Co-CEO Richard Teng said the attackers ran a self-destruct mechanism to erase evidence and reached a hot wallet through Ethereum's account-delegation feature. Withdrawals stay paused while the service is rebuilt, with Sunday the stated target.
Binance co-CEO Richard Teng said Friday that investigators examining the theft of about $6.3 billion from the exchange had found breach points beyond the compromised employee laptop it first suspected, and that the attackers ran a self-destruct mechanism to erase evidence. Withdrawals have been suspended since early Friday and Teng said they will stay paused while Binance rebuilds and tests the service.
Teng, speaking in a video posted to X, called it a complex attack and said investigators had not yet established the full sequence of events, according to CoinDesk. Binance has reserved more than $6.34 billion of company funds to cover the losses, about $5 billion of which it already held in the tokens that were taken. It is buying the rest through exchange and over-the-counter markets, and said some purchases could take longer where liquidity is thin or settlement is slow. The reserve excludes assets that have been frozen.
Teng said the attackers used EIP-7702, Ethereum's account-delegation feature, to take control of a hot wallet without passing through Binance's normal approval procedures. The security firm Blockaid traced that step to a transaction submitted at 20:20:59 UTC on October 29 carrying 50 EIP-7702 authorizations aimed at the wallet Binance labels Binance 14, crypto.news reported. The authorizations covered consecutive nonce values 18,914,775 to 18,914,824, a spread the attacker needed because the wallet was processing withdrawals and its next nonce could not be predicted. One authorization matched and activated an unverified contract exposing a sweep function that moved ether and ERC-20 tokens, leaving a single ETH behind for fees. Binance later revoked the authorization.
crypto.news put the drain from Binance 14 at roughly $2.5 billion, including 167,464 ETH and more than 1.6 billion USDT, moved at about 20:24 UTC. Binance 16 and a third Ethereum hot wallet holding USDC were also hit, and transfers spread to Bitcoin, Tron, Arbitrum and Avalanche. Binance puts the total impact near $6.3 billion. Chainalysis counted $5.912 billion at the moment of the theft, and its chief executive Jonathan Levin later put the figure at $6.4 billion. Binance has not published the calculation behind its own number.
How the attacker obtained the authorizations is unresolved, and the available accounts do not agree. Binance's October 30 update says the incident may involve a compromised DevOps engineer's laptop that gave access to a service container used for withdrawals, and that the company found no evidence a wallet private key leaked. Blockaid's own post describes a stolen key and a $5.5 billion drain, figures that match neither Binance's statement nor Blockaid's Binance 14 total.
Token issuers and chain operators froze part of the proceeds within hours. Tether froze more than $1.567 billion of USDT and Circle more than $800 million of USDC. World Liberty Financial froze $27 million of USD1 and $2 million of WLFI, Arbitrum's Security Council moved 74,559,805 ARB and 8,425 ETH out of an address linked to the attack and into a restricted wallet, and Ripple said it was freezing affected RLUSD without naming an amount. Binance put verified frozen assets at $2.54 billion late on October 29, revised that to about $3 billion by 00:52 UTC and still reported about $3 billion at 09:57 UTC on Friday. Intervention by issuers and chain operators is now a standard first response to a large theft, as when Qubic halted its own chain to freeze most of a 1,404-wallet drain this month.
Attribution is contested. TRM Labs attributed the attack to North Korea's TraderTraitor group with high confidence, and Ari Redbord, its global head of policy, called the scale unprecedented, Al Jazeera reported. Levin said TraderTraitor was the likely culprit. Teng said Friday that “Our investigation has not attributed responsibility to any individual.” The FBI named TraderTraitor over the February 2025 theft of about $1.5 billion from Bybit, until now the largest on record, but has not publicly attributed this incident. The investigator ZachXBT said proceeds from this attack and from the Bitget exploit were commingled in a single address after passing through THORChain.
Teng said the attack reached Binance's own hot wallet rather than customer funds, and the company has said repeatedly that user balances are safe and that it will cover all losses. CoinDesk, reviewing Binance's published reserve data, found that the compromised wallets had previously been listed among the assets backing customer balances.
Binance paused withdrawals at 04:17 UTC on Friday to rebuild and test the withdrawal service, first estimating a 48-hour outage, then 45 hours, then roughly 40 hours with Sunday as the target. They were still paused on Friday evening. Deposits are operating normally. The review covers cloud systems, employee devices, private-key management and transaction-signing procedures. Binance said it would publish an initial proof-of-reserves update before a fuller report on Monday, and a technical post-mortem once the investigation closes.
Bitcoin fell below $77,000 in the hours after the theft and was trading in the $76,000s on Friday afternoon, down 8.4% over October. Measured at 01:19 UTC on Friday, BNB was down 8% at about $693 and ether down 5.7% at about $2,211. It is the second compromise at a major venue this week: Polymarket paused trading and blamed a compromised provider days earlier. Binance said it is working with law enforcement, blockchain investigators and token issuers to recover the stolen assets. About $3 billion of those assets is frozen, and the company has not said how much has been recovered.
