Binance co-chief executive Richard Teng has published a full statement on the $6.3 billion theft, and the line investors will test is the shortest in it. “So far, we have found no evidence of any wallet private key leak,” he wrote. Security firm Blockaid, which detected the drain under two minutes after it began, counts eleven Binance hot wallet keys signing transfers to an address created minutes earlier.
Both can be literally true, and the gap between them is the whole technical question of the Binance hack. A key can sign without leaking if somebody else controls the machinery that decides what it signs.
Teng’s Binance Hack Statement Keeps the Laptop and Rejects the One-Click Reading
Teng’s statement retains the overnight explanation of the breach rather than replacing it. The Binance hack “may have started with a compromised DevOps engineer’s laptop,” which “gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.”
He then narrows what readers should take that to mean about the Binance hack itself. “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process.” Teng promised “a detailed technical post-mortem once the investigation is complete and every fact is verified,” plus an updated Proof of Reserves. On the commercial side he was unambiguous: “your money is safe, and we’re covering every loss.”
So the Binance hack laptop account was not withdrawn, as some coverage of the original 02:25 UTC statement implied. It was fenced.
Binance’s own corporate account then went further than its co-chief executive had gone. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” it posted, calling it “a complex attack” and saying outflows ceased once withdrawals were paused. It did not say what those additional points were.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.
The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far.
We will continue to provide further updates through official Binance channels as more verified information becomes available.
— Binance (@binance) October 30, 2026
Fifty Authorizations Went Out and Only One Had to Land
Blockaid’s incident report supplies the Binance hack mechanism that Teng’s “more complex attack process” leaves open. At 20:20:59 UTC the attacker sent a type-4 transaction to Binance 14 carrying 50 EIP-7702 authorizations signed with that wallet’s key, one per nonce from 18,914,775 to 18,914,824. Binance 14 was still paying out withdrawals, so the attacker could not know which nonce would be current and signed a window instead. Forty-nine failed. One matched.
Three minutes and 24 seconds later the sweeper moved 167,464 ETH, 1.615 billion USDT and about 60 other tokens out of Binance 14, leaving it with 1 ETH. Blockaid values that single transaction at roughly $2.5 billion. The operator address behind the Binance hack was funded through three Tornado Cash withdrawals from 28 October, and the sequence was rehearsed on three of the attacker’s own wallets first.
The authorization was visible on-chain for three minutes and 24 seconds before the sweep, which was the window to act in. Source: Blockaid incident report · Chart: FinanceFeedsInvestor Takeaway
Binance now says its investigation has uncovered additional points of breach beyond the laptop, which is the first official move away from a single-machine account.
Eleven Keys Signed Transfers and Binance Says No Key Leaked
The delegation explains what happened on Ethereum, and nothing at all about the other chains. Twenty-four seconds after the sweep, Binance 16 sent 28,005.6 ETH, 55.7 million USDT and 25.9 million RLUSD to the same address. Within twelve minutes a wallet on Optimism had sent 44.2 million OP tokens to it. Four wallets on Arbitrum sent 74.6 million ARB and 8,426 ETH, and four on Avalanche sent 1.81 million AVAX and 8.41 million USDT.
“None of these wallets carried code,” Blockaid writes of that second Binance hack group. “Each transfer was an ordinary transaction signed by the wallet’s own key, placed between routine withdrawals.” Its analysis identified “unauthorized signing from Binance’s hot wallet keys” within 11 minutes, and it describes the first delegation as signed by “Binance’s own signing infrastructure, under the attacker’s control.” The Reuters file has TRM counting wallets hit on ten chains, most of the money gone in 20 minutes.
Jayant Dave of security firm Check Point gave the BBC the Binance hack reconciliation between the two. “The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign.” That is consistent with Teng’s wording and with TRM Labs assessing that the attacker likely compromised Binance’s signing infrastructure. No evidence of a leak is not the same as no unauthorized signing. Binance’s admission of additional points of breach moves toward Blockaid’s count without naming a single one of them.
The Delegation Is the Part of the Binance Hack That Key Rotation Cannot Fix
An EIP-7702 authorization attaches to the address rather than the key, which is what sets this Binance hack apart. Blockaid states the operational consequence directly: rotating keys does not clear a delegation, and removing one requires a fresh authorization from the same wallet pointing at the zero address. The attacker used that at 20:41:23, pulling 780 million USDC from a Circle smart account owned by the still-delegated Binance 14, then sweeping the wallet again at 21:44 for 200 million USDT and 13 tokens banked since.
On remediation, Teng says the company has “revoked the affected address authorizations” and suspended withdrawals “while we complete a security revamp of the withdrawal service and its related addresses.” That sequencing matters, because a wallet refilled before its delegation is cleared is a wallet that drains again without anyone signing anything.
Losses will be covered from SAFU and company funds, about $3 billion is frozen on-chain, and Binance says it is on track to resume withdrawals in 45 hours. TRM Labs and Chainalysis both attribute the Binance hack to TraderTraitor with high confidence.
Investor Takeaway
Blockaid counts eleven Binance keys signing, against Teng’s statement of no evidence of a key leak, and only the Binance hack post-mortem can reconcile the two.