Binance co-CEO Richard Teng says the industry must learn from the $6.3 billion Binance hack. Hackers combined a new Ethereum (ETH) feature, fake recruiters and AI techniques, raising questions about new crypto tools.
Yet one Ethereum researcher says the feature itself is not broken. ETH holders on exchanges could be exposed through custodians’ signing systems rather than the upgrade.
What Does Teng Say the Industry Should Learn From the Binance Hack?
Teng told CNBC on Tuesday that Binance published a detailed report so the industry can learn from it. He cited an FBI attribution to North Korea and a campaign built over months.
The campaign began with a fake developer tool in June, he said, then fake recruiter interviews in September. Attackers then moved through internal AI tools to the system that authorized wallet transactions.
On October 29, they exploited a new Ethereum feature that kept funds moving after Binance paused withdrawals, Teng said. On Ethereum, one wallet lost about 167,464 ETH and $1.6 billion in Tether (USDT).
Researchers identify it as EIP-7702, an Ethereum upgrade from May 2025 that lets ordinary wallets borrow smart-contract code, Gizmodo reported.
Blockaid, a blockchain security firm, found the attacker bundled 50 signed authorizations into one transaction. Binance cleared the delegation nearly four hours later, per a detailed account of how the hack happened.
Does New Technology Raise Risk or Move It?
Ethlabs researcher Derek Chiang argued that EIP-7702 is not broken, though it made the theft faster and more efficient. Holders using wallets that support the feature, such as MetaMask, need not panic, he added.
AI tools also featured in Teng’s account, both as attacker techniques and as an internal route to the signing system.
Binance says it has replenished 98% of affected assets, rebuilt the wallet system, replaced devices, and cancelled linked credentials. It is also working with law enforcement and industry partners to trace and freeze stolen funds.
If the independent review Teng promised confirms signer compromise, risk sits with exchange custody design rather than new features alone. A flaw in a feature itself would change that read.
