Hackers stole approximately $6.3 billion from Binance on Thursday, marking the largest cryptocurrency theft in history. Onchain investigators attributed the exploit to North Korea-backed actors, similar to previous breaches at Bybit and Bitget. Initially suspected to involve a compromised engineer’s laptop, Binance co-CEO Richard Teng clarified that the attack did not rely on a single individual’s permissions or a 'one-click' action, noting that additional breach points were discovered by Friday morning.
The attackers utilized Ethereum’s EIP-7702 upgrade to gain execution authority over a hot wallet, bypassing standard approval controls. Blockaid CEO Ido Ben-Natan suggested that while the funds could have been stolen without this specific protocol feature, it likely helped drain assets in a single sweep by circumventing safeguards. Teng reported that a 'self-destruct mechanism' destroyed tools and traces, complicating the forensic investigation. Chainalysis observed thousands of rapid transactions indicative of automated laundering, with funds circulating among various addresses.
Binance stated it has set aside more than $6.34 billion in company funds to cover the losses, including $5 billion held in the same tokens stolen during the hack. The incident caused significant volatility in crypto prices and prompted decentralized lender Aave to temporarily freeze new deposits and borrowing, though its markets reopened on Friday afternoon. Binance withdrawals remained suspended as the exchange worked to rebuild its service. Teng announced plans to resume withdrawals within 40 hours of his update and to publish a full proof-of-reserves report by Monday.
This breach exposes critical vulnerabilities in how major exchanges integrate emerging blockchain standards like EIP-7702 into their security architectures. While the use of delegation features allowed attackers to bypass internal approval controls, the incident underscores the tension between operational efficiency and robust security protocols. The reliance on a self-destruct mechanism by the attackers highlights the sophistication of state-sponsored cyber operations, which are increasingly targeting centralized infrastructure to maximize impact and obscure forensic trails.
From a Market Structure perspective, the immediate suspension of withdrawals and the subsequent plan to restore them within 40 hours tests the resilience of user confidence in centralized entities. Although Binance’s commitment to cover losses with company funds mitigates direct financial harm to users, the event raises questions about the adequacy of current risk management frameworks against coordinated, large-scale exploits. The broader industry must now scrutinize whether existing safeguards are sufficient for high-value hot wallets operating under evolving network upgrades.
