The official account changed three times in 24 hours. The process itself is more worth watching than the conclusion.
First, the explanation was that "a DevOps engineer’s laptop may have been compromised." Then Binance co-CEO Richard Teng’s account escalated: the attacker abused EIP-7702 to bypass standard verification, and the funds were moved out in about 20 minutes. More than one person was involved, and they used a "self-destruct mechanism" to destroy tools and traces as they went. Third, Binance now says it has "begun recovering some of the funds."
Law enforcement has also formally entered the picture. The FBI said it is aware of the matter and involved. The U.S. Secret Service, the lead federal agency for financial crimes, said it is working "around the clock" to identify, freeze, track, and recover the funds, in coordination with the U.S. Attorney’s Office for the District of Columbia. At a press conference, Trump was asked directly whether North Korea was responsible. He replied that they don’t know yet and that the FBI is investigating.
What I’m more focused on is that "self-destruct mechanism." It directly undermines traceability, and also explains why racing to freeze the funds is more important than tracking them afterward: once on-chain funds are converted to ETH, they can’t be frozen. They can only be stopped in the few minutes when they’re still stablecoins.
There are three verifiable milestones to watch next. Ignore the narrative and look at what gets delivered: Binance has committed to publishing a full proof-of-reserves report on Monday; withdrawals will resume after rigorous testing, which Teng says should take about 40 hours; and there will be a follow-up disclosure on recovery progress.
Teng also added one point worth remembering: Binance doesn’t use customer funds, and the vast majority of assets are held in cold wallets, with some transferred to hot wallets only when withdrawals are made. Whether that claim holds up, Monday’s reserves report will be the first test.
First, the explanation was that "a DevOps engineer’s laptop may have been compromised." Then Binance co-CEO Richard Teng’s account escalated: the attacker abused EIP-7702 to bypass standard verification, and the funds were moved out in about 20 minutes. More than one person was involved, and they used a "self-destruct mechanism" to destroy tools and traces as they went. Third, Binance now says it has "begun recovering some of the funds."
Law enforcement has also formally entered the picture. The FBI said it is aware of the matter and involved. The U.S. Secret Service, the lead federal agency for financial crimes, said it is working "around the clock" to identify, freeze, track, and recover the funds, in coordination with the U.S. Attorney’s Office for the District of Columbia. At a press conference, Trump was asked directly whether North Korea was responsible. He replied that they don’t know yet and that the FBI is investigating.
What I’m more focused on is that "self-destruct mechanism." It directly undermines traceability, and also explains why racing to freeze the funds is more important than tracking them afterward: once on-chain funds are converted to ETH, they can’t be frozen. They can only be stopped in the few minutes when they’re still stablecoins.
There are three verifiable milestones to watch next. Ignore the narrative and look at what gets delivered: Binance has committed to publishing a full proof-of-reserves report on Monday; withdrawals will resume after rigorous testing, which Teng says should take about 40 hours; and there will be a follow-up disclosure on recovery progress.
Teng also added one point worth remembering: Binance doesn’t use customer funds, and the vast majority of assets are held in cold wallets, with some transferred to hot wallets only when withdrawals are made. Whether that claim holds up, Monday’s reserves report will be the first test.
