Binance investigators uncovered additional breach points, bypassed approval controls, and evidence-destruction tactics in Thursday’s $6.3 billion hack, co-CEO Richard Teng said. His update outlined a withdrawal-service rebuild, a companywide security review, and targets for restoring transfers and verifying reserves.
Key Takeaways
- CEO Richard Teng said the attacker bypassed Binance’s normal approval controls.
- A self-destruct mechanism destroyed attack tools and traces, he said.
- Teng hoped withdrawals could resume within 40 hours, subject to testing.
Investigation Expands Beyond the Laptop
Binance found additional breach points beyond the initially suspected engineer laptop while investigating the $6.3 billion hack, co-CEO Richard Teng said.
In a video shared on Oct. 30, he stated: “This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.”
Teng described evidence destruction:
“This was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate.”
His earlier statement explaining the attack process emphasized: “To be clear: The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”
Signing Controls Come Under Scrutiny
Explaining the approval failure, Teng stated: “The attacker used a known multi-signature protocol EIP-7702, to obtain on-chain execution approval over a hot wallet. That delegation did not pass through our normal approval controls.” The executive continued:
“That’s why we need to pause the withdrawal service to investigate, rebuild, and retest the entire infrastructure system.”
Ethereum’s EIP-7702 feature lets a wallet authorize smart contract code to act on its behalf, including moving assets. Delegating malicious code can give an attacker control over those holdings, while multisignature approval is a separate control requiring multiple signatures.
Independent TRM Labs analysis of Binance’s signing systems pointed to a compromise of its signing infrastructure across blockchains. The firm cited valid signatures from wallets using different keys and signing schemes as evidence that attackers could make Binance’s systems authorize transfers. That finding concerned control over the transaction-signing process, while Teng had reported no evidence of a private key leak.
Separately, Elliptic’s onchain assessment of the breach identified 50 pre-signed authorizations on Ethereum. One enabled delegation to attacker-controlled code, which repeatedly drained the affected wallet as new funds arrived.
Company Funds Back the Coverage Pledge
Corporate funding reserved to cover losses exceeded $6.34 billion, Teng said. Of that, $5 billion was already held in affected tokens, including USDC, USDT, BTC, ETH, and BNB. Remaining token purchases were proceeding through market and over-the-counter channels to replace assets affected by the hack.
In the video, the Binance CEO committed company funds to covering all losses, while earlier statements also identified the Secure Asset Fund for Users, or SAFU. Teng had reassured customers:
“Bottom line—your money is safe, and we’re covering every loss.”
He credited retained crypto earnings with enabling coverage and described long-term reinvestment in the business and security.
On assets held under exchange custody, he stated: “We NEVER use any customer funds, so they are not impacted. What was affected in this incident was Binance’s own hot wallet. User assets are held under Binance’s established security architecture. The vast majority sit in cold wallets, and are only moved into a hot wallet when a user makes a withdrawal.”
Withdrawal Restart Awaits Testing
Teng outlined the conditions for restoring withdrawals: “We are rebuilding the withdrawal service, and we are not switching it back on until it passes rigorous testing.” He further shared:
“We are very hopeful that users will be able to withdraw prior to our Sunday deadline, which is on track to be within 40 hours.”
The companywide security review was examining endpoints, cloud infrastructure, key management, and signing systems as part of the response.
Earlier updates reported normal deposits, revoked affected address authorizations, and approximately $3 billion in frozen assets from partners. Law enforcement, blockchain intelligence firms, token issuers, and other exchanges were pursuing recovery and accountability. Teng thanked users for their patience and partners for their rapid assistance, saying Binance worked nonstop to make users whole.
Alongside plans for a technical postmortem after investigators verified the findings, Teng advised concerned users to check their balances and contact support. Teng pledged a full proof-of-reserves report by Monday, Nov. 2, with an initial view potentially available earlier.
