Binance Finds More Breach Points in $6.3 Billion Hack and Targets Sunday for Withdrawal Restart
Binance said its investigation found more points of breach beyond a compromised employee laptop, set aside more than $6.34 billion to cover losses, and aims to reopen withdrawals by Sunday while about $3 billion in stolen assets stays frozen.
Binance said Friday that its investigation into the theft of about $6.3 billion in cryptocurrency has found additional points of breach beyond the compromised laptop of a company engineer that investigators first named as a possible entry point. Co-chief executive Richard Teng said in a video statement that the attack was not a single one-click action, according to Decrypt.

According to CoinDesk, the attackers used a self-destruct mechanism to erase evidence and used a feature of the Ethereum network, known as EIP-7702 account delegation, to take control of a hot wallet without going through Binance’s normal approval steps. Binance said it has found no evidence that any wallet private keys were leaked. Teng said the investigation has not attributed the attack to any individual, Decrypt reported.

Withdrawals stay paused while systems are rebuilt
Withdrawals remain suspended while Binance rebuilds and tests its withdrawal service, and the exchange aims to reopen them by Sunday. Deposits were operating normally by Friday morning, Decrypt reported. Binance is reviewing its cloud systems, employee devices, private key management and transaction signing procedures, according to CoinDesk.

Binance said it has set aside more than $6.34 billion to cover the losses, including $5 billion already held in the affected cryptocurrencies, with the rest being bought through exchanges and over-the-counter markets, CoinDesk reported. About $3 billion in stolen assets has been frozen on blockchains with help from blockchain partners, Decrypt reported, and stablecoin issuers Tether and Circle froze about $1.8 billion in USDT and USDC held in the main receiving wallet. Blockchain analytics firm Arkham put the total taken at $6.01 billion from hot wallets on nine blockchains on Thursday afternoon Eastern time, Decrypt reported.

Binance plans to publish an initial proof-of-reserves update before a full report on Monday, and Teng said a detailed technical post-mortem will follow once the investigation is complete and every fact is verified, Decrypt reported.
Reporting based on coverage by CoinDesk and Decrypt.