Binance Blamed One Laptop. A Day Later It Found 'Additional Points of Breach', and the Hacker Had Been Rehearsing for 36 Hours

On Thursday night, Binance had a tidy explanation for the largest theft in crypto history: one DevOps engineer’s laptop was compromised, and the attacker used it to submit withdrawals. We covered that version yesterday.

By Friday, Binance was changing it. In an update on X, quoted by The Next Web:

“Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.”

Co-CEO Richard Teng went further, saying “the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.”

It wasn’t one laptop, and it wasn’t one night either. According to TRM Labs, the attacker started preparing at least 36 hours before the money moved.

This is a follow-up. Figures are as of Friday, October 30, and are still moving. Binance hasn’t published a root cause.

---

What’s New Since Yesterday

Attack vector	No longer “a compromised laptop.” Binance now says “additional points of breach” and “multiple factors”. Root-cause report to follow
Total stolen	Binance: ~$6.3B. TRM: ~$6.36B. Chainalysis: ~$6.4B (up from $5.912B in its first estimate)
Prep time	At least 36 hours (TRM)
Still unfrozen	420,000+ ETH and 18,270 BTC, about $2.4B (TRM, as of 00:30 UTC Oct 30)
Frozen	~$2.7B on-chain per TRM. Binance says ~$3B
Binance’s backstop	$6.34B earmarked. About $1.3B of it still has to be bought
Withdrawals	Still suspended. Teng: on track for “within 40 hours”, before the Sunday deadline
Proof of reserves	Binance is targeting Monday, Nov 2 for an initial report (The Block)
Attribution	TRM, Chainalysis and Elliptic point to North Korea. Binance hasn’t named anyone

---

The 36-Hour Rehearsal

TRM Labs published the most detailed timeline so far. Here it is in order:

1. October 28, morning. The attacker’s operator wallet “received three small withdrawals from Tornado Cash.” That’s gas money, and it’s untraceable.
2. October 29, during the day. The operator “deployed a first piece of code for the attack and tested it on two wallets. Later that day, it rehearsed the final version on a third wallet.”
3. 20:05 UTC. Money starts leaving. Between 20:05 and 20:09, five Binance wallets sent out 233.46 million XRP.
4. 20:20 UTC. The operator submits one transaction carrying 50 EIP-7702 authorizations. Each one hands control of a Binance wallet to “a sweeper contract that accepts instructions only from the operator.” The 50 signatures had been prepared in advance for 50 consecutive nonces, so at least one would still be valid when the transaction landed.
5. 3 minutes 24 seconds later. The 167,464 ETH transfer goes out.
6. Most of it was gone in about 20 minutes. More sweeps followed at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC, across about ten chains.

According to Immunefi’s Simone Imbrescia, quoted by The Block, the sweeper contract was “only around 130 lines.”

This is why “no private key leak” was technically true but didn’t help. The attacker didn’t need the keys. They needed Binance’s systems to sign one delegation, and they had prepared 50 to make sure it went through. Whatever the “additional points of breach” turn out to be, someone had enough access to get those authorizations signed and was patient enough to test it twice first.

---

The $2.4 Billion Nobody Can Freeze

Stablecoin issuers moved fast. TRM has Tether freezing 971.1M USDT in the main receiving wallet at 21:01 UTC and Circle freezing 823M USDC at 21:04 UTC, a bit under an hour after the first outflows. (Tether’s Paolo Ardoino has put Tether’s total at over $1.57B across wallets.) TRM counts about $2.7B frozen on-chain overall.

The attacker seems to have expected that. TRM says about 325M USDT was dumped to “professional fillers and market makers” for about 122,300 ETH before it could be frozen. That’s an implied price near $2,650 per ETH when ETH was trading around $2,300 to $2,350, so the attacker accepted a haircut of more than 10% to get out of something freezable. Elliptic puts losses on some swaps at up to 26%.

According to TRM, the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion “beyond any issuer’s reach.”

---

Binance’s Bill

On Friday, Binance said it has set aside $6.34 billion of its own funds to cover users. The Block reports the breakdown:

• About $5B is already held in the affected assets.
• The other ~$1.3B has to be bought on the market and through OTC, which Binance warned “could take longer because of thin liquidity and settlement delays.”
• The ~$3B frozen by partners is not counted in that reserve. If it comes back, it’s upside.

Teng: “Your money is safe, and we’re covering every loss.”

Users will find out whether that’s true when withdrawals reopen. Teng said Friday they’re on track to resume “within 40 hours”, ahead of the Sunday deadline. An initial proof-of-reserves report is targeted for Monday.

---

Washington Weighs In

• President Trump, at a Friday press conference, said he’s looking into it. He noted Binance says customers will get their funds back, then added: “But it’s a hack. That’s the problem.”
• CFTC Chair Michael Selig, earlier on CNBC: “The real issue here is that these are unregulated offshore exchanges.”

Expect “the largest hack in history happened offshore” to come up in every market-structure argument on the Hill for the rest of the year.

---

Why This Matters for Crypto Jobs

Yesterday’s lesson was “secure the laptops.” Today’s is harder: Binance’s own security team needed a day to find out the laptop wasn’t the whole story.

• Signing-infrastructure security. The attack worked by getting a production hot wallet to sign EIP-7702 delegations. Every exchange and custodian is now auditing which systems can request a signature, what policy engine checks it, and whether a 7702 authorization to an unknown contract gets blocked automatically. People who understand account abstraction, MPC/HSM signing flows and transaction policy are going to be very busy.
• Detection engineering. The attacker funded a wallet through Tornado Cash and ran test deployments against three wallets more than a day before the theft, and none of it stopped the attack. Teams that monitor on-chain pre-attack signals and alert on them will get budget.
• Incident response and forensics. “Laptop” became “additional points of breach” within a day. Firms that can scope a breach correctly the first time, and the DFIR people who can do it, are worth a lot more this week.
• Treasury and OTC desks. Binance has to buy about $1.3B of assets in thin markets without moving the price. That’s work for execution traders and OTC desks.
• Policy and compliance. Every senator now has a $6B example. Exchange policy teams and compliance leads will spend Q4 answering for it.

The root-cause report Binance publishes will become the checklist every other exchange’s security team gets measured against. If you’re the one who can answer “could this happen here?” with evidence, you’re in demand.

---

Want to work in crypto security, infra or compliance? Browse thousands of open Web3 roles at Cryptogrind, updated daily.