This article summarizes Cointelegraph’s coverage of the Binance hack as it unfolded. See the full timeline for detailed updates here.
Hackers stole about $6.3 billion from Binance on Thursday, in what is now the largest cryptocurrency theft on record. Industry partners have frozen roughly $3 billion in affected assets, while customers await the reopening of withdrawals.
TRM Labs traced the first unauthorized transfers to around 8:05 pm UTC Thursday, with Binance wallets drained across multiple blockchains. The attackers targeted hot wallets, which exchanges keep connected to the internet to process withdrawals.
TRM attributed the attack to North Korea’s TraderTraitor group, which the US Federal Bureau of Investigation blamed for the $1.5 billion Bybit theft in February 2025. Binance has not publicly confirmed the attackers’ identity.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” said Binance co-CEO Richard Teng. “Our investigation has not attributed responsibility to any individual.”
Binance said it had reserved more than $6.34 billion in company funds to cover losses, including $5 billion already held in the affected tokens. However, that allocation excludes the frozen assets, and the exchange said it was buying the remaining tokens through exchanges and over-the-counter deals.
A spokesperson told Cointelegraph the $5 billion was in Binance’s custody but declined to disclose wallet addresses, citing security concerns. Security firm CertiK said it needed more information to verify the holdings independently.
Frozen funds are not necessarily recovered funds, and Binance has yet to disclose how much stolen crypto has actually been returned to its control.
EIP-7702’s role in the hack comes under scrutiny
Ethereum’s EIP-7702 upgrade came under fire after attackers used it to drain a Binance wallet. EIP-7702 is a feature that lets a wallet authorize software to act on its behalf. Blockaid CEO Ido Ben-Natan told Cointelegraph that compromised signing systems likely enabled the theft.
Attackers could have stolen the funds without EIP-7702, but it may have helped them bypass safeguards and drain assets in one sweep, Ben-Natan said.
Teng said that the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without passing Binance’s normal approval controls. A “self-destruct mechanism” destroyed tools and traces, complicating the investigation, he said.
Chainalysis observed thousands of transactions in quick succession that could indicate automated laundering, with funds circulating among addresses and sometimes returning to wallets used earlier.
Binance users await withdrawals reopening
The theft rattled crypto prices and prompted a precautionary freeze on new deposits and borrowing at decentralized lender Aave. Aave reopened its markets Friday afternoon, while Binance’s withdrawals remained suspended.
Teng said Binance was rebuilding its withdrawal service and conducting a company-wide security review.
Binance aims to resume withdrawals within 40 hours of Teng’s Friday update and to publish a full proof-of-reserves report by Monday.
Magazine: Tampered Ledger reported in Singapore a month before news broke: Asia Express
