Binance now calls the Oct 29 hot wallet drain a complex attack with multiple points of breach, beyond the first theory of one compromised DevOps engineer laptop reaching a service container.

Binance now calls the Oct 29 hot wallet drain a complex attack with multiple points of breach, beyond the first theory of one compromised DevOps engineer laptop reaching a service container.

Co-CEO Richard Teng said in a video update the attacker used EIP-7702 delegation to gain on-chain execution control of a hot wallet, bypassing normal approval controls, and used a self-destruct mechanism to wipe tools and traces, which summaries describe here and here. No private key leak has been found so far.

Estimated impact remains around $6.3B, with about $3B frozen onchain via issuers and partners. Binance says outflows stopped when withdrawals were paused.

Withdrawals remain paused for a security rebuild, now expected back in about 40-45 hours, while deposits work normally.

Binance will cover all losses from SAFU plus company funds, saying it reserved over $6.34B with $5B already held in the exact impacted tokens and buying the rest via market and OTC, per its update. A full Proof of Reserves report is promised by Monday.