Binance investigators have expanded their understanding of a $6.3 billion hack, uncovering multiple breach points and attack methods that go beyond initial findings, co-CEO Richard Teng disclosed on October 30.
Attack Scope Wider Than Initially Thought
While Binance's first assessment pointed to a compromised engineer laptop, subsequent investigation revealed additional breach points. Teng stated that the attacker used a self-destruct mechanism that destroyed tools and traces to hinder the investigation.
Teng emphasized that the attack was not the work of a single person or a simple unauthorized action. "The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," he said, adding that "our investigation has not attributed responsibility to any individual."
Approval Controls Bypassed
The attacker circumvented Binance's normal approval controls by exploiting Ethereum's EIP-7702 feature, a protocol that allows a wallet to authorize smart contract code to act on its behalf. Teng explained that the attacker obtained on-chain execution approval over a hot wallet through this mechanism, which "did not pass through our normal approval controls."
External analysis by TRM Labs identified compromised signing infrastructure across multiple blockchains, noting valid signatures from wallets using different keys and signing schemes. Elliptic's assessment separately identified 50 pre-signed authorizations on Ethereum, with one enabling delegation to attacker-controlled code that repeatedly drained the wallet as new funds arrived.
Coverage and Customer Funds
Binance has committed company funds totaling $6.34 billion to cover all losses from the hack. Of that amount, $5 billion was already held in affected tokens including USDC, USDT, BTC, ETH, and BNB, with remaining token purchases proceeding through market and over-the-counter channels.
Customer assets held under exchange custody were not affected, as Binance does not use customer funds. The compromised hot wallet contained only Binance's own assets, while the vast majority of user assets remain in cold wallets and are only moved to hot wallets when users initiate withdrawals.
Withdrawal Resumption and Security Review
Binance is rebuilding its withdrawal service and conducting rigorous testing before resuming operations. Teng expressed hope that withdrawals could resume prior to a Sunday deadline, potentially within 40 hours of his statement.
The company has launched a companywide security review examining endpoints, cloud infrastructure, key management, and signing systems. Teng pledged a full proof-of-reserves report by Monday, November 2, with an initial view potentially available earlier.
Law enforcement, blockchain intelligence firms, token issuers, and other exchanges are pursuing recovery and accountability efforts. Approximately $3 billion in assets have been frozen through partner cooperation.
