Binance Hack Update: EIP-7702, the Withdrawal Restart and Is Your Crypto Safe on an Exchange?

Disclosure: Bionic Artisan may earn a commission from some links on this site, at no extra cost to you. This article contains no affiliate links.

Not financial advice: This article is for information only. It is not investment, legal or tax advice. Crypto is volatile and you can lose money. Do your own research and talk to a licensed professional before making decisions.

“Binance” is still one of the biggest searches in the U.S. on Google Trends (200K+ searches since Thursday afternoon), and the story has moved on since our first report, Binance $6.3 Billion Hack: What Happened. Binance now says the attack went beyond one laptop, it named the Ethereum feature the attacker abused (EIP-7702), and it has given a target for turning withdrawals back on. Meanwhile, experts are openly arguing about whether it’s safe to keep crypto on an exchange at all. Here’s what’s new, with sources.

What’s new in the investigation

Binance’s first official update said the incident “may involve a compromised DevOps engineer’s laptop.” In a video on Oct 30, Teng said that was only part of the story, according to the BBC. Binance still says it has found no evidence that wallet private keys leaked. It expects to share more verified technical findings within about 48 hours of its second update, followed by a full post-mortem (Bitcoin.com News).

TRM Labs told the BBC the theft was the “product of long preparation”: an “operator wallet” was funded about 36 hours before the attack, and the signatures needed were likely prepared in advance. Binance has not yet published its own full technical account, so the exact chain of events may change.

What is EIP-7702, in plain English?

EIP-7702 is an Ethereum upgrade that lets a regular wallet (an “externally owned account”) point to smart-contract code, so the wallet can run that code as if it were a smart contract (official EIP-7702 spec). It was built for useful things like batching transactions or letting someone else pay gas fees. The catch: whoever gets that wallet to sign a delegation can make it run their code.

According to a timeline by BlockBeats, the attacker deployed a simple “sweep” contract, got a delegation signed for a Binance hot wallet, and then called that contract through the wallet, so on-chain it looked like Binance’s own wallet was sending normal transfers. Blockchain security firm Hypernative also described compromised signing access and valid signatures from Binance-controlled keys (as reported by Bitcoin.com News). These are third-party analyses, and Binance hasn’t confirmed every step.

Note: Teng described EIP-7702 as a “multi-signature protocol,” but the official spec describes it as a way for regular accounts to set code. The key point is the same either way: the transfers skipped Binance’s normal approval checks.

The money: what’s frozen, covered and still missing

• Reserved: more than $6.34 billion of company funds, including $5 billion already held in the same tokens that were taken (USDC, USDT, BTC, ETH, BNB and others), about 80% of the losses. The rest is being bought on the market and over the counter (Bitcoin.com News).
• Frozen: Binance says about $3 billion has been frozen on-chain. Blockchain analytics firm Elliptic’s own tally put verified freezes at $2.84 billion as of 4 AM ET on Oct 30, mostly USDT and USDC (Bitcoin.com News).
• Proof of reserves: a first snapshot was planned within 12 hours of the second update, with results expected by Monday, Nov 2. A proof-of-reserves report is a point-in-time check of assets against customer balances, not a full audit.

Who did it?

TRM Labs says it has “high confidence” that the North Korea-linked group TraderTraitor (also called Lazarus) is responsible, and Chainalysis says it has a “high degree of confidence” North Korea was behind it, citing stolen funds “commingling” with an earlier hack (BBC). The U.S. Secret Service says it is working “around the clock” to “identify, freeze, trace, and recover funds,” and the FBI says it is “aware of the incident.” No government agency and not Binance itself has publicly confirmed who carried out the attack, and North Korea has always denied involvement in such hacks.

Is it safe to keep crypto on an exchange?

This is the new question people are asking, and the experts CNBC interviewed on Oct 31 don’t agree:

• Be wary: “I think you should be very wary of leaving any significant amount of funds in an exchange… there are no built-in protections for when these inevitable hacks take place,” said Tyler Moore, a cybersecurity professor at the University of Tulsa. Unlike bank deposits, crypto on an exchange has no FDIC-style insurance.
• Exchanges can make you whole: Ido Ben-Natan, CEO of security firm Blockaid, said “I actually think no users will lose any money,” because Binance has said it will cover everything.
• Self-custody has its own risk: Brett Falk of the University of Pennsylvania agreed with Ben-Natan that it’s better to have a company’s financial backing than a self-custody wallet where no one can refund your losses after a hack, CNBC reports.
• Offshore vs. U.S.-regulated: CNBC notes the breach hit Binance’s offshore platform, while its U.S. exchange and U.S.-regulated platforms like Coinbase and Robinhood were not affected. CFTC Chairman Michael Selig said offshore exchanges “don’t have the same sorts of safeguards.”

There’s no one right answer. Keeping coins on an exchange means trusting its security and its promise to cover losses. Holding them yourself means you’re fully responsible for your keys and backups, and no one can reverse a mistake.

What to do this week

• Use only official channels. Watch Binance’s website, app and verified accounts for the withdrawal restart. Big hacks bring fake “refund” and “early withdrawal” scams. Never share your seed phrase, password or 2FA codes.
• Don’t panic-click when withdrawals reopen. A phased restart may be slow. Double-check every withdrawal address, and consider a small test transfer first.
• Check your account security. The BBC suggests reviewing balances and history, logging out of other sessions if anything looks odd, and using an authenticator app or passkey instead of text-message codes.
• If you move to a hardware wallet, buy it from the maker or an authorized seller and set it up yourself; never use a device that arrives with a recovery phrase already filled in.
• Watch leverage. Markets are jumpy. Coinbase shares fell about 11% on Friday after its earnings, with the Binance hack weighing on crypto stocks (Proactive via Yahoo Finance).

What we’re watching next

• Whether Binance actually starts phased withdrawals on its roughly 34-hour target.
• The proof-of-reserves results due Monday, Nov 2.
• Binance’s promised technical findings and full post-mortem.
• Any official attribution from U.S. law enforcement.

Sources: Binance official update (Oct 30, 2026); BBC live coverage (Oct 30); Bitcoin.com News (Oct 30); BlockBeats timeline (Oct 31); CNBC (Oct 31); Proactive via Yahoo Finance (Oct 30); EIP-7702 specification (eips.ethereum.org). Trending data: Google Trends U.S. “Trending now,” checked Oct 31, 2026. Times are Eastern Time (ET). Not financial advice. Images are AI-generated illustrations.