Binance's investigation into the record $6.3 billion hack has uncovered security breaches beyond the compromised employee laptop it first suspected, co-CEO Richard Teng said Friday, according to CoinDesk.
In a video statement on X, Teng said the attackers used a self-destruct mechanism to erase evidence and exploited Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without going through Binance's normal approval procedures. "This was a complex attack," Teng said, adding that investigators found additional points of breach but still have not worked out the full sequence of events.
CoinDesk's earlier reporting described how the attacker obtained wallet permissions and used malicious code to drain about $2.5 billion in minutes.
The part that should worry you
The EIP-7702 detail matters. An Ethereum account-delegation feature was the tool that let an attacker sidestep the exchange's approval flow entirely. I keep coming back to the self-destruct mechanism too. Whoever did this planned the cleanup alongside the theft. That is not opportunistic. That is professional.
And Binance is still finding new breach points. The investigation is open, the full attack sequence is unknown, and part of the evidence has been destroyed.
The Sunday target
Against all that, Binance says it hopes to resume withdrawals by Sunday, roughly 40 hours from Teng's statement, while it rebuilds and tests its infrastructure. The review covers cloud systems, employee devices, private-key management, and transaction-signing procedures.
That is a lot to rebuild and test in 40 hours when you cannot yet reconstruct how the attacker got in. Maybe they pull it off. But a restart promised under pressure is exactly the kind of restart worth watching closely, because pressure is when security reviews get thin.
The money
Teng reiterated that Binance will cover all $6.3 billion in losses using company funds. The exchange has reserved more than $6.34 billion, including $5 billion already held in the affected cryptocurrencies, he said. Binance plans to publish its proof of reserves on Monday.
That proof of reserves is the first real check on any of this. If the reserves verify, Binance absorbs the hit, customers get made whole, and the exchange survives its worst day. If they do not, this becomes a completely different story. Monday tells us which version we are in.
Nobody knows how this plays out. The gap between "we don't know the full sequence of events" and "withdrawals reopen Sunday" is the thing to watch.