The cryptocurrency landscape was rocked on Thursday when hackers made off with approximately $6.3 billion from Binance, marking the largest digital asset theft in financial history. The staggering breach has sent shockwaves through the global crypto economy, prompting immediate containment efforts from industry partners, a temporary freeze on select decentralized finance services, and an intense, ongoing investigation into how the attackers bypassed multiple layers of security to drain hot wallets across multiple blockchains.
As customers anxiously await the resumption of withdrawals, blockchain intelligence firms, exchange executives, and cybersecurity experts are piecing together the timeline and methodology behind the unprecedented attack. According to data from TRM Labs, the first unauthorized transfers began at approximately 8:05 pm UTC on Thursday. The perpetrators methodically targeted hot wallets—digital asset storage systems that exchanges deliberately keep connected to the internet to facilitate fast, automated processing of user withdrawals.
The scale of the breach immediately drew comparisons to previous major incidents, with TRM Labs attributing the coordinated offensive to North Korea’s notorious TraderTraitor cybercrime syndicate. US federal authorities, including the Federal Bureau of Investigation, have previously linked the same group to massive financial exploits, such as the $1.5 billion Bybit theft in February 2025. Despite the circulating intelligence reports and attribution from independent blockchain analysts, Binance leadership has maintained a cautious stance regarding public confirmation of the attackers’ identity.
Binance Co-CEO Richard Teng addressed the nature of the exploit in public statements, emphasizing the sophistication and multi-layered execution required to breach the exchange’s infrastructure. To be clear, the attacker did not simply use one engineer’s permissions, and this was not a single one-click action, Teng noted, adding that the ongoing internal and external investigations have not yet formally attributed official responsibility to any specific individual or external group.
In the wake of the theft, swift coordination among industry partners resulted in the freezing of roughly $3 billion in affected digital assets before the bad actors could fully launder or disperse them. Meanwhile, Binance moved aggressively to reassure the market regarding its solvency and commitment to covering the shortfall. The exchange announced that it had reserved more than $6.34 billion in company funds specifically designated to cover the losses. This reserve figure includes approximately $5 billion in the affected tokens that were already held directly in Binance’s custody at the time of the incident.
However, navigating the logistics of the asset recovery and token replacement strategy has proven complex. The $5 billion allocation excludes the funds that have been frozen by external industry partners, and Binance disclosed that it is actively purchasing the remaining necessary tokens through a combination of open-market exchanges and over-the-counter deals. When questioned about the specifics, a Binance spokesperson confirmed to Cointelegraph that the $5 billion in replacement cryptocurrency was safely in the exchange’s custody, though they declined to disclose specific wallet addresses, citing necessary security precautions. Independent security firms, such as CertiK, have noted that they require more comprehensive data and visibility to independently verify these reserve holdings. Furthermore, industry observers have cautioned that frozen funds are not automatically recovered funds, and Binance has yet to publish a definitive breakdown of how much stolen crypto has actually been brought back under its direct operational control.
EIP-7702’s role in the hack comes under scrutiny
As technical post-mortems began to circulate, Ethereum’s recent EIP-7702 upgrade came under intense scrutiny from the cybersecurity community after investigators observed that attackers leveraged the feature to help drain a Binance wallet. EIP-7702 is a modern Ethereum upgrade designed to allow standard externally owned wallets to temporarily authorize smart contract code to act on their behalf, improving user experience and flexibility.
Ido Ben-Natan, CEO of blockchain security firm Blockaid, explained that while the attackers could theoretically have orchestrated the theft through other vectors, compromised signing systems combined with EIP-7702 capabilities likely allowed them to bypass traditional safeguards and drain vast quantities of assets in a single, streamlined sweep. Echoing these technical observations, Richard Teng elaborated that the attacker utilized an EIP-7702 delegation method to illicitly gain execution authority over a hot wallet, bypassing Binance’s standard multi-layered approval controls. Compounding the difficulties faced by forensic investigators, Teng noted that the attackers deployed a self-destruct mechanism designed to deliberately destroy specific tools and digital traces, making the root-cause analysis significantly more challenging.
Binance stated that its joint forensic investigations with external security partners had uncovered additional vectors and breaches beyond the initially suspected compromised laptop. Crucially, the exchange reported no concrete evidence indicating that core wallet private keys had been directly leaked or compromised. Binance management indicated that it expects to share further technical findings and comprehensive post-mortem details with the public within approximately 48 hours.
On-chain analytics firm Chainalysis tracked the movement of the stolen funds, observing thousands of transactions executed in rapid succession. This high-velocity activity strongly indicated the use of automated laundering techniques, with stolen funds circulating through a labyrinth of intermediary addresses before periodically cycling back to wallets that had been utilized earlier in the attack sequence.
Binance users await withdrawals reopening
The sheer magnitude of the breach sent immediate tremors through the broader digital asset market, triggering defensive reactions across the decentralized finance ecosystem. Notably, prominent decentralized lending protocol Aave implemented a precautionary freeze on new deposits and borrowing markets to insulate its liquidity pools from potential contagion. Following stability assessments, Aave successfully reopened its markets on Friday afternoon, even as Binance’s internal withdrawal mechanisms remained fully suspended.
Binance communicated its phased recovery plan to the global user base, stating in a Friday update that it aimed to begin reopening user withdrawals in a controlled, multi-stage rollout starting Sunday, November 1, provided all necessary internal and external security checks are successfully completed. Meanwhile, user deposits and other unaffected exchange services remained operational throughout the containment period.
To reinforce market confidence and transparency, Binance outlined plans to publish an initial proof-of-reserves snapshot within 12 hours of its announcement, with comprehensive verification reports scheduled for release by Monday. The forthcoming report is intended to provide a clear, cryptographically verifiable accounting of the assets currently held in Binance reserves and to demonstrate the full backing of customer balances following the historic security incident.
Comments (0)