Timeline: The $6.3B Binance Security Breach Breakdown
An overview of Cointelegraph's real-time reporting on the Binance security incident, featuring initial discovery details and the platform's commitment to complete user compensation.
This piece provides a summary of Cointelegraph's reporting on the Binance security breach as events transpired. For the complete chronological breakdown with granular updates, click here.
Cybercriminals made off with approximately $6.3 billion from Binance this Thursday, marking what has become the most significant digital asset heist in recorded history.
Similar to the $1.5 billion Bybit incident that occurred in February 2025 and the Bitget compromise in September, blockchain forensics experts have linked Binance's unprecedented security breach to cybercriminal groups operating with North Korean state backing.
Come Friday morning, the planet's most prominent cryptocurrency trading platform announced that forensic teams had uncovered multiple points of entry after preliminary investigations pointed toward a potentially compromised laptop belonging to one of their engineers as the initial vulnerability.
"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," said Binance co-CEO Richard Teng. "Our investigation has not attributed responsibility to any individual."
The exchange revealed it had allocated in excess of $6.34 billion from corporate reserves to make users whole, with $5 billion of that sum held in identical tokens to those taken during the security breach.
EIP-7702's role in the hack comes under scrutiny
The Ethereum network's EIP-7702 protocol enhancement faced criticism following its exploitation by threat actors to empty a Binance wallet. In statements to Cointelegraph, Blockaid's Chief Executive Officer Ido Ben-Natan indicated that breached signing infrastructure most likely facilitated the unauthorized fund transfers.
While the perpetrators could have executed the theft without leveraging EIP-7702, Ben-Natan explained that the protocol upgrade may have enabled them to circumvent protective measures and extract holdings in a single comprehensive operation.
According to Teng, the malicious actors exploited an EIP-7702 delegation mechanism to acquire execution privileges over a hot storage wallet while evading Binance's standard authorization protocols. He further noted that a "self-destruct mechanism" eliminated tooling and forensic evidence, creating additional obstacles for investigators.
Blockchain analytics firm Chainalysis documented thousands of transactions occurring in rapid sequence that may suggest programmatic money laundering operations, with stolen assets moving between different addresses and occasionally being routed back to previously utilized wallets.
Binance users await withdrawals reopening
The massive theft triggered volatility across cryptocurrency markets and led to a preventive suspension of new deposits and lending activities at decentralized finance platform Aave. Aave restored normal operations Friday afternoon, whereas Binance's withdrawal functionality continued to remain disabled.
Teng indicated that Binance was in the process of reconstructing its withdrawal infrastructure while simultaneously executing a comprehensive security audit across all company systems.
The exchange has set a target to reinstate withdrawal capabilities within 40 hours from Teng's most recent communication and committed to releasing a comprehensive proof-of-reserves audit document no later than Monday.