TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Binance co-CEO Richard Teng said the exchange’s investigation found additional security breaches beyond a potentially compromised employee laptop. Withdrawals remain suspended while Binance rebuilds and tests its systems, with a Sunday restart as its target; the full attack sequence is still unknown.
Binance’s investigation into the reported $6.3 billion exploit has found additional security breaches beyond an initially suspected employee laptop, co-CEO Richard Teng said Friday. The exchange has suspended withdrawals while it rebuilds and tests infrastructure, and is targeting Sunday to resume withdrawals, though the full sequence of the attack remains undetermined.
In a video statement posted on X, Teng said attackers used a mechanism that erased evidence and exploited Ethereum’s EIP-7702 account-delegation feature to take control of a hot wallet without following Binance’s usual approval procedures. He described the incident as a complex attack and said investigators had identified additional breach points but had not established how events unfolded in full.
Binance is reviewing its cloud systems, employee devices, private-key management and transaction-signing procedures as it rebuilds and tests its infrastructure. Teng said the company hoped to restore withdrawals by Sunday, approximately 40 hours after his statement. That is a target, not confirmation that withdrawals will be available by then.
Teng reiterated that Binance would cover the stated $6.3 billion in losses with company funds. He said the exchange had reserved more than $6.34 billion, including $5 billion already held in the affected cryptocurrencies, and was buying the remaining assets through exchanges and over-the-counter markets. He also said the attack targeted Binance’s hot wallet rather than customer funds; CoinDesk’s examination of reserve data found that the compromised wallets had previously appeared in a list of assets backing customer balances.
Withdrawal Access and Loss Coverage
The incident affects both access to funds and confidence in exchange safeguards. With withdrawals suspended, customers cannot use the service to move assets off Binance while the exchange rebuilds and checks the systems involved. A Sunday restart would mark a return of that function, but the stated timeline remains subject to testing.
There is also a material distinction between Binance’s assurance that the attack targeted its own hot wallet and the reserve-data finding reported by CoinDesk. The wallets’ previous inclusion in a list of assets backing customer balances does not, on its own, establish that customer balances were lost; it does leave questions about how the wallet was categorized and represented. The exchange’s planned reserve update and fuller report may help clarify that point.
Binance’s commitment to fund the losses and its stated reserve amount describe the company’s response, not an independent verification of the amount, availability or recovery of assets. The planned reporting and continuing investigation will matter to customers seeking clarity on both the breach and the exchange’s backing.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How the Wallet Was Compromised
The attack involved EIP-7702, an Ethereum account-delegation feature that can allow an account to delegate control. CoinDesk’s earlier reporting described how the attacker obtained wallet permissions and used malicious code to drain about $2.5 billion in minutes. That figure concerns the rapid draining described in the earlier report; the current report identifies the overall exploit as $6.3 billion.
Binance initially suspected a compromised employee laptop. Teng’s Friday statement expanded the investigation beyond that possibility, citing additional breach points and an effort by attackers to erase evidence. The new disclosure does not yet provide a complete timeline or explain how each breach point contributed to the wallet compromise.
Open Questions in the Investigation
The full attack sequence and the relationship among the breach points remain unknown, according to Teng. Binance has not yet detailed how the attackers gained access, how the evidence-erasing mechanism operated, or how the additional security breaches enabled control of the hot wallet.
It is also not yet clear whether withdrawals will restart by Sunday, since Binance described that timing as a goal dependent on rebuilding and testing. The difference between the exchange’s statement that its hot wallet was targeted and the wallet’s earlier appearance in reserve data has not been fully explained. The reported amounts of losses and reserves have not been independently verified in the source material.
Sunday Restart and Monday Report
Binance says it is aiming to restore withdrawals by Sunday after rebuilding and testing its infrastructure. Customers and other observers will be watching for confirmation that withdrawals have resumed and for any revised timing if the checks take longer than expected.
Teng said Binance plans to publish an initial proof-of-reserves update before releasing a full report Monday. The exchange is also working with law enforcement, blockchain investigators and token issuers to recover stolen assets. Those updates may provide more detail on the breach, the affected wallets and the recovery effort, but the investigation is ongoing.
Key Questions
What did Binance discover in the investigation?
Co-CEO Richard Teng said investigators found additional security breaches beyond an initially suspected compromised employee laptop. He said attackers also used an evidence-erasing mechanism and Ethereum’s EIP-7702 account-delegation feature to gain control of a hot wallet.
When does Binance expect withdrawals to resume?
Binance is targeting Sunday, approximately 40 hours after Teng’s Friday statement. The exchange has not confirmed a restart; it says infrastructure must be rebuilt and tested first.
Did Binance say customer funds were stolen?
Teng said the attack targeted Binance’s own hot wallet rather than customer funds and reiterated that the company would cover the reported losses. CoinDesk found that the compromised wallets had previously appeared in a list of assets backing customer balances; the significance of that discrepancy has not been fully explained.
What updates are expected next?
Teng said Binance plans an initial proof-of-reserves update before a full report Monday. The exchange is also working with law enforcement, blockchain investigators and token issuers to try to recover stolen assets.
Source: coindesk.com
