Binance CEO Richard Teng says the company has set aside $6.34bn to cover the hack, and that the attacker bypassed the company's controls via the protocol EIP-7702. Customers are expected to be able to withdraw funds again by 1 November.
Richard Teng, chief executive of Binance, posted a video update on X on Friday afternoon, less than a day after Binance was hit by what the company itself calls one of the largest losses in crypto industry history, with a confirmed loss of around $6.3bn. EIP-7702 is an update to the Ethereum protocol that lets an ordinary wallet temporarily take on the functions of a smart contract, including approving transactions on the owner's behalf. This is the system the attacker is said to have used to gain control of one of Binance's hot wallets — wallets connected to the internet and used for day-to-day withdrawals, as opposed to cold wallets, which are kept offline.
Teng writes that Binance is committed to covering all losses from the hack with the company's own funds, and that users' assets are safe. According to him, the company has set aside more than $6.34bn for the purpose, of which $5bn is already held in the exact tokens affected, including USDC, USDT, bitcoin, ether and BNB. The figure is not the same as the confirmed loss of $6.3bn Binance previously reported — it is the company's own reserve to cover the loss, not a new update to the loss figure.
Teng stresses that customer funds are never used in Binance's own operations, and were therefore unaffected. What was attacked was the company's own hot wallet. The vast majority of users' assets sit in cold wallets, disconnected from the internet, and are only moved to a hot wallet when a user makes a withdrawal.
"We are committed to covering all losses from the hack through our own company funds. Your funds are safe," Teng says.
The remaining outstanding amount will be covered by buying the relevant tokens on the market and through OTC channels, meaning direct deals outside the exchange. Binance aims to share an initial view of its reserves ahead of a full Proof of Reserves report, expected by 2 November.
"This was not carried out by one person. Our initial investigation pointed to a compromised computer, but further investigation has uncovered additional points of breach," Teng writes. He describes the attack as complex, saying the attacker also used a self-destruct mechanism that destroyed tools and traces as it went, making it harder for Binance to trace and investigate.
According to Teng, the attacker used the known protocol EIP-7702 to obtain on-chain execution approval over a hot wallet, and that delegation bypassed Binance's internal controls.
"That's why we have to pause the withdrawal service, to investigate, rebuild and retest the entire infrastructure system," he says.
Binance is now rebuilding the withdrawal service and will not switch it back on until it has passed rigorous testing. The company says it is hopeful that users will be able to withdraw funds before the deadline it has set itself.
At the same time, a full security review is under way across the company — endpoints, cloud, key management and signing. Binance is also working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover the stolen funds.
"We will do everything within our power to ensure these bad actors are held accountable," Teng says.
Sources: Richard Teng on X
You have read what you can read for free. With an account you get unlimited access to all news and articles on kaupr.io — and become part of the network of investors, professionals and builders following onchain finance.