Binance Hack Emptied Wallets Listed as Proof of Customer Asset Backing
Key Takeaways
- •The addresses emptied in the hack appear in Binance's own monthly reserve disclosures, which the exchange uses to show that customer balances are fully backed.
- •The attacker leveraged EIP-7702, an Ethereum feature introduced in the 2025 Pectra upgrade, to turn the 'Binance 14' wallet into a sweeper that forwarded incoming funds to their own address.
- •About 204,500 ETH, roughly 5.6% of Binance's ether reserves and worth around $442 million in one transfer, was taken, likely reducing ETH backing from exactly 100% as of Oct. 1 to near 94%.
- •Binance and co-CEO Yi He have said customer balances will be honored despite the theft, and founder Changpeng Zhao stated he expects users to be fully recovered.
- •Substantial parts of the stolen funds have been frozen, including more than 1.567 billion USDT by Tether and roughly $823 million of USDC by Circle, with Ripple freezing about $200 million and World Liberty Financial $27 million of USD1.
The Binance wallets emptied in Thursday's hack are the same addresses the exchange cites as proof that customers' crypto is fully backed, according to a CoinDesk review of Binance's own reserve data.
As a result, Binance's 1:1 backing of some assets — ether in particular — has likely fallen below 100% until the exchange replaces what was taken.
Every month, Binance publishes a list of wallets it controls and what they hold, comparing those totals with customer balances on the platform — a disclosure practice that became an industry staple after the 2022 collapse of FTX, where customer balances proved not to be fully backed. Its most recent report, dated Oct. 1, includes a wallet labeled "Binance 14," the wallet at the center of the attack. At the time of the report, it held 1.26 billion USDT and 89,475 ETH, among 37 assets.
The attacker used an Ethereum feature called EIP-7702, added to the network in its 2025 Pectra upgrade, which lets a wallet hand control to a piece of software. After getting Binance 14's key to sign that permission, the attacker turned the wallet into a sweeper that forwarded incoming funds to their own address. Etherscan shows 167,464 ETH moving from Binance 14 at 20:24 UTC, or 4:24 p.m. ET, followed by 28,005.6 ETH from Binance 16, both flowing into the attacker's wallet. Nearly 15 minutes later, 195,460 ETH — around $442 million — was sent to a second address.
The loss landed on a thin cushion. As of Oct. 1, Binance held exactly enough ETH to cover customer balances (a 100% reserve ratio) and 108.26% of customers' USDC. The roughly 204,500 ETH taken represents approximately 5.6% of Binance's ETH reserves, leaving the exchange's ETH backing near 94%. The attacker's smaller positions, including ENA, UNI, PEPE and AAVE, represent anywhere from 7% to 15% of Binance's reported holdings of each.
Binance and co-CEO Yi He have said user funds are safe — in practice, meaning customers' balances will be honored even though the assets behind them were stolen. Founder Changpeng Zhao also said he expects users to be fully recovered.
Stablecoin issuers have frozen much of the haul. Tether CEO Paolo Ardoino said more than 1.567 billion USDT was frozen, while Zhao put Circle's USDC freeze at around $823 million. Ripple also froze roughly $200 million in assets, and World Liberty Financial froze $27 million worth of its USD1 stablecoin.
Binance's next monthly reserve report will show whether the assets behind customer balances have been rebuilt, and how much of the frozen funds is ultimately recovered remains to be seen.
