Binance Eyes Withdrawal Restart in 40 Hours as Probe Finds More Breach Points
Binance co-CEO Richard Teng says investigators found additional breach points and a self-destruct mechanism in the $6.4 billion hack. Withdrawals may resume within about 40 hours, as Chainalysis and TRM tie the theft to North Korea.
Binance expects to restore withdrawals within about 40 hours while it rebuilds and retests its withdrawal service, co-CEO Richard Teng said in an Oct. 30 video. He added that investigators have found breach points beyond the compromised engineer laptop first suspected.
Teng said Binance hopes users can withdraw before Sunday, subject to testing. An earlier estimate had put the window at 48 hours. A full proof-of-reserves report is promised by Monday, Nov. 2, and an initial view may come sooner. Our earlier coverage detailed the funds Binance set aside and its work with law enforcement.
"This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach."
Richard Teng, co-CEO of Binance
Teng also said the attacker used a self-destruct mechanism that destroyed tooling and traces, making the attack harder to trace and investigate. The EIP-7702 delegation over the hot wallet, he said, "did not pass through our normal approval controls."
A companywide security review now covers endpoints, cloud infrastructure, key management and signing systems. Teng said the hack hit Binance's own hot wallet, not customer funds, since most user assets sit in cold wallets. The exchange has reserved more than $6.34 billion of company funds to cover losses.
North Korea attribution
Chainalysis attributes the theft to the North Korean group TraderTraitor, citing on-chain commingling of the stolen funds with those from last month's Bitget theft, which was also attributed to North Korea. It announced the attribution at 12:30 a.m. ET on Oct. 30. TRM Labs published its own analysis attributing the theft to North Korea.
Funds began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. ET on Oct. 29. Chainalysis puts the unauthorized transfers at about $6.4 billion, the largest theft in crypto history. Estimates vary slightly: Binance uses about $6.3 billion, while TRM's figure is $6.36 billion.
Freezes began by 5:14 p.m. ET. Chainalysis reports about $2.8 billion frozen; Binance's updates say about $3 billion. To stay ahead of freezes, the attacker swapped $325 million of stablecoins into $285 million of ETH over nearly 20 minutes.
Chainalysis also reports signs of automated laundering, with thousands of transactions and many addresses first receiving exactly 1 TRX.
Open questions on the mechanism
Teng reported no private key leak. TRM's analysis, however, points to compromise of signing infrastructure across blockchains. Blockaid CEO Ido Ben-Natan suspects the attackers manipulated Binance's transaction-signing infrastructure, describing possible private key misuse rather than outright theft.
Elliptic identified 50 pre-signed authorizations on Ethereum, one enabling delegation to attacker-controlled code that repeatedly drained the wallet as new funds arrived. Chainalysis says the attacker used an operational wallet funded via Tornado Cash to submit the signed authorizations on Ethereum.
The attacker is still moving funds. A Tron wallet that Arkham attributes to the hacker sent about 5.19 million TRX, roughly $1.73 million, to 12 addresses between 11:37 a.m. and 12:12 p.m. ET Friday.
Former Binance chief Changpeng Zhao said the theft is the largest in dollar terms but not in Bitcoin terms, pointing to Mt. Gox's loss of 650,000 BTC. "It hurts, but we survive," he wrote.
