Binance says its investigation into the record $6.3 billion exploit has found more security breaches than the employee laptop first suspected. Co-CEO Richard Teng gave the update Friday in a video statement on X, and he also set a Sunday target for restarting withdrawals.
What Binance found
According to Teng, the attackers used a self-destruct mechanism to erase evidence. They also used Ethereum’s EIP-7702 account-delegation feature to control a hot wallet without going through Binance’s normal approval steps. He described the attack as complex and said investigators have found additional breach points. The full sequence is still not known, he said.
Earlier CoinDesk reporting examined the account-delegation method. That reporting looked at how the attacker gained wallet permissions and used malicious code to drain about $2.5 billion in minutes. Binance has not tied every part of the incident to one clear entry point yet. That uncertainty matters because the exchange is still rebuilding and testing systems before it lets users withdraw again.
Withdrawals and reserves
Withdrawals remain suspended. Teng said Binance hopes to resume them by Sunday, roughly 40 hours from his statement. That timing could slip, of course. The exchange is reviewing cloud systems, employee devices, private-key management and transaction-signing procedures.
Teng repeated that Binance will cover all $6.3 billion in losses with company funds. He said the exchange has reserved more than $6.34 billion, including $5 billion already held in the affected cryptocurrencies. The rest is being bought through exchanges and over-the-counter markets.
He also said the attack hit Binance’s own hot wallet, not customer funds. A separate CoinDesk review of Binance reserve data complicates that account. It found the affected wallets had been included in a list of assets backing customer balances. Binance plans an initial proof-of-reserves update before a full report Monday.
Questions remain
The exchange says it is working with law enforcement, blockchain investigators and token issuers to recover stolen assets. For users, the main question is simple: when will withdrawals reopen, and will reserves match the claims? Binance’s Sunday target is a deadline, not a guarantee. The Monday report may answer more, but it may also raise new questions about how much was exposed and for how long.
