Binance details how attackers bypassed controls in $6.3 billion breach
Security & Exploits ·
The exchange's co-chief executive says multiple actors exploited a new Ethereum authority-transfer standard and erased their tracks as withdrawals stay frozen during a system overhaul.
Richard Teng, Binance's Co-CEO, offered fresh detail on October 30 about the roughly $6.3 billion breach, telling followers the operation was not the work of a single intruder. Early theories centered on a single compromised laptop, but the ongoing review has since turned up additional ways attackers got in, pointing to a more coordinated effort than first assumed, according to this update.
Teng said the intruders deployed self-destruct functions to wipe their tools and erase evidence as they moved, a tactic that has made reconstructing their path significantly harder for investigators. He also pointed to EIP-7702, an Ethereum mechanism, as the method used to seize on-chain execution rights over a hot wallet, effectively sidestepping Binance's standard approval checks without triggering them.
To contain the fallout, Binance paused withdrawals entirely while it rebuilds and stress-tests its infrastructure, with an internal target of restoring service within 40 hours. The exchange says it is also coordinating with law enforcement to track the stolen funds and pursue recovery.
The incident has drawn wider scrutiny beyond Binance's own disclosures. The FBI has attributed the breach to North Korean hackers, and the exchange reportedly urged blocking measures on THORNode as part of the response, per wublockchain.xyz. Separate reporting indicates Binance began phased withdrawals after replenishing 95% of the affected assets, a recovery effort covered by cryptopotato.com.
Still unresolved is the question of attribution itself: statements attributed to Trump have contradicted the FBI's North Korea assessment, raising doubt about who was actually behind the attack. Also unclear is the fate of the remaining unreplenished funds, the precise number of attackers involved, and whether the EIP-7702-based technique exposes a broader vulnerability affecting other exchanges' hot wallets.