How did hackers breach Binance? Co-CEO shares details of $6.3 billion heist

New Delhi: Binance has reserved more than $6.34 billion in company funds to cover losses from what is being described as the largest cryptocurrency heist on record. The exchange has already set aside $5 billion in the exact digital assets affected by the attack, while the remaining amount is being purchased through market and over-the-counter (OTC) channels.

The latest announcement comes as Binance co-CEO, Richard Teng, disclosed fresh details of how the attackers bypassed the exchange’s security controls to access its hot wallet. The company said its investigation had uncovered additional points of breach beyond the compromised employee laptop initially suspected of being involved.

How hackers breached Binance: Co-CEO reveals

In an update on the investigation, Teng said the attack was not carried out by a single person and involved a complex sequence of actions. The initial findings pointed to a potentially compromised laptop belonging to a DevOps engineer, but investigators subsequently identified further points of breach.

The attackers also deployed a self-destruct mechanism that deleted two connected traces as they were being generated. This made it harder for investigators to reconstruct the attack and trace the activity.

Revealing a key technical detail, Teng said the attackers exploited Ethereum’s EIP-7702 mechanism to obtain on-chain execution approval over a Binance hot wallet. The authorization bypassed the exchange’s normal approval controls, allowing the attackers to execute unauthorized transactions.

The affected wallet belonged to Binance itself, rather than its customers, Teng said. He added that the exchange had found no evidence of customer funds being compromised and that most user assets were held in cold wallets as part of its security architecture.

Binance freezes $3 billion, begins asset recovery

Binance said it had begun recovering affected assets and was working with law enforcement agencies, blockchain intelligence firms, token issuers and other industry partners. Approximately $3 billion in assets has been frozen so far through these efforts.

Of the $6.34 billion reserved by the exchange, $5 billion is already held in the same token assets affected by the attack, including USDC, USDT, Bitcoin, Ether and BNB. Binance is purchasing the remaining amount to match the affected assets and address any shortfalls.

Binance is rebuilding its withdrawal service following the incident and will not restore it until the infrastructure has been retested. Teng said the company was hopeful that users would be able to withdraw their funds before Sunday.

The exchange is also carrying out a comprehensive security review covering employee devices, cloud infrastructure, key management and transaction-signing systems. The review will examine the systems involved in authorizing and processing withdrawals.

Binance is also preparing a full proof of reserves report, which Teng said would be published by Monday. The report will provide public verification of user holdings as the exchange continues its recovery efforts. Teng thanked industry partners for freezing the affected assets and law enforcement agencies for their cooperation. He also acknowledged users’ patience, saying the company remained committed to recovering the stolen assets and restoring their trust.