🔍 Read the full analysis: Could The Binance Hack Timeline Answer What Happened To The Billions? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an October 29 security incident had an estimated impact of about $6.3 billion, while blockchain analysts traced rapid outflows across several networks. A timeline of public transactions shows how a permission on Ethereum enabled a major hot-wallet drain, but the total remains preliminary and the attacker’s identity has not been confirmed by Binance or a government.
Binance says a security incident on October 29 had an estimated impact of about $6.3 billion, after funds left several of its wallets across multiple blockchains. Public Ethereum records trace the largest reported movement to a hot wallet called Binance 14, which sent hundreds of thousands of ETH and more than $1.6 billion in USDT to a newly created wallet; the total and the full route of the funds remain under investigation.
The central Ethereum transaction took place at 20:24 UTC, according to the source’s review of the public ledger. It moved 167,464 ETH, 1.615 billion USDT and 62 other tokens. About 24 seconds later, another Binance wallet, labelled Binance 16, sent 28,005.6 ETH to the same receiving address in a separately signed transaction. Binance has said it will cover losses and that user funds are safe.
The incident was not limited to Ethereum. TRM Labs reported transfers from Binance wallets on Bitcoin, Tron, the XRP Ledger and Solana, as well as other networks. The source’s timeline places the first cross-chain outflows at about 20:05 UTC, with much of the activity occurring within roughly 20 minutes. A further wave involving Avalanche and Polygon was reported at about 23:05 UTC.
Published estimates differ because analysts counted at different times and used different valuations. Blockaid put the impact at at least $5.5 billion as of 22:00 UTC; Arkham estimated $6.01 billion, TRM about $6.36 billion, and Binance about $6.3 billion. These are preliminary estimates, not a final accounting. Binance said roughly $3 billion had been frozen, while the source reports that stablecoin issuers froze between $2.5 billion and $3 billion. Those freezes do not apply to ETH or bitcoin.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Drain Affects Binance Users
The reported scale makes this a major security and operational event for the world’s largest cryptocurrency exchange by trading volume, though the final loss figure is not settled. Binance said deposits and withdrawals were suspended while it addressed the incident. Its co-CEO Yi He said on October 30 that withdrawals were expected to begin resuming within 48 hours of her post; that was a forecast, not confirmation that service had resumed.
The incident also shows why a transaction-by-transaction timeline matters. Public records can establish when assets moved and where they were sent, but they do not, by themselves, identify who controlled the initiating systems or establish the attacker’s motive. A significant portion of the reported value was in assets whose issuers can freeze them, while other assets cannot be frozen through an issuer action. The funds’ eventual recovery and the lasting financial impact remain open questions.
For customers, Binance’s statement that user funds are safe is a company assurance, not a substitute for the exchange’s forthcoming accounting and technical review. The source also warns that users should be alert to fake refund and support messages exploiting the incident. No recovery procedure should be trusted solely because a message claims to come from Binance.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Ethereum Permission Sequence
The Ethereum drain involved EIP-7702, a feature introduced with the Pectra upgrade in May 2025. The source describes it as a signed authorization that lets an externally owned account run specified program code. In this case, Blockaid’s analysis found a transaction carrying 50 authorizations for consecutive transaction numbers, or nonces, associated with Binance 14. One authorization matched the wallet’s current nonce, allowing the attacker’s code to run, according to that analysis.
That explanation is based on the on-chain transaction and Blockaid’s interpretation; it does not independently explain how the authorization was obtained. The sequence described in the source began with small transfers to the operator wallet on October 28, followed the next day by tests of sweeper code and deployment of a contract. The main wallet drain came later that evening. Binance said its preliminary review found that a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals.
Binance also said it found no evidence of a wallet private-key leak. That is a statement about the company’s investigation at that point, not a conclusive explanation of how the attacker obtained the permissions or initiated transfers across multiple chains. Binance said it had revoked the affected address authorization by the morning of October 30.
The Unresolved Trail of Funds
The final amount stolen or affected is not established. Estimates range from at least $5.5 billion to about $6.36 billion in the cited reports, with Binance’s own estimate at about $6.3 billion. The source does not provide a final audited accounting or a complete reconciliation of assets, prices and transfers behind those totals.
It is also unclear how much of the reported value can ultimately be recovered. Stablecoin issuers announced freezes, but those actions do not cover ETH or bitcoin, and a freeze does not itself prove that funds have been returned to Binance. The source reported about $2.4 billion in assets beyond issuer freeze control, based on TRM’s count.
Binance’s account of a compromised laptop is preliminary. The precise access route, whether the same intrusion enabled activity across all affected chains, and the attacker’s identity have not been independently established in the material provided. TRM’s attribution to TraderTraitor is an analyst assessment; neither Binance nor a government had confirmed it. The source also notes that one wallet holding 195,460 ETH had not sent a transaction by the morning of October 30, but that observation does not establish what happened to the funds afterward.
Binance’s Post-Mortem and Service Resumption
Binance said withdrawals would resume once the security issue was resolved. On October 30, co-CEO Yi He said the exchange expected withdrawals to begin returning within the next 48 hours, while deposits were continuing to operate normally. The source does not confirm that withdrawals had resumed by the time of its account, so service status should be checked against Binance’s latest notices.
The next substantive milestone is Binance’s promised post-incident review, which could clarify how the attacker obtained the authorization, what controls failed, and how the exchange calculated its estimated impact. Further updates from blockchain analysts and stablecoin issuers may also establish whether frozen funds are returned or moved. Until those details are published, the timeline can show the visible transfers, but not settle the full cause, attribution or recovery outcome.
Key Questions
How much did Binance say the incident affected?
Binance estimated an impact of about $6.3 billion in its October 30 update. Other preliminary estimates cited in the source ranged from at least $5.5 billion to about $6.36 billion, so the total was not final.
What happened to Binance 14?
Public Ethereum records show Binance 14 sent 167,464 ETH, 1.615 billion USDT and 62 other tokens to a new wallet at about 20:24 UTC on October 29. Blockaid’s analysis says an EIP-7702 authorization enabled the wallet to run the attacker’s code.
Were customer funds safe?
Binance said user funds were safe and that it would cover losses. The incident nevertheless led to suspended withdrawals while the exchange investigated. The source does not provide an independent audit of Binance’s assurance.
Who was responsible for the attack?
TRM Labs attributed the activity with high confidence to TraderTraitor, which it links to North Korea. That remains an analyst attribution: the source says Binance and government authorities had not confirmed it.
When were withdrawals expected to resume?
On October 30, Binance co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours of her post. The source does not confirm that the service had resumed, so the timing was an expectation rather than a completed milestone.
Source: ThorstenMeyerAI.com
