This recap summarizes Cointelegraph’s reporting on the Binance hack and has been updated with the exchange’s latest statements. The investigation is ongoing, and figures and recovery timelines may change. See our archived live coverage for the original timeline.
Hackers stole about $6.3 billion from Binance on Thursday, in what is now the largest cryptocurrency theft on record. Industry partners have frozen roughly $3 billion in affected assets, while customers await the reopening of withdrawals.
TRM Labs traced the first unauthorized transfers to around 8:05 pm UTC Thursday, with Binance wallets drained across multiple blockchains. The attackers targeted hot wallets, which exchanges keep connected to the internet to process withdrawals.
TRM attributed the attack to North Korea’s TraderTraitor group, which the US Federal Bureau of Investigation blamed for the $1.5 billion Bybit theft in February 2025. Binance has not publicly confirmed the attackers’ identity.
Binance said it had reserved more than $6.34 billion in company funds to cover losses, including $5 billion already held in the affected tokens. However, that allocation excludes the frozen assets, and the exchange said it was buying the remaining tokens through exchanges and over-the-counter deals.
A spokesperson told Cointelegraph the $5 billion was in Binance’s custody but declined to disclose wallet addresses, citing security concerns. Security firm CertiK said it needed more information to verify the holdings independently.
EIP-7702’s role in the hack comes under scrutiny
Ethereum’s EIP-7702 upgrade came under fire after attackers used it to drain a Binance wallet. EIP-7702 is a feature that lets a wallet authorize software to act on its behalf. Blockaid CEO Ido Ben-Natan told Cointelegraph that compromised signing systems likely enabled the theft.
Attackers could have stolen the funds without EIP-7702, but it may have helped them bypass safeguards and drain assets in one sweep, Ben-Natan said.
Teng said that the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without passing Binance’s normal approval controls. A “self-destruct mechanism” destroyed tools and traces, complicating the investigation, he said.
Binance said investigators had also uncovered additional breaches beyond the initially suspected compromised laptop. However, it reported no evidence that wallet private keys had leaked and said it expected to share further technical findings within about 48 hours.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” said Binance co-CEO Richard Teng. “Our investigation has not attributed responsibility to any individual.”
Chainalysis observed thousands of transactions in quick succession that could indicate automated laundering, with funds circulating among addresses and sometimes returning to wallets used earlier.
Binance users await withdrawals reopening
The theft rattled crypto prices and prompted a precautionary freeze on new deposits and borrowing at decentralized lender Aave. Aave reopened its markets Friday afternoon, while Binance’s withdrawals remained suspended.
Binance said in a Friday update that it aimed to begin reopening withdrawals in stages Sunday, Nov. 1, subject to completing security checks. Deposits and other unaffected services remained operational.
The exchange said it planned to take an initial proof-of-reserves snapshot within 12 hours of the announcement, with results ready by Monday. The report is intended to show the assets Binance holds and the backing of customer balances.
Binance said in a Saturday update that it had replenished 90% of stolen assets and remained on track to open withdrawals by Sunday.
Magazine: Tampered Ledger reported in Singapore a month before news broke: Asia Express
