Binance finds more breach points in $6.3 billion hack, targets Sunday withdrawal restart
Binance says the hack was bigger than first thought
Binance's investigation into the record $6.3 billion hack has found more security breach points than the initially suspected compromised employee laptop, co-CEO Richard Teng said Friday in a video statement on X. He set a Sunday target to restore withdrawals, which are currently suspended.
Teng said the attackers erased evidence using a self-destruct mechanism and took control of a hot wallet — an internet-connected wallet an exchange uses for everyday transfers — without going through Binance's normal approval procedures. He called it a complex attack and said investigators have not yet determined the full sequence of events.
Key points from Teng's statement
- Attackers abused an Ethereum feature called EIP-7702, which lets an account temporarily delegate its permissions to another address, to seize a hot wallet.
- About $2.5 billion was drained in minutes using malicious code, according to CoinDesk's earlier examination of the account-delegation method.
- Withdrawals have been suspended while Binance rebuilds and tests its infrastructure. The Sunday restart is roughly 40 hours away as of Teng's statement.
- Binance is reviewing its cloud systems, employee devices, private-key management and transaction-signing procedures.
How Binance plans to cover the losses
Teng reiterated that Binance has committed to cover the full $6.3 billion in losses using company funds. He said more than $6.34 billion has been reserved, including $5 billion already held in the affected cryptocurrencies. The remaining assets are being bought through exchanges and over-the-counter (OTC) markets, where trades happen directly between parties rather than on a public order book.
Whose money was hit? The sources disagree
Teng said the attack targeted Binance's own hot wallet rather than customer funds. However, a separate CoinDesk examination of Binance's reserve data found the compromised wallets were previously listed among the assets backing customer balances. That disagreement is not yet resolved.
What happens next
Binance plans to publish an initial proof-of-reserves update — a public showing of the assets it holds to back customer deposits — before releasing a full report on Monday. The exchange is also working with law enforcement, blockchain investigators and token issuers to recover the stolen assets.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.