Binance co-CEO Richard Teng: The attack was not a one-click operation with a single engineer’s permissions
On October 30, 2026, Binance co-CEO Richard Teng posted on X that the estimated total impact of this security incident was about $6.3 billion. The attacker did not complete it by using only a single engineer’s permissions, and it was not a single “one-click” operation, but involved a more complex attack process. The investigation has not yet assigned blame to any individual. Preliminary findings show that the incident may have begun when a DevOps engineer’s laptop was compromised, allowing the attacker to access service containers and submit unauthorized withdrawal transactions. No evidence of wallet private key leakage has been found so far.
Teng said that users’ funds are safe, and Binance will cover all losses through the SAFU fund and company funds. It has coordinated with blockchain partners, and about $3 billion in assets have been frozen on-chain. As a precaution, the platform has temporarily suspended withdrawals to complete security upgrades to its withdrawal service and related addresses; deposits are not affected and continue to operate normally. Authorization for the affected addresses has been revoked, and Binance is working with law enforcement and blockchain intelligence partners to track and recover the funds.
Earlier, on October 29, Binance’s official announcement had already confirmed that the preliminary investigation pointed to a DevOps engineer’s laptop being compromised, and that no private key leakage had been found, while promising to cover the losses with SAFU and company funds. Teng’s post further clarified that the attack process was not a simple abuse of a single point of access.
Original sources:
Title: I want to speak to you directly about what happened. Publisher: Richard Teng (@_RichardTeng) Publication date: 2026-10-30 URL: https://x.com/_RichardTeng/status/2116072080525656150 Source type: firsthand post Verification status: the full post was actually read for this report, verification date 2026-10-30 Supporting content: the attack was not based on a single engineer’s permissions, not a “one-click” operation, and involved a more complex process; no blame was assigned to any individual; preliminary indication of a DevOps engineer’s laptop being compromised; no evidence of private key leakage; users’ funds are safe; losses covered by SAFU and company funds; estimated impact of about $6.3 billion, about $3 billion frozen; withdrawals suspended, deposits normal, and other statements
Title: Security Incident Update Publisher: Binance Publication date: 2026-10-29 (as marked on the page) URL: https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7 Source type: official announcement Verification status: the full announcement was actually read for this report, verification date 2026-10-30 Supporting content: preliminary investigation pointed to a DevOps engineer’s laptop being compromised, no evidence of private key leakage, estimated impact of about $6.3 billion, about $3 billion frozen, losses covered by SAFU and company funds, users’ funds are safe, temporary deposit and withdrawal suspension measures, and other statements
ABAB AI Insight
Richard Teng joined Binance in 2021, having previously served for about six years as CEO of the Financial Services Regulatory Authority of Abu Dhabi Global Market, and before that as chief regulatory officer at Singapore Exchange and director of corporate finance at the Monetary Authority of Singapore. In November 2023, he succeeded Changpeng Zhao as Binance CEO, and later became co-CEO alongside Yi He. This post is his direct clarification, in the role of an executive with a regulatory background, in response to external doubts that “a single engineer’s permissions could be enough to carry out a transfer of several billion dollars.”
The core path of this incident is: the attacker gained access to internal service containers through a compromised engineer terminal, then submitted unauthorized withdrawal transactions, rather than directly stealing wallet private keys. Binance said it will cover all losses with the SAFU fund and its own company funds, and has already frozen about $3 billion with partners. This is similar to Bybit’s roughly $1.5 billion incident in February 2025 — at that time, the FBI determined it was carried out by the North Korea-related TraderTraitor organization, and the attacker compromised a third-party Safe developer’s device, manipulated the signing interface rather than directly stealing private keys, and ultimately completed the fund transfer. The key similarity between the two is the use of signing infrastructure rather than the key itself; the difference is that Bybit involved tampering with a cold-wallet multisig process, while Binance’s preliminary indication this time points to an internal service container.
Binance’s rapid emphasis on “not one-click, not a single permission” and its promise of full coverage are intended to shift responsibility from an individual employee to a system-level attack process, while maintaining user confidence in the platform’s solvency. Compared with the industry-wide strengthening of endpoint and signing-process isolation after the Bybit incident, this larger-scale incident once again shows that the hot wallets and withdrawal service containers of major centralized exchanges remain high-value targets, and that even if private keys are not leaked, the integrity of the operational permission chain may still be bypassed.
This clarification changes the external immediate interpretation of Binance’s internal controls: it reframes the event from “a single engineer had too much power” to “a complex attack process,” and makes clear that no individual is being blamed. For Binance, this temporarily reduces accountability pressure on any specific employee, but reinforces the need for it to provide a technical postmortem on endpoint security, service-container permission isolation, and the signing-request process; for the industry, it continues the existing pattern that “private key security does not equal operational security,” and the key observation will be whether Binance’s subsequent technical review discloses the specific permission boundaries and monitoring gaps of the service containers.
ABAB News · Cognition Law
A compromised endpoint does not mean that a single permission was enough to complete a transfer of several billion dollars; a complex attack process still requires coordination across the system-level permission chain.
When there is no evidence of private key leakage, an exchange’s commitment to cover losses depends on its own funds and insurance fund, rather than on the failure of on-chain keys themselves.