Theory Open
Questions raised about approval controls during the 20-minute transfer
TRM Labs and WIRED report that most of the money left in about 20 minutes. Kok Tin Gan of NyxLab told NPR the event raises questions about why stronger approval controls were not in place. Binance co-CEO Richard Teng said the attacker's delegation did not pass through normal approval controls.
This is a theory, not an established fact. First seen . Updated .
What the evidence does and does not show
Sources agree the main drain took about 20 minutes, with one Ethereum transaction of about $2.53B at 20:24 UTC. Blockaid says it flagged the drain under two minutes after the sweep and that the delegation was visible on-chain for 3 minutes 24 seconds before it. Hacken says the delegation stayed in place for 3 hours 46 minutes and that nobody outside Binance knows whether a policy layer was set. In the sources captured as of 2026-11-01, Binance has not said when it first detected the transfers or what limits its signing system applied. The attacker destroyed tooling and traces, Teng said, which complicates the investigation. The post-mortem Binance promised should answer these points.
Evidence
Evidence for (5)
Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.
Hacken. Captured . Original
Note: Policy layer unknown. (in the sources captured as of 2026-11-01)
At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again
Hacken. Captured . Original
Note: Delegation stayed 3 hours 46 minutes.
The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.
Kok Tin Gan, npr.org. Captured . Original
Note: Questions about approval controls.
The delegation itself was visible onchain for three minutes and 24 seconds before the sweep
blockaid.io. Captured . Original
Note: Delegation visible for 3 minutes 24 seconds before the sweep.
Blockaid’s detection flagged the drain under two minutes after the sweep and before any public report
blockaid.io. Captured . Original
Note: An outside firm flagged it within two minutes.
Evidence against (1)
Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.
Richard Teng, Cointelegraph. Captured . Original
Note: Teng says the attacker destroyed tooling and traces.
Context (6)
Most of the money left in about 20 minutes, and a smaller second wave hit Avalanche and Polygon around 23:05 UTC.
Hacken. Captured . Original
Note: Hacken agrees on about 20 minutes.
Hacken said stablecoin issuers began freezing funds 56 minutes after the first transfer.
Stablecoin issuers began freezing funds 56 minutes after the first transfer.
Hacken. Captured . Original
Note: First freezes 56 minutes after the first transfer.
Cap value and rate per wallet at the signer and hold new destinations for a second approval
Hacken. Captured . Original
Note: Hacken's suggested limits.
The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs.
WIRED. Captured . Original
Note: Most funds taken in about 20 minutes.
The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”
Richard Teng, Cointelegraph. Captured . Original
Note: Delegation did not pass through normal approval controls.
Cointelegraph reported that concerns were first raised by blockchain researcher Spreek on X.
Concerns were first raised by blockchain researcher Spreek, who
Spreek, Cointelegraph. Captured . Original
Note: An on-chain researcher raised the first alert.