Binance's investigation into its recent security breach has moved beyond the initial theory that a single compromised laptop triggered the incident. Co-CEO Richard Teng said investigators have identified additional breach points and traced how the attacker obtained on-chain approval over one of the exchange's hot wallets. He added that there is no evidence of a private-key leak. Binance has committed to covering all losses with company funds and its Secure Asset Fund for Users (SAFU), the emergency reserve the exchange created in 2018 to cover losses in extreme cases.

Attack Was More Complex Than a One-Click Breach

In an X post, Co-CEO Richard Teng said Binance initially suspected the hack began with a compromised laptop. Subsequent findings uncovered more breach points, making the attack considerably more complex than a one-click breach.

According to Teng, the attacker gained access to a service container and then submitted unauthorized withdrawal transactions. He stressed that the incident was not a case of a single employee misusing permissions, and Binance has not assigned responsibility to any individual.

Investigators said the attacker deployed a self-destruct mechanism to erase tools and traces, which slowed the security team's progress in reconstructing the attack path. Erasure tactics of this kind, commonly described in the security industry as anti-forensic techniques, are designed to frustrate post-incident reconstruction.

Teng also said the attacker exploited EIP-7702, an Ethereum authorization feature, to obtain on-chain execution approval over a Binance hot wallet. This allowed the attacker to bypass Binance's usual approval checks. EIP-7702 went live as part of Ethereum's Pectra upgrade in May 2025 and lets standard user accounts temporarily adopt smart-contract functionality, such as batching multiple operations under a single authorization.

The exchange has not reported any flaw in EIP-7702 itself, stating instead that the attacker used the feature to circumvent its internal controls. Binance said it has found no evidence that wallet private keys were exposed. The investigation continues, and the exchange plans to publish a technical post-mortem once its findings are verified.

Binance Reserves $6.34 Billion to Cover Losses

Teng said customer funds were not affected and that Binance would make users whole. The exchange has reserved more than $6.34 billion in company funds to cover the stolen assets, per Teng's earlier update.

According to Teng, about $5 billion is already held in the same assets involved in the incident, including BTC, ETH, BNB, USDT, and USDC. Binance is working to acquire the remaining amount through market purchases and over-the-counter transactions.

The exchange estimated the total impact of the breach at around $6.3 billion and said roughly $3 billion had been frozen on-chain with assistance from blockchain partners. Teng noted that most customer assets are held in cold wallets and are moved to hot wallets only when users request withdrawals. Cold wallets keep private keys offline, while hot wallets stay connected to the internet to process user withdrawals — the layer now at the center of the investigation and remediation efforts.