Binance Teng Confirms EIP-7702 Role in $6.3B Hack, Targets Sunday Withdrawals and Monday Reserves

Published October 30, 2026, 09:35 PM PKT. This is a follow-up to MABOnChain's October 30 articles on Binance's investigation into a suspected multi-billion wallet drain, its pause of withdrawals, its pledge to cover all losses and suspend all deposits and withdrawals, its first findings pointing to a compromised DevOps engineer's laptop, TRM Labs' attribution of the hack to North Korea, its expectation to begin resuming withdrawals within 48 hours, its finding of additional breach points, and its reservation of more than $6.34 billion in company funds to cover losses while buying back stolen altcoins. It is based on Binance co-chief executive Richard Teng's video statement on X on October 30, 2026 (primary source for the EIP-7702 confirmation, the self-destruct detail, the Sunday withdrawal target and the Monday proof of reserves target, as reported by The Defiant, The Crypto Times and Lookonchain), and on CoinDesk's EIP-7702 explainer (secondary source). Where sources disagree, this article says so rather than picking a winner.

Binance has now confirmed, in its own voice, the mechanism outside researchers pointed to within hours of the hack. In a video posted on X on October 30, co-chief executive Richard Teng said the attacker used Ethereum's EIP-7702 authorization mechanism to obtain on-chain execution approval over a Binance hot wallet, and that the authorization bypassed the exchange's normal approval controls. The Crypto Times and The Defiant both report the video, and Lookonchain's summary of Teng's update carries the same points. The confirmation matters because, until now, the EIP-7702 account came from researchers, not from Binance. Arkham chief executive Miguel Morel told CoinDesk on October 30 that the attacker may have exploited EIP-7702, TRM Labs traced a 50-authorization EIP-7702 transaction against the wallet labeled Binance 14 in its October 30 analysis, and MABOnChain reported both, while Binance's own statements spoke only of a compromised laptop, a service container and additional points of breach. Teng's video closes that gap on one point: Binance now says the EIP-7702 authorization was part of the attack. It does not close the gap on the harder question, which is how the attacker obtained an authorization signed by a Binance wallet in the first place. Teng said the investigation has not yet established the full attack path, and Binance has not explained how the authorization was obtained or detailed all the systems involved. Readers should therefore treat the EIP-7702 confirmation as a confirmed step in the attack, not as a confirmed root cause, and watch the promised technical post-mortem for the missing link between the laptop account, the additional breach points and the signed authorization.

How the EIP-7702 authorization worked

EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, lets an ordinary wallet hand control of its behavior to a smart contract by signing an authorization. Once accepted, the wallet runs that contract's code as if it were its own, until a replacement or cancellation is recorded on-chain. CoinDesk's October 30 explainer describes how that feature drained about $2.5 billion from the Binance 14 wallet in under four minutes on October 29: a Binance wallet signed a permission that let an attacker-controlled contract operate it, and less than four minutes later about $2.5 billion in ether and tokens was gone, with the delegation staying active for nearly four hours so further arriving funds could be swept as well. TRM Labs' analysis, reported by MABOnChain earlier on October 30, gives the precise shape of the Ethereum step: at 20:20 UTC on October 29, the operator submitted a single transaction containing 50 authorizations, each signed by the Binance hot wallet and each pointing it to a sweeper contract, prepared for 50 consecutive transaction counts because the busy hot wallet's count kept moving, so one authorization would still be valid when the transaction executed. One matched, and three minutes and 24 seconds later the operator instructed the wallet to send its entire balance to an attacker-controlled address, moving 167,464 ether and 63 tokens, including 1.615 billion USDT. Teng added two clarifications that researchers could not give. First, the affected wallet belonged to Binance, rather than being a direct compromise of customer wallets, which fits Binance's position that customer funds themselves were not taken from customer accounts but from the exchange's own hot wallets. Second, Binance has found no evidence that wallet private keys leaked, a point Teng repeated in the video and in his written statement on October 30. Those two points sit together uneasily, and honestly: if no key leaked, the signed authorization still had to come from somewhere inside Binance's signing process, and that is exactly what the unfinished investigation has to explain. Teng's own framing points the same way. He said the attack was not a single one-click action by one person, and that the investigation has not attributed responsibility to any individual.

The self-destruct detail, and what it leaves unanswered

Teng also disclosed a detail that explains why the investigation is moving slowly. According to The Crypto Times and Lookonchain, Teng said the attacker used a self-destruct mechanism that removed some of the attacker's tools and traces, complicating the investigation and the tracking effort. A self-destructing tool deletes itself after running, so forensic teams lose the code, the configuration and the logs that would normally show how the tool was built, where it connected and what it touched. That detail connects directly to Binance's earlier statement that its investigation had uncovered additional points of breach beyond the compromised DevOps engineer's laptop first cited as a possible entry point. The laptop, the service container, the additional breach points and now the EIP-7702 authorization and the self-destruct mechanism are five pieces of one attack that Binance has not yet assembled into a single account. The exchange has said it will publish a detailed technical post-mortem once the investigation is complete and every fact is verified, and Teng repeated that commitment in the video. Until that post-mortem arrives, the honest summary is that Binance has confirmed more of the attack's shape, including the EIP-7702 step and the evidence-destroying step, while the entry point, the signing-system compromise and the full chain of events remain under investigation. Attribution is in the same unfinished state. TRM Labs attributes the attack to North Korea's TraderTraitor unit with high confidence, and Chainalysis has corroborated that link, but Binance has not itself named a perpetrator, and Teng said only that the exchange is working with law enforcement and industry partners to trace the funds and hold those responsible accountable.

Sunday withdrawals, Monday reserves: two dates to watch

The video also gives customers the two dates that matter most, and both are targets, not guarantees. On withdrawals, Teng said Binance was aiming to resume withdrawals before its Sunday deadline, which The Crypto Times describes as being within about 40 hours of the video update, and The Defiant reports the same 40-hour aim with a Sunday restart target. Lookonchain's summary puts it the same way: Binance aims to resume user withdrawals within 40 hours, by the Sunday deadline, and will restore the service only after rigorous testing. Readers should note that this is a refinement of earlier estimates, not a contradiction to hide. Co-chief executive Yi He first said on October 30 that Binance expected to begin resuming withdrawals within 48 hours, Binance then said at 08:47 UTC on October 30 that it remained on track to resume withdrawals in about 45 hours, and Teng's video now puts the aim at about 40 hours to Sunday. The direction is consistent, a narrowing window as rebuilding progresses, but none of these figures is a confirmed reopening time, and Binance has given no schedule by network or asset. Teng said Binance is rebuilding its withdrawal service and will not restore it until the updated infrastructure passes security testing, and that the review covers employee endpoints, cloud infrastructure, key management and transaction signing. Binance has revoked the affected address authorization, deposits are operating normally, and withdrawals remain paused pending the security overhaul. On reserves, Teng said Binance was targeting Monday for the full proof of reserves report, with an initial view potentially available earlier, and Lookonchain adds that preliminary data will be provided for public verification ahead of the full report. That Monday target is the first date Binance has attached to the reserves report, and it fills the gap MABOnChain flagged earlier on October 30, when the $6.34 billion reserve announcement carried no publication date. It does not, by itself, close the reserves gap. The full report depends on the buyback MABOnChain reported earlier on October 30, in which Binance is buying the remaining stolen altcoins in fully matching amounts through over-the-counter deals and on-exchange trades, with some purchases warned to take longer for low-liquidity tokens. A preliminary view is therefore not the same as the completed, token-by-token verification, and customers should treat the Monday full report, not any earlier preview, as the document that shows whether the backing has actually been restored.

What is still unresolved

Four questions remain open after Teng's video, and readers should keep them separate from what Binance has now confirmed. First, the full attack path: how the attacker obtained a signed EIP-7702 authorization, how the laptop compromise, the service container and the additional breach points connect, and whether the attacker retains any access. Second, the frozen total, unchanged at about $3 billion with industry partners, and how much of it Binance expects to recover rather than write off against its more than $6.34 billion company-funds reserve. Third, attribution: TRM Labs and Chainalysis point to North Korea's TraderTraitor, Binance has not confirmed it, and no law-enforcement determination has been announced. Fourth, the two dates themselves: Sunday for withdrawals and Monday for the full proof of reserves report are Teng's stated aims, and both depend on testing and on the buyback completing, so either could slip. Until withdrawals actually begin resuming and the full reserves report is published, the confirmed position is this: an estimated $6.3 billion impact, about $3 billion frozen outside the reserve, more than $6.34 billion in company funds reserved with $5 billion already held in the affected tokens, an EIP-7702 authorization confirmed by Binance itself as bypassing normal approval controls, a self-destruct mechanism that removed some of the attacker's tools and traces, and a post-mortem still to come. Until withdrawals actually begin resuming, customers should treat any message offering to unlock withdrawals for a fee, or asking for account details through an unofficial link, as a scam, and rely only on Binance's official channels.

This article is news reporting and is not investment advice.

Sources

• Richard Teng, Binance co-chief executive, video statement on X, October 30, 2026 (as reported by The Defiant, The Crypto Times and Lookonchain), primary source for the EIP-7702 confirmation, the bypass of normal approval controls, the self-destruct mechanism, the additional breach points, the affected wallet belonging to Binance, no evidence of a wallet private key leak, the aim to resume withdrawals within about 40 hours before a Sunday deadline subject to security testing, and the Monday target for the full proof of reserves report with preliminary data earlier
• The Defiant, Binance's Teng Targets Sunday Withdrawal Restart After Hack (published October 30, 2026, 14:38 UTC), secondary source for the 40-hour Sunday withdrawal aim, the more than $6.34 billion company-funds reserve, and the Monday full proof of reserves report
• The Crypto Times, Binance's $6.3B Hack: What Teng Revealed About the Attack and Recovery (published October 30, 2026), secondary source for the EIP-7702 authorization detail, the self-destruct mechanism, the review of employee endpoints, cloud infrastructure, key management and transaction signing, the revoked authorization, deposits operating normally, and the Sunday deadline described as within about 40 hours of the video update
• Lookonchain, Binance's co-CEO: Aims to resume withdrawals before the Sunday deadline, and plans to release a full proof of reserves next Monday (published October 30, 2026), secondary source for the 40-hour Sunday aim, rigorous testing before restoration, the Monday full proof of reserves report, preliminary data for public verification ahead of it, and the self-destruct mechanism complicating tracking
• CoinDesk, Here is how one Ethereum permission let an attacker drain $2.5 billion from Binance (published October 30, 2026), secondary source for the EIP-7702 mechanism, the Pectra upgrade in May 2025, the under-four-minute drain of about $2.5 billion from Binance 14, and the delegation staying active for nearly four hours
• MABOnChain, Binance Reserves $6.34B to Cover Hack Losses, Buys Back Stolen Altcoins (October 30, 2026), context for the more than $6.34 billion reserve, $5 billion already held in the affected tokens, the fully matching amounts buyback, the low-liquidity warning, and the previously missing proof of reserves publication date
• MABOnChain, Binance Finds Additional Breach Points in $6.3B Hack (October 30, 2026), context for the additional points of breach, the 45-hour withdrawal track, about $3 billion frozen, and Binance not attributing the attack
• MABOnChain, TRM Labs Blames North Korea for $6.36B Binance Hack (October 30, 2026), context for the TRM attribution, the 50-authorization EIP-7702 transaction at 20:20 UTC, the 167,464 ether sweep, and the attacker holdings beyond issuer reach