The Binance hack investigation has identified additional breach points after attackers stole about $6.3 billion from the cryptocurrency exchange on October 29, 2026. Withdrawals remained suspended the following day as Binance reviewed its security and worked on restoring the service.

Key Takeaways

  • Binance said more than $6.34 billion in company funds had been reserved to cover losses.
  • Investigators have not attributed responsibility to an individual, co-CEO Richard Teng said.
  • Binance aims to reopen withdrawals within 40 hours of Teng’s latest update.

Binance hack investigation expands

Binance initially considered a compromised engineer’s laptop as a possible entry point. By October 30, investigators had found other breach points, Teng said. He cautioned that the attack was not simply a matter of using one engineer’s permissions or a single action.

On-chain investigators attributed the theft to North Korea-backed hackers. The investigation into how the attackers gained access remained ongoing.

How account delegation entered the investigation

Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without going through Binance’s normal approval controls. He also said a self-destruct mechanism had removed tools and traces, making the investigation more difficult.

The EIP-7702 account delegation specification describes a transaction type that lets an externally owned Ethereum account set code and delegate execution. The specification explains the mechanism; it does not establish how it was used in this incident.

Blockaid CEO Ido Ben-Natan said compromised signing systems likely enabled the theft. He said the attackers could have stolen the funds without EIP-7702, though the feature may have helped them bypass safeguards and drain assets in one sweep.

Blockchain analytics firm Chainalysis observed thousands of transactions in quick succession, a pattern it said could indicate automated laundering.

Loss coverage and withdrawal plans

Binance said its reserved company funds included $5 billion held in the same tokens that were stolen. The exchange was rebuilding its withdrawal service and conducting a company-wide security review, Teng said.

Decentralized lender Aave had paused new deposits and borrowing as a precaution. It reopened its markets on October 30, while Binance withdrawals remained suspended.

Next milestone

Binance aims to resume withdrawals within 40 hours of Teng’s latest update and publish a full proof-of-reserves report by Monday, November 2.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.