Key Highlights:
- Binance co-CEO Richard Teng confirmed that the record $6.3 billion security breach involved multiple compromise points beyond an initially suspected employee laptop.
- Attackers deployed a self-destruct mechanism to destroy forensic evidence and leveraged Ethereum’s EIP-7702 account-delegation feature to bypass hot wallet approval protocols.
- Binance has paused customer withdrawals while overhauling infrastructure, with a target to restore withdrawal services by Sunday.
Investigation Details Scope of Record $6.3 Billion Security Breach
Binance has uncovered evidence of broader infrastructure compromises during its ongoing investigation into the unprecedented $6.3 billion exploit, according to co-CEO Richard Teng. Speaking via a video statement shared on social media platform X on Friday, Richard Teng clarified that the intrusion extended past the single employee laptop that was first suspected as the primary point of failure. The cryptocurrency exchange is currently conducting a comprehensive forensic audit to establish the exact sequence of events that enabled the massive unauthorized transfer of funds.
Describing the sophisticated nature of the cyberattack, Richard Teng disclosed that the threat actors utilized self-destructing code designed to systematically erase digital footprints and hinder incident response efforts. Furthermore, the attackers managed to circumvent Binance’s standard internal transaction authorization workflows by exploiting Ethereum’s EIP-7702 account-delegation feature. This mechanism allowed the perpetrators to seize administrative control over an exchange hot wallet and orchestrate transactions without triggering Binance’s typical internal approval procedures.
Account-Delegation Exploited to Drain Billions in Minutes
This was a complex attack,
Teng said, adding that investigators had found additional points of breach but had yet to determine the full sequence of events. The technical mechanics behind the breach align with prior analysis reported by CoinDesk, which highlighted how the attackers weaponized the account-delegation method. By improperly acquiring wallet permissions, the threat actors injected malicious code that enabled the siphoning of approximately $2.5 billion within just minutes, underscoring the automated speed and coordination behind the exploit.
In response to the exploit, Binance initiated an immediate freeze on all user withdrawals to contain the incident and safeguard remaining platform assets. The digital asset exchange is currently in the process of auditing, rebuilding, and verifying its core technical environments. Richard Teng noted that Binance aims to restore withdrawal functionality by Sunday, setting an operational target of approximately 40 hours as engineering teams perform stress tests across every critical component of the platform.
Why This Matters
The scale of the $6.3 billion attack marks one of the most severe cybersecurity incidents in cryptocurrency history, raising fundamental questions about institutional wallet security and smart contract features such as EIP-7702 account abstraction. As the industry’s largest centralized trading venue, Binance’s response serves as an immediate stress test for digital asset custody protocols. Binance is currently conducting thorough reviews of its enterprise cloud systems, internal employee hardware, transaction-signing protocols, and private-key management architectures to eliminate residual vulnerabilities prior to reopening customer fund access.
Frequently Asked Questions
What caused the Binance hot wallet breach?
While the initial assessment pointed to a compromised employee device, Binance’s investigation revealed multiple attack vectors. The perpetrators exploited Ethereum’s EIP-7702 account-delegation feature to manipulate hot wallet permissions, bypass Binance’s internal verification procedures, and deploy self-destructing code to conceal their forensic trail.
When will Binance reopen user withdrawals?
Binance co-CEO Richard Teng stated that the platform aims to resume withdrawals by Sunday, within roughly 40 hours of his Friday announcement, pending successful completion of infrastructure rebuilding, private-key reviews, and system-wide security testing.
How much capital was stolen during the exploit?
The total breach accounted for a record $6.3 billion in compromised funds, with approximately $2.5 billion drained in a matter of minutes through automated, malicious hot wallet delegation commands.
