According to Binance's investigation, the incident may have started from a compromised laptop of a system operating engineer.

On Thursday, Binance suddenly suspended all deposit and withdrawal operations. The world's largest cryptocurrency exchange said it is checking security, freezing assets and working with authorities. Mr. Changpeng Zhao, founder of Binance, admitted on social network X that this appeared to be a hack. He confirmed that users' money is still safe.

The number of damages has not yet been agreed upon. Expert Taylor Monahan of the SEAL 911 security team estimates from more than 2 billion to 5.5 billion USD. Chainalysis puts the figure at $5.9 billion, while TRM Labs says it's more than $6 billion. By any estimate, this exceeds the old record of $1.5 billion in the Bybit attack in 2025.

How ​​did the attack happen?

So how did hackers do it? The answer starts with EIP-7702, a feature of the Ethereum network. Normally, Ethereum wallets only act on the orders of the holder of the private key, which is the only key that can open the wallet. This feature allows the wallet owner to delegate control of the wallet to a piece of software. It can be imagined as the owner of a safe signing an authorization letter for a manager, working according to pre-set rules. This is a valid feature, not a bug of Ethereum.

So which way did the attacker get in? According to Binance, the initial investigation indicated that the laptop of a system operating engineer was compromised. From this machine, he could access the exchange's service environment and send illegal withdrawal orders. The exchange said it has not seen evidence of the wallet's private keys being exposed, but the investigation is still ongoing. Some initial reports suggested that hackers had the wallet keys. That comment has not yet been confirmed.

Security company Blockaid offered a similar preliminary assessment. Blockaid's Mr. Ben-Natan calls this “key abuse.” Meaning the attacker did not steal the key. He hijacked or tricked the exchange's transaction signing system, allowing the system to automatically approve malicious orders. It can be imagined as a company's seal. The thief does not take the stamp, but causes the stamp holder to stamp the fake documents. Mr. Ben-Natan said: "This appears to be a takeover of the transaction signing infrastructure. We do not think the key was exposed."

Blockaid's on-chain data analysis reveals the next step. Hackers combined 50 EIP-7702 authorizations into a transaction targeting a wallet called “Binance 14”. Each paper carries a sequential number, and the wallet only accepts papers with the correct number pending. One of the 50 papers matching this number should be approved.

The wallet is then assigned to an unverified smart contract. This contract allows a designated operator to withdraw tokens and ETH. That is a "money sucker", any assets transferred to this wallet are immediately automatically forwarded to an address controlled by the attacker. Mr. Ben-Natan said that the campaign may involve many devices being compromised and moving within the exchange's internal network.

In other words, hackers do not need to continuously log into the wallet or manually create each withdrawal transaction. They just need to make the wallet accept the above relay mechanism, then let the software do the rest automatically. The wallet that was originally used to store assets became a transfer station for money straight into the hands of the attacker.

The biggest loss in cryptocurrency history

Data on Etherscan shows what happened next. At 8:24 p.m. UTC, or 4:24 p.m. Eastern US time, 167,464 ETH left the Binance 14 wallet. Next, 28,005.6 ETH left the Binance 16 wallet. Both amounts flowed to the attacker's wallet. Nearly 15 minutes later, 195,460 ETH, worth about 442 million USD, continued to be transferred to a second address.

The consequences are more severe because these are not ordinary wallets. Each month, Binance publishes a list of wallets controlled by the exchange and the number of assets in them, then compares them with customer balances to prove that the exchange holds enough funds. The October 1 report noted that the Binance 14 wallet contained 1.26 billion USDT and 89,475 ETH. In other words, the very wallets Binance used as proof of reserves were the targets of withdrawals.

The safety cushion at that time was very thin. On October 1, Binance kept 100% of the ETH amount compared to customer balances. About 204,500 ETH was taken, equivalent to 5.6% of reserves, so the ETH margin is likely to have dropped to about 94% until the exchange compensates. Smaller tokens such as ENA, UNI, PEPE and AAVE also lost between 7% and 15% of their holdings.

That's why Binance continuously reassures. Ms. Yi He, co-CEO of the exchange, and Mr. Zhao both said user funds were safe. In practice, this means that the floor will pay the full balance to the customer even if the property behind has been taken. Binance's SAFU emergency fund is holding about $1 billion in bitcoin and can be used to offset it.

Part of the stolen funds were stopped thanks to stablecoin issuers. When they freeze, they blacklist the hacker's wallet address. The number of tokens in that wallet stays still, the hacker cannot transfer, sell or withdraw. Mr. Paolo Ardoino, CEO of Tether, said more than 1.567 billion USDT has been frozen. According to Mr. Zhao, Circle froze about 823 million USDC. Ripple locked about 200 million USD, while World Liberty Financial locked 27 million USD1. Binance then adjusted the total frozen assets to $3 billion, spread across multiple asset classes.

The incident also shows why cryptocurrency exchanges are always attractive targets. Unlike stock exchanges, many cryptocurrency exchanges directly hold assets on behalf of customers, so a large amount of money is concentrated in wallets. A few hours earlier, prediction platform Polymarket also reported a withdrawal of at least 2.6 million USD. Binance.US said it was not affected.

Binance's next reserve snapshot will take place on November 1. That report will show whether the exchange has compensated for the lost assets or not. Until then, Binance's ETH reserves are likely to remain below 100%, although the exchange pledges not to let customers suffer.