By Binance co-chief executive Richard Teng has published a full statement on the $6.3 billion theft, and the line investors will test is the shortest one in it. “So far, we have found no evidence of any wallet private key leak,” he wrote. Security firm Blockaid, which detected the Binance hack drain under two minutes after it began, counts eleven Binance hot wallet keys signing transfers to an address created minutes earlier.
Both can be literally true, and the gap between them is the whole technical question of the Binance hack. A key can sign without leaking if somebody else controls the machinery that decides what it signs.
Teng’s Binance Hack Statement Keeps the Laptop and Rejects the One-Click Reading
Teng’s statement retains the explanation Binance had already given overnight rather than replacing it. The incident “may have started with a compromised DevOps engineer’s laptop,” which “gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.”
He then narrows what readers should take that to mean about the Binance hack itself. “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.” Teng promised a Binance hack review, “a detailed technical post-mortem once the investigation is complete and every fact is verified,” and an updated Proof of Reserves after remediation. On the commercial side he was unambiguous: “your money is safe, and we’re covering every loss.”
So the laptop account was not withdrawn, as some Binance hack coverage of the original 02:25 UTC statement implied it had been. It was fenced.
Fifty Authorizations Went Out and Only One Had to Land
Blockaid’s incident report supplies the mechanism Teng’s phrase “more complex attack process” leaves open. At 20:20:59 UTC the attacker sent a type-4 transaction to Binance 14 carrying 50 EIP-7702 authorizations signed with that wallet’s key, one for each nonce from 18,914,775 to 18,914,824. Binance 14 was still paying out customer withdrawals, so the attacker could not know which nonce would be current and signed a window instead. Forty-nine failed. One matched.
Three minutes and 24 seconds later the sweeper moved 167,464 ETH, 1.615 billion USDT and about 60 other tokens out of Binance 14, leaving the wallet with 1 ETH. Blockaid values that single Binance hack transaction at roughly $2.5 billion. The operator address behind the Binance hack had been funded through three Tornado Cash withdrawals from 28 October and had rehearsed the sequence on three of its own wallets, moving $2 to $6 each time.
The authorization was visible on-chain for three minutes and 24 seconds before the sweep, which was the window to act in. Source: Blockaid incident report · Chart: FinanceFeedsInvestor Takeaway
Teng has kept the laptop as a possible starting point while rejecting the reading that one engineer’s permissions were enough, and the two statements sit in the same text.
Eleven Keys Signed Transfers and Binance Says No Key Leaked
The delegation explains what happened on Ethereum, and nothing at all about the other chains. Twenty-four seconds after the sweep, Binance 16 sent 28,005.6 ETH, 55.7 million USDT, 25.9 million RLUSD and 84.5 WBTC to the same address. Within twelve minutes a wallet on Optimism had sent 44.2 million OP tokens to it. Four wallets on Arbitrum sent 74.6 million ARB and 8,426 ETH, and four on Avalanche sent 1.81 million AVAX and 8.41 million USDT.
“None of these wallets carried code,” Blockaid writes of that second group of wallets. “Each transfer was an ordinary transaction signed by the wallet’s own key, placed between routine withdrawals.” Its automated analysis identified “unauthorized signing from Binance’s hot wallet keys” within 11 minutes, and it describes the first delegation as signed by “Binance’s own signing infrastructure, under the attacker’s control.” The Reuters file records TRM finding wallets hit on ten chains, with most of the money gone in about 20 minutes.
Jayant Dave of the security firm Check Point gave the BBC the reconciliation between the two. “The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign.” That reading is consistent with Teng’s wording and with TRM Labs assessing that the attacker likely compromised Binance’s hot wallet signing infrastructure. No evidence of a leak is not the same as no unauthorized signing, and nothing Binance has published yet addresses the second.
The Delegation Is the Part of the Binance Hack That Key Rotation Cannot Fix
An EIP-7702 authorization attaches to the address rather than to the key, which is what makes this Binance hack different from the ones before it. Blockaid says rotating keys does not clear a delegation, and that removing one requires a fresh authorization from the same wallet pointing at the zero address. The attacker used that property at 20:41:23, pulling 780 million USDC from a Circle smart account owned by the still-delegated Binance 14, then swept the wallet again at 21:44 for 200 million USDT and 13 tokens that had arrived after the first sweep.
Teng says Binance has “revoked the affected address authorizations” and suspended withdrawals “while we complete a security revamp of the withdrawal service and its related addresses.” That sequencing matters more than it sounds, because a wallet refilled before its delegation is cleared is a wallet that drains again without anyone signing anything.
Binance has pledged to cover user losses from SAFU and company funds, and about $3 billion is frozen on-chain. Withdrawals are expected back within 48 hours of 04:17 UTC. Binance has not responded to BBC questions about North Korea, though TRM Labs and Chainalysis have both attributed the Binance hack to TraderTraitor with high confidence.
Investor Takeaway
Blockaid counts eleven Binance keys signing, against Teng’s statement of no evidence of a key leak, and only the Binance hack post-mortem can reconcile the two
