Binance sets aside $6.34B after record hack as about $3B stays frozen
In brief
- Binance set aside more than $6.34 billion in company funds to cover hack losses.
- About $3 billion remains frozen as recovery efforts continue, Binance said.
- An EIP-7702 delegation bypassed normal approval controls, co-CEO Richard Teng said.
- Chainalysis said it is seeing never-before-seen laundering patterns with the stolen funds.
- Aave resumed deposits and borrowing after a precautionary freeze, saying its contracts were unaffected.
How the attacker got in
Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet. According to Teng, that delegation didn't pass through Binance's normal approval controls. He also said the attacker used a "self-destruct mechanism" to destroy tools and traces during the breach, which has complicated the investigation.
Not everyone thinks Ethereum's upgrade was the deciding factor. Blockaid CEO Ido Ben-Natan told Cointelegraph the attackers could have stolen the funds without EIP-7702 (though it may have helped them get past security checks), and he said compromised signing systems likely enabled the attack. Ambire CEO Ivo Georgiev agreed the funds could have been taken through other methods. He warned that engineers could forget to revoke malicious EIP-7702 delegations after regaining control.
Covering the losses
Binance said $5 billion of the reserve was already held in the same tokens hit by the attack. It's buying the rest through market and OTC transactions, and it warned that some purchases could take longer because of low liquidity and OTC settlement times. Co-CEO Yi He said Binance's SAFU fund and company holdings include substantial amounts of Bitcoin and Ether.
A spokesperson said the matching tokens are held in the exchange's custody but wouldn't share wallet addresses, citing security reasons. Binance didn't say when it acquired them. The allocation excludes frozen or protected assets.
Teng said Binance hoped to restore access before its Sunday deadline and to publish an initial reserves snapshot ahead of Monday's report.
Laundering and the defi ripple
Chainalysis said the attackers may be using automation to move and redistribute the stolen funds.
“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the company said
Binance said in an X post that it's cooperating with law enforcement, without naming the agencies involved.
The incident reached defi too. Aave froze new deposits and borrowing as a precaution, then resumed both across all V3 and V4 markets. Withdrawals and repayments stayed open the whole time, and Aave said its contracts weren't affected. Founder Stani Kulechov said all positions remained overcollateralized.
Frequently asked questions
How did the attacker get into Binance's hot wallet?
Binance co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet. He said the delegation did not pass through Binance's normal approval controls, and that the attacker used a self-destruct mechanism to destroy tools and traces.
Was Ethereum's EIP-7702 upgrade to blame for the Binance hack?
Blockaid CEO Ido Ben-Natan said the funds could have been stolen without EIP-7702, though it may have helped attackers bypass security checks and act in one sweep. Ambire CEO Ivo Georgiev also said other methods could have worked, and warned engineers could overlook revoking malicious delegations.
How is Binance covering the losses from the hack?
Binance said it set aside more than $6.34 billion in company funds, $5 billion of which was already held in the affected tokens. It's buying the remainder through market and OTC deals. About $3 billion remains frozen and is excluded from the allocation.
