The hack happened to Binance’s global centralised exchange, Binance.com.
Binance.us, which provides trading services specifically for US residents, said it has not been affected by the issue.
In an initial announcement, Teng said: “Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop.
“That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions.”
He said the hack “was not a simple ‘one-click’ action” but a “more complex attack process”.
Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, said this could mean an engineer was “talked into taking a test” and malware – malicious software – “landed on their laptop while they did it”.
Because the laptop already had sufficient security privileges, Nandakumara said early reports suggest it became “the attacker’s route straight into production, and from there to the wallets”.
Teng has since said the hack was “not carried out by one person” and the hackers used sophisticated methods to hide their tracks, such as a “self-destruct mechanism”.
“You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened,” said Dr Clive Summerfield, head of FARx, a biometrics in AI security company.