🔍 Read the full analysis: What The Minute-by-Minute Binance Hack Timeline Reveals on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says an attack on Oct. 29 had an estimated impact of about $6.3 billion, with funds moved from hot wallets across multiple blockchains. Public Ethereum records and blockchain analysts’ reports show a staged operation culminating in a large transfer from the Binance 14 wallet; Binance says users’ funds are safe and it will cover losses. The total is preliminary, the attacker’s identity has not been officially confirmed, and a full post-mortem is pending.
Binance says an attack on Oct. 29 had an estimated impact of about $6.3 billion, after funds moved from hot wallets across several blockchains. A transaction at 20:24 UTC sent 167,464 ETH, 1.615 billion USDT and 62 other tokens from a wallet identified as Binance 14, according to the public Ethereum record reviewed by ThorstenMeyerAI.com; the exchange says user funds are safe and it will cover losses.
The timeline assembled by Thorsten Meyer draws on Binance statements, public Ethereum transactions, and reports from blockchain security firms TRM Labs and Blockaid. It shows preparatory activity before the main transfer: the operator tested code on small wallets during the afternoon of Oct. 29 and deployed a contract later used in the attack, according to the on-chain review and TRM’s account.
At 20:20:59 UTC, a transaction carried 50 permissions associated with Binance 14, each tied to a consecutive transaction number. Blockaid’s analysis says one permission matched the wallet’s current number, allowing the attacker’s code to run. Three minutes and 24 seconds later, the wallet sent the large batch of assets to a receiving address. Another Binance wallet, Binance 16, transferred 28,005.6 ETH to that address 24 seconds afterward, according to the public record.
Outflows from Binance wallets on other networks reportedly began around 20:05 UTC. TRM Labs said transfers involved Bitcoin, Tron, the XRP Ledger, Solana and other networks, and reported a later wave involving Avalanche and Polygon. Binance’s incident update, issued at 02:23 UTC on Oct. 30, put the estimated total impact at about $6.3 billion and said about $3 billion had been frozen. That figure is preliminary; estimates from other firms varied with timing and valuation.
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How the Wallet Permissions Mattered
The timeline matters because it connects a major wallet transfer with a specific mechanism and a wider pattern of activity, while also showing where evidence remains incomplete. The Ethereum record documents transactions and their timing; it does not, by itself, establish who controlled the attacker’s systems or how they gained access to Binance’s operational environment.
The reported use of EIP-7702 permissions highlights a risk for systems that manage high-value wallets: a valid authorization can let code act through a wallet, even when the transaction does not resemble a conventional transfer signed at the moment of theft. Blockaid’s account says the attacker submitted many permissions tied to consecutive transaction numbers, with one matching the wallet’s current nonce. That interpretation describes the method reported by analysts, not a completed independent forensic finding from Binance.
The incident also shows the uneven reach of emergency freezes. Binance and analysts said stablecoin issuers froze roughly $2.5 billion to $3 billion within hours. Issuers can freeze some stablecoins, but ETH and bitcoin cannot be frozen by a central issuer in the same way. TRM put about $2.4 billion beyond issuer control; that estimate, too, depends on the assets and prices counted. For customers, Binance’s assurance that it will cover losses is significant, while paused withdrawals and the need to verify official support channels remain immediate concerns.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
EcoFlow DELTA 3 Classic Portable Power Station, 1024Wh, 1800W
As an affiliate, we earn on qualifying purchases.
The Oct. 29 Transfer Sequence
The reported sequence began before the large transfers. TRM and Blockworks said the operator wallet received three small withdrawals from Tornado Cash on Oct. 28. On Oct. 29, the operator tested code on small wallets from 13:51 to 14:24 UTC, then deployed a contract at 15:59 and rehearsed it on another wallet until 16:47, according to the timeline’s on-chain review.
After the first outflows around 20:05 UTC, the main Binance 14 transfer occurred at 20:24. At 20:38:47, about 195,460 ETH moved to a newly created wallet, which the source said had made no further transaction by the morning of Oct. 30. Transfers from a Binance smart account called Hot Wallet 34 followed at 20:41 and 20:59, moving 780 million and 43 million USDC, respectively.
Binance posted at 21:29 that it was investigating reports of a potential security issue and that user funds were safe. At 22:15, it said withdrawals would resume when the issue was resolved. Stablecoin issuers announced freezes between 21:18 and 22:56, according to the source timeline. Binance later reported a verified frozen total of $2.54 billion, then gave the broader estimate of about $3 billion in its Oct. 30 update.
“With high confidence” the attack was attributable to TraderTraitor, a unit TRM links to North Korea.”
— TRM Labs, on the suspected actor
What Investigators Have Not Settled
The $6.3 billion impact estimate is preliminary. Other figures cited in the source ranged from at least $5.5 billion to about $6.36 billion, reflecting different counting times, asset prices and methods. The source does not establish a final amount of assets permanently lost, recovered or still controlled by the attacker.
Binance said a compromised DevOps engineer’s laptop may have provided access to a service container, but the company had not published a post-mortem. It also said it found no evidence that a wallet private key had leaked. The precise intrusion route, the extent of any internal access, and whether the attacker had help remain unresolved in the material available as of Oct. 30.
TRM’s attribution to TraderTraitor is an analyst assessment, not an official finding. No government confirmation was cited. It is also not yet clear how much of the frozen funds can be returned, how much remains beyond issuer control, or whether further transfers will occur.
Binance’s Recovery and Forensic Review
Binance co-CEO Yi He said on Oct. 30 that deposits continued to operate normally and withdrawals were expected to begin resuming within the next 48 hours. Binance had said withdrawals would restart once the security issue was resolved; the source material does not confirm that they had resumed by the time of publication.
The next major development is Binance’s promised post-mortem, which could clarify how the attacker obtained the ability to submit unauthorized transactions, how the exchange calculated the impact, and what controls it plans to change. Issuers and blockchain investigators may also provide updates on frozen assets and fund movements. Until those details arrive, the timeline is a reconstruction from available records and attributed reports, not a final forensic account.
Binance users should rely on the exchange’s official channels for service updates and treat unsolicited messages promising refunds or account assistance with caution. The source warns of scams posing as support or compensation offers, but does not document a specific related fraud campaign.
Key Questions
How much did the Binance attack affect?
Binance’s preliminary estimate is about $6.3 billion. Other estimates cited by the source ranged from at least $5.5 billion to about $6.36 billion, and no final audited total was provided.
What happened to the Binance 14 wallet?
According to the public Ethereum record and Blockaid’s analysis, a transaction carried 50 permissions tied to consecutive transaction numbers. One matched the wallet’s current number, and the wallet then sent a large batch of assets to a receiving address.
Are Binance users’ funds safe?
Binance said user funds are safe and that it will cover losses. The source does not provide a separate audit confirming the exchange’s financial position or the final loss amount.
Who carried out the attack?
TRM Labs attributed the attack with high confidence to TraderTraitor, which it links to North Korea. That attribution had not been confirmed by Binance or a government authority in the supplied material.
When were withdrawals expected to resume?
On Oct. 30, co-CEO Yi He said withdrawals were expected to begin resuming within 48 hours. The source material did not confirm that service had restarted.
Source: ThorstenMeyerAI.com
