Binance Covers $6.34 Billion Out of Its Own Pocket: The Attacker Used EIP-7702 to Bypass Normal Approvals
$6.34 billion, paid in full, not one cent of customer money. That sounds like a strong statement — and it also tells you the loss was big enough that the company had no choice but to say it.
Three key facts
Binance CEO Richard Teng promised in a video address to cover all losses from this week's hack with company funds. According to Decrypt, Binance has reserved more than $6.34 billion of company money, of which $5 billion is already held in the exact tokens stolen (USDC, USDT, BTC, ETH, BNB), with the rest being bought through market and over-the-counter channels. He said customer funds were never touched, most user assets sit in cold wallets, and only enter a hot wallet when a user withdraws.
The core of the attack was EIP-7702. Teng said the attacker used the Ethereum feature — which lets ordinary wallets run smart contract code — to obtain onchain execution rights over a hot wallet, and that "that delegation did not pass through our normal approval controls," which is why Binance paused withdrawals to rebuild and retest its infrastructure. He added the attacker used a self-destruct mechanism to wipe tooling and traces along the way, complicating the investigation. Binance first traced the incident to a compromised laptop, then found "additional points of breach."
The timeline is set. Binance aims to restore withdrawals before Sunday and plans to publish a full proof of reserves on Monday, alongside a complete security review covering endpoints, cloud, key management, and signing.
Wang Dou's Take
Start with that line "our normal approval controls." It's the most informative sentence in the whole story — it admits something: Binance had a process meant to stop a hot wallet from being drained, and that process was bypassed. Not by breaking cryptography, but by using an official Ethereum feature, documented in the upgrade notes. This wasn't a hacker finding a hole; it was a hacker using a legitimate product feature to walk through a door nobody guarded.
The second thing worth pondering is "$6.34 billion, paid in full." That's a sharp PR counterpunch — users lost nothing, so sentiment settles. But ask a different question: a crypto exchange can produce cash equal to a small country's GDP within two days. What does that tell you? That its balance sheet is far beyond the "intermediary" category. It's proof of strength, and also a copy of "too big to fail" landing in crypto.
Third, that proof of reserves. Restore withdrawals Sunday, publish PoR Monday — the order matters. Give people their money back first, then let them audit. Doing it the other way would panic the market first. Binance knows that in moments like this, trust isn't rebuilt by statements; it's rebuilt by the withdrawal button actually working. Every "your assets are safe" only gets believed after that.
Source: Decrypt