🔍 Read the full analysis: How Billions Moved Out Of Binance—and What’s Still Unclear on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Binance says an attack on Oct. 29 caused an estimated $6.3 billion in outflows across multiple blockchains, and that users’ funds are safe and it will cover losses. Stablecoin issuers froze about $3 billion, but the total remains preliminary; Binance has not released its full post-mortem, and attribution to North Korea-linked actors is an analyst assessment, not an official finding.
Binance reported an estimated $6.3 billion in impact from a multi-chain attack that began on Oct. 29, when an Ethereum transaction emptied a major exchange hot wallet and funds moved from other Binance wallets. The company said user funds are safe and it will cover losses; the reported total is preliminary, and the full cause and destination of the funds remain under investigation.
At 20:24 UTC on Oct. 29, a transaction sent 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14 to a newly created address. Blockworks valued that transaction at about $2.5 billion. On-chain records also show another Binance wallet sending 28,005.6 ETH to the same recipient 24 seconds later. Further outflows followed, including from wallets on other networks.
The overall estimate varies by source and time of measurement. Binance put the estimated impact at about $6.3 billion in an update on Oct. 30. TRM Labs estimated about $6.36 billion, Arkham about $6.01 billion, and Blockaid reported at least $5.5 billion as of 22:00 UTC on Oct. 29. These are preliminary estimates, not a final accounting of net losses. Binance said about $3 billion had been frozen; earlier reporting put the verified frozen amount at $2.54 billion.
Binance said deposits and withdrawals were suspended while it responded. Co-CEO Yi He said on Oct. 30 that withdrawals were expected to begin resuming within 48 hours of her post. Binance also said its investigation found that a compromised DevOps engineer’s laptop may have allowed access to a service container used to submit unauthorized withdrawal transactions. The company said it had found no evidence that a wallet private key was leaked.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
What the Outflows Mean for Binance Users
The incident puts a large amount of customer-facing exchange infrastructure under scrutiny because hot wallets hold assets used for operational transactions and are connected to systems that can authorize transfers. Binance’s statement that it will cover losses is relevant to customers, but the final scale of the loss and the accounting for recovered or frozen assets have not yet been independently settled.
Freezes can limit the movement of some assets, but they do not apply uniformly. Stablecoin issuers can freeze tokens they control under their systems; ETH and bitcoin cannot be frozen by a single issuer. TRM Labs estimated about $2.4 billion was beyond any issuer’s ability to freeze. That difference makes the ongoing tracing effort important to potential recovery, while leaving the eventual recoverable amount uncertain.
The disruption also matters to users who need access to deposits or withdrawals. Binance said deposits were operating normally, but withdrawals remained paused as the company worked on the security issue. Customers should rely on the exchange’s official channels for status updates and treat unsolicited messages offering refunds or recovery help with caution; the source material warns that scams may impersonate support.
Popular right now
Dyson Car+Boat Cordless Handheld Vacuum
Ninja Foodi DualZone 10-Qt Air Fryer, 6-in-1, Black (DZ302)
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How the Wallet Permission Was Used
Public Ethereum records and analyses by Blockaid and TRM Labs describe a sequence that started before the large transfers. The operator wallet received three small withdrawals from Tornado Cash on Oct. 28, according to those analysts. On Oct. 29, it tested code on smaller wallets, then deployed a contract and rehearsed with it before the main outflows began at about 20:05 UTC.
Blockaid’s analysis says a transaction at 20:20:59 carried 50 EIP-7702 permissions for Binance 14, each tied to a consecutive transaction number, or nonce. One permission matched the wallet’s current number and caused it to run the attacker’s code. EIP-7702, introduced as part of Ethereum’s Pectra upgrade in May 2025, allows an externally owned account to authorize code to act for it. The precise security failure that let the attacker submit the permission is still being investigated.
Outflows then appeared across several networks. TRM Labs reported transfers involving Bitcoin, Tron, the XRP Ledger, Solana and smaller networks, in addition to Ethereum. A second wave involving Avalanche and Polygon wallets was reported later that evening. Binance said it revoked the affected address authorization by the morning of Oct. 30, and the wallet no longer ran the attacker’s code.
The Losses and Attribution Remain Open
The $6.3 billion figure is an estimate, and the sources cited use different values and measurement times. It is not yet clear how much represents assets ultimately lost rather than moved, frozen or otherwise recoverable. Binance has not released the full post-mortem or a final reconciliation of affected wallets and assets.
The specific route into Binance’s systems also remains unconfirmed. Binance said the laptop issue may have enabled access to a service container and reported no evidence of a private-key leak, but it has not explained how the permission was generated or who authorized the relevant transactions. TRM Labs attributed the activity with high confidence to TraderTraitor, a group it links to North Korea; neither Binance nor a government has confirmed that attribution.
It is also unclear how much of the frozen stablecoin value will be returned or how quickly affected services will be fully restored. The reported estimate of roughly $3 billion frozen is not the same as a confirmed recovery, and assets such as ETH and bitcoin are not subject to issuer freezes.
Forensics and Withdrawals Remain Ahead
Binance’s next stated milestones are to resolve the security issue, resume withdrawals and publish further findings. Yi He’s Oct. 30 estimate put the start of withdrawal resumptions within 48 hours of her post; that was a forecast, not confirmation of a completed restart. Users should check Binance’s official updates for changes to service availability.
The exchange’s promised post-mortem should clarify how the attacker obtained the ability to submit the permissions, which systems and wallets were affected, and how Binance calculated the impact. Investigators and blockchain analysts may also update estimates as they trace transfers and confirm which assets remain frozen or recoverable. Until those details are available, the total loss, recovery outcome and responsibility for the attack remain unresolved.
Key Questions
How much money moved out of Binance?
Binance estimated the incident’s impact at about $6.3 billion in its Oct. 30 update. Other preliminary estimates ranged from at least $5.5 billion to about $6.36 billion, depending on the source and measurement time. A final loss figure has not been established.
Did Binance say customer funds are safe?
Yes. Binance said user funds are safe and that it will cover losses. That is the company’s assurance; its full post-incident accounting and investigation have not yet been published.
How did the Ethereum wallet get emptied?
Blockaid’s analysis says a transaction carried 50 EIP-7702 permissions for Binance 14, with one matching the wallet’s current transaction number. That permission allowed the wallet to run attacker-controlled code, which was then used to move assets. Binance has not yet published a full technical post-mortem confirming how the permission was obtained.
Were any of the funds frozen?
Binance reported about $3 billion frozen, while an earlier verified figure was $2.54 billion. Stablecoin issuers announced freezes, but the frozen amount is not necessarily the amount recovered. ETH and bitcoin cannot be frozen by a token issuer.
Who is believed to be responsible?
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. That attribution has not been confirmed by Binance or a government, so it remains an analyst assessment.
Source: ThorstenMeyerAI.com
