From Cointelegraph · By Yohan Yun
This article summarizes Cointelegraph’s coverage of the Binance hack as it unfolded. See the full timeline for detailed updates here.
Hackers stole about $6.3 billion from Binance on Thursday, in what is now the largest cryptocurrency theft on record.
As with Bybit’s $1.5 billion loss in February 2025 and September’s Bitget breach, onchain investigators attributed Binance’s record-breaking exploit to North Korea-backed hackers.
By Friday morning, the world’s largest exchange said investigators had found additional breach points after initially suspecting that an engineer’s compromised laptop was a possible entry point.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” said Binance co-CEO Richard Teng. “Our investigation has not attributed responsibility to any individual.”
Binance said it had set aside more than $6.34 billion in company funds to cover the losses, including $5 billion held in the same tokens stolen in the hack.
EIP-7702’s role in the hack comes under scrutiny
Ethereum’s EIP-7702 upgrade came under fire after attackers used it to drain a Binance wallet. Blockaid CEO Ido Ben-Natan told Cointelegraph that compromised signing systems likely enabled the theft.
Attackers could have stolen the funds without EIP-7702, but it may have helped them bypass safeguards and drain assets in one sweep, Ben-Natan said.
Teng said that the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without passing Binance’s normal approval controls. A “self-destruct mechanism” destroyed tools and traces, complicating the investigation, he said.
Chainalysis observed thousands of transactions in quick succession that could indicate automated laundering, with funds circulating among addresses and sometimes returning to wallets used earlier.
Binance users await withdrawals reopening
The theft rattled crypto prices and prompted a precautionary freeze on new deposits and borrowing at decentralized lender Aave. Aave reopened its markets Friday afternoon, while Binance’s withdrawals remained suspended.
Teng said Binance was rebuilding its withdrawal service and conducting a company-wide security review.
Binance aims to resume withdrawals within 40 hours of Teng’s Friday update and to publish a full proof-of-reserves report by Monday.
Magazine: Tampered Ledger reported in Singapore a month before news broke: Asia Express