Binance’s withdrawal shutdown during a $6.3 billion cryptocurrency breach did not immediately terminate unauthorized activity from one of its Ethereum wallets, according to blockchain investigators, exposing a gap between the exchange’s emergency restrictions and its underlying transaction controls.
Blockchain analytics firm Bitquery identified the final unauthorized Ethereum transfer at 23:56 UTC on October 29, more than an hour after Binance had publicly indicated that withdrawals were suspended. The malicious authorization was not revoked until 00:10 UTC on October 30.
The findings raise questions about whether Binance’s customer-facing withdrawal suspension and internal wallet security measures operated independently during the attack.
Sponsored · Cambria Gold Mines
Binance disclosed an estimated $6.3 billion incident impact on October 30, making it the largest cryptocurrency theft reported to date. The exchange said approximately $3 billion had been frozen and pledged to cover customer losses.
According to Bitquery, unauthorized transactions affected 17 Binance hot wallets across nine blockchains between 20:04 and 23:56 UTC on October 29.
The most significant Ethereum transfer occurred at 20:24 UTC, when approximately 167,464 ETH, 1.6 billion USDT, and dozens of other tokens left a Binance wallet.
Investigators at TRM Labs identified 50 pre-signed authorizations involving Ethereum’s EIP-7702 mechanism, which allows an externally owned wallet to execute delegated smart-contract code.
Sponsored · Selkirk Copper Mines
The technique enabled attacker-controlled code to operate through an authorized Binance wallet. Bitquery’s reconstruction indicates that the malicious authorization remained active for approximately three hours and 50 minutes.
Binance said its preliminary investigation pointed to a compromised DevOps engineer’s laptop that may have provided access to an internal service container used to submit unauthorized withdrawals.
The company said it found no evidence that wallet private keys had leaked.
The exchange’s financial exposure remains unresolved. Bitquery calculated that approximately $2.7 billion had been frozen or rescued through actions involving stablecoin issuers and blockchain operators. It identified another $3.2 billion in attacker-controlled wallets as of 06:43 UTC on October 30.
The firm also reported that $729 million in stolen USDT had been exchanged into other cryptocurrencies before freezing measures took effect.
Binance has pledged to reimburse losses using its Secure Asset Fund for Users and corporate resources. Reuters reported that the emergency fund held approximately $1 billion in bitcoin, substantially below the estimated incident impact.
The attack also disrupted cryptocurrency markets. Reuters reported bitcoin falling to $76,368, while Coinbase Global shares declined 4.8%.
Binance expects withdrawals to begin resuming within 48 hours and has promised a technical post-mortem and updated proof of reserves.
