🔍 Read the full analysis: What Happened At Binance The Evening Billions Left? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says a security incident on Oct. 29 caused an estimated $6.3 billion in outflows from its wallets across several blockchains. The exchange says customer funds are safe and it will cover losses; analysts report that issuers froze about $3 billion, while the total and attacker attribution remain unconfirmed.
Binance said a security incident on Oct. 29 led to an estimated $6.3 billion in outflows from its wallets across multiple blockchains, including a major Ethereum hot wallet emptied in a single transaction. The exchange says customer funds are safe and it will cover losses, but the reported total remains preliminary and the incident’s full cause has not been established publicly.
At 20:24 UTC on Oct. 29, a transaction transferred 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as “Binance 14” to a newly created address. Blockworks valued the transaction at about $2.5 billion. Public Ethereum records show that, 24 seconds later, another Binance wallet sent 28,005.6 ETH to the same receiving address.
Blockchain security firms reported that the outflows extended beyond Ethereum. TRM Labs said Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and other networks sent assets through signed transfers during the incident. TRM estimated the overall impact at about $6.36 billion; Binance put it at around $6.3 billion. Other estimates cited in the source report range from at least $5.5 billion to $6.01 billion, reflecting different counts and valuation times. These are preliminary estimates, not a final accounting.
Binance’s early Oct. 30 update said deposits and withdrawals were suspended while it investigated. The company said about $3 billion had been frozen, while separate estimates from analysts and Binance at earlier points in the evening were lower. Issuers including Circle and Tether announced freezes of some assets. The source report says roughly $2.4 billion in assets, including ETH and bitcoin, remained beyond issuer freeze controls; that figure is an analyst estimate, not a final recovery total.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
Customer Funds and Withdrawal Access
The incident matters because it combined a large hot-wallet outflow with disruption to customer access to the exchange. Binance said user funds were safe and that it would cover losses, but withdrawals were paused during the response. Co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her Oct. 30 post; that was a forecast, not confirmation that service had resumed.
The recovery picture also depends on which assets can be immobilized. Stablecoin issuers can freeze tokens they control, while assets such as ETH and bitcoin cannot be frozen by an issuer in the same way. The reported billions in freezes may limit the attacker’s access to some funds, but they do not establish how much will ultimately be recovered or whether the estimated loss will change.
For customers, the incident also creates a risk of follow-on fraud. The source report warns that scammers may impersonate Binance support or offer fake refunds. Users should rely on Binance’s official channels for service updates and treat unsolicited recovery offers with caution.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
FLEXISPOT Standing Desk with Monitor Riser & Cable Management
As an affiliate, we earn on qualifying purchases.
How the Ethereum Wallet Was Used
Binance attributed the incident in part to a possible compromise of a DevOps engineer’s laptop. In its account, that access may have allowed an attacker into a service container to submit unauthorized withdrawal transactions. Binance said it had found no evidence of a wallet private-key leak. The company’s wording is qualified: a full post-mortem had not yet been published in the source material.
The Ethereum portion involved EIP-7702, a feature that allows an externally owned account to authorize code to act on its behalf. Blockaid’s analysis, as described by the source report, found that one transaction carried 50 pre-signed permissions for consecutive transaction numbers, or nonces, associated with Binance 14. One matched the wallet’s current nonce, allowing the attacker’s code to run and move assets. The Ethereum upgrade containing EIP-7702 had been introduced with the Pectra upgrade in May 2025.
The timeline reported by the source begins before the large transfers. TRM and Blockworks said an operator wallet received small withdrawals from Tornado Cash on Oct. 28, and researchers observed tests of sweeping code on smaller wallets the next day. Those observations describe blockchain activity and analyst interpretation; they do not independently establish who controlled the wallets or why the transfers were made.
Losses, Attribution and Recovery
The final amount affected remains unsettled. Binance and several analytics firms gave estimates that differ, and the source report notes that those totals depend on which transfers were counted and the prices used. Binance’s early estimate of about $6.3 billion should not be treated as a confirmed final loss figure.
The attacker’s identity is also unresolved. TRM Labs attributed the activity with high confidence to TraderTraitor, which it associates with North Korea, but the source material says neither Binance nor a government confirmed that attribution. Binance’s explanation about a potentially compromised laptop is likewise a preliminary account, not a completed technical post-mortem.
It is not yet clear how much of the frozen assets will be returned, how much remains accessible to the attacker, or when all deposits and withdrawals will be restored. The source report says Binance had revoked the affected address authorization by the morning of Oct. 30, but that step does not by itself answer those broader questions.
Binance’s Investigation and Service Restart
Binance said it was investigating and would publish a post-mortem; the source material does not provide a date for that report. The next key updates are a fuller accounting of the outflows and freezes, an explanation of how unauthorized transactions were submitted, and confirmation of the status of customer withdrawals.
Yi He’s Oct. 30 statement anticipated that withdrawals would begin resuming within 48 hours. Readers should distinguish that estimate from a confirmed restoration notice. Binance’s subsequent service updates, along with independent blockchain monitoring and any findings from authorities, will help clarify how much was recovered and what controls changed after the incident.
Key Questions
How much did Binance say left its wallets?
Binance estimated the impact at about $6.3 billion in its early Oct. 30 update. Analysts reported different preliminary totals, so the final amount has not been established in the source material.
Was the Ethereum wallet emptied in one transaction?
A single transaction at 20:24 UTC on Oct. 29 moved 167,464 ETH, 1.615 billion USDT and 62 other tokens from the wallet labeled Binance 14. Other reported outflows occurred from Binance wallets on additional networks.
Did Binance say customer funds were lost?
No. Binance said user funds were safe and that it would cover losses. Withdrawals were suspended during the investigation, and the source report does not confirm the final loss or recovery amount.
Who does Binance say was responsible?
The source material does not report a confirmed public attribution from Binance. TRM Labs attributed the activity with high confidence to TraderTraitor, a group it links to North Korea, but that claim has not been confirmed by Binance or a government.
When were withdrawals expected to return?
On Oct. 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours. That was an expected timeframe, not confirmation that withdrawals had resumed.
Source: ThorstenMeyerAI.com
