Binance co-CEO Richard Teng said the exchange plans to publish a full proof-of-reserves report by next Monday and may release a preliminary version before then. In a video posted on X, Teng said the incident affected Binance’s own hot wallet rather than customer funds, adding that the vast majority of user assets are held in cold wallets and are only moved to hot wallets when users make withdrawals. He also said Binance is rebuilding its withdrawal service and still expects user withdrawals to resume by Sunday under the original timetable. On the attack itself, Teng said the breach was not carried out by a single person. Beyond an initially identified compromised laptop, the investigation found additional points of intrusion. He said the attackers used self-destruct mechanisms to erase tools and traces during the operation, making the case harder to track, and used EIP-7702 to obtain on-chain execution authorization over one hot wallet, bypassing Binance’s normal approval process. Teng added that Binance has launched a company-wide security review covering endpoints, cloud systems, key management and signing. He reiterated that Binance will cover all stolen losses with company funds, with more than $6.34 billion reserved, including $5 billion already held in affected token equivalents such as USDC, USDT, BTC, ETH and BNB.
Binance co-CEO Richard Teng said in a video posted on X that the exchange will publish a full proof-of-reserves report by next Monday, and hopes to put out a preliminary version before that.
Teng said the incident affected Binance’s own hot wallet. He added that Binance does not use customer funds, and that the vast majority of user assets are stored in cold wallets and moved to hot wallets only when users withdraw.
On withdrawals, Teng said Binance is rebuilding the withdrawal service and still expects user withdrawals to be restored by Sunday under the original plan.
Investigation finds multiple intrusion points
Discussing the attack, Teng said it was not the work of a single individual. In addition to an initially identified compromised laptop, the ongoing investigation found more points of intrusion.
He said the attackers used self-destruct mechanisms to destroy tools and traces during the attack, making the case harder to trace. He also said they used EIP-7702 to obtain on-chain execution authorization over one hot wallet, which bypassed Binance’s normal approval process.
Company-wide security review underway
Teng said Binance is now conducting a company-wide security review covering endpoints, cloud infrastructure, key management and signing.
Binance says company funds will cover all losses
Teng reiterated that Binance will use company funds to cover all stolen losses. He said more than $6.34 billion has already been reserved, with $5 billion already held in affected token equivalents including USDC, USDT, BTC, ETH and BNB. The remaining portion is being acquired through market purchases and OTC channels.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
