Binance 14; security firm Blockaid reported that one matched the wallet’s current number. The authorization let the wallet run attacker-controlled code. At 20:24, the wallet sent 167,464 ETH, 1.615 billion USDT and 62 other tokens to a newly created address. A separate Binance wallet sent 28,005.6 ETH to the same address 24 seconds later, according to the public Ethereum record described in the source report.
Outflows from Binance wallets began on several blockchains around 20:05 UTC, with another reported wave on Avalanche and Polygon later in the evening. TRM Labs said transfers on Bitcoin, Tron, the XRP Ledger, Solana and other networks used ordinary signed transactions. The source report places losses at different preliminary estimates: Blockaid counted at least $5.5 billion, Arkham about $6.01 billion, TRM about $6.36 billion and Binance about $6.3 billion. These figures use different counting times and prices.
Binance said it had found that a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. The company said it had found no evidence of a wallet private-key leak. Binance also said it had revoked the affected address authorization and that user funds were safe, with the company covering losses. Stablecoin issuers froze assets; Binance’s reported frozen amount was about $3 billion, while the source cites a verified total of $2.54 billion earlier in the evening.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
The Scale and Reach of the Outflows
The reported scale matters because Binance is a major exchange holding assets in wallets that support customer activity. A multichain incident can affect more than one network and complicate efforts to trace, contain or reconcile transfers. Yet the headline estimate should not be read as a final audited loss: the counts differ, and the values depend on the time and prices used.
Freezes can limit access to certain stablecoins when their issuers act, but they do not apply to every asset. The source report says about $2.4 billion was beyond issuer freeze controls, including ETH and bitcoin. That distinction helps explain why a frozen total is not the same as a recovered total. Binance’s assurance that users are protected addresses customer exposure, but does not by itself establish how much was recovered or how the incident occurred.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
The central Ethereum event involved EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025. It allows an externally owned account to authorize code to act for it. In the account given by the source report, the authorization remains active until replaced or revoked, making control of the signing process important.
Blockaid’s analysis says the transaction included 50 permissions for consecutive nonce values, or transaction numbers, because the attacker could not know which number Binance 14 would be using at that moment. One permission matched. The public Ethereum record showed the subsequent transfer, while the source’s wider timeline draws on Binance updates and reports from TRM Labs and Blockaid. Binance said the affected authorization had been revoked by the morning of Oct. 30.
Binance first acknowledged reports of a potential security issue at 21:29 UTC on Oct. 29. It later said withdrawals would resume once the issue was resolved. The company’s Oct. 30 incident update put the estimated impact near $6.3 billion and said deposits and withdrawals were suspended. Co-CEO Yi He later said withdrawals were expected to begin resuming within 48 hours of her post.
Loss Totals and Attribution Remain Open
The final financial impact is not settled. Binance’s estimate of about $6.3 billion is close to TRM’s roughly $6.36 billion figure, but other firms reported lower amounts. The available account does not reconcile each estimate asset by asset or establish a final net loss after freezes, recoveries or subsequent movement of funds.
Binance said a compromised laptop may have been involved, while also stating it found no evidence of a private-key leak. The company’s full post-mortem had not yet been released in the source material, leaving unanswered how access was obtained, what systems were affected and whether the laptop theory will be substantiated. TRM’s attribution to TraderTraitor is an assessment, not a confirmed finding; neither Binance nor a government had confirmed it.
It is also unclear from the material whether all affected wallets and networks have been fully accounted for, how much frozen value can be returned, or when normal withdrawals would be restored. The fact that one new wallet holding a large ETH balance had not sent a transaction by the morning of Oct. 30 is a time-specific observation, not proof that the assets remain there now.
Post-Mortem and Withdrawal Resumption
The next key developments are Binance’s full incident review and the restoration of customer withdrawals. Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post; the source material does not confirm that this occurred. Binance’s subsequent notices will clarify whether services return on that schedule and whether restrictions differ by network.
Readers should also look for a reconciled loss figure, details on the frozen assets and any confirmed recovery. Until Binance publishes its post-mortem or investigators provide further evidence, explanations of the intrusion and claims about who carried it out should remain attributed rather than treated as established fact.
Key Questions
How did the attacker access Binance 14?
Blockaid said a transaction used one valid authorization among 50 consecutive EIP-7702 permissions, allowing Binance 14 to run attacker-controlled code. Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container. The company’s full technical account was not yet available.
How much was taken?
Binance estimated the impact at about $6.3 billion. Estimates from firms cited in the source ranged from at least $5.5 billion to about $6.36 billion. They are preliminary and differ by counting time and asset prices.
Were customer funds affected?
Binance said user funds are safe and that it would cover losses. The source material does not provide an independent audit of that assurance or a final account of recoveries and losses.
Who is suspected of carrying out the attack?
TRM Labs attributed the attack with high confidence to TraderTraitor, a group it links to North Korea. That remains an attributed security-firm assessment; Binance and government authorities had not confirmed it in the cited material.
When were withdrawals expected to resume?
Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within the next 48 hours of her post. The source does not confirm whether that timetable was met.
Source: ThorstenMeyerAI.com
