Binance’s $6.3B Crypto Theft Puts Hot Wallet Controls Under Scrutiny

The Binance theft puts a practical question at the center of exchange security: how did an attacker gain authority to move billions from hot wallets, and how much of the stolen crypto can still be recovered? Binance says it has earmarked $6.34 billion to cover losses, while the full extent of asset recovery remains unclear. Those are two different measures of exposure: a company can set aside funds to cover customer losses even while stolen assets remain outside its control. For customers, the distinction matters because reimbursement capacity says little about whether investigators can trace, freeze or return the crypto.

Tracing the breach

TRM Labs traced the first unauthorized transfers to about 8:05 pm UTC Thursday. The attackers drained Binance hot wallets across multiple blockchains, making the incident a question of how access was obtained and how quickly controls responded across connected systems. TRM attributed the operation to North Korea’s TraderTraitor group, which the US Federal Bureau of Investigation blamed for the $1.5 billion Bybit theft in February 2025. Binance hasn’t publicly confirmed who was responsible, so the attribution remains an assessment from an outside analytics firm rather than a conclusion the exchange has endorsed.

Binance co-CEO Richard Teng said the breach didn’t stem from one engineer’s permissions or a single action. “Our investigation has not attributed responsibility to any individual,” he said. That statement points to a broader review of systems and processes, though it doesn’t explain which controls failed or how authority was granted. Until Binance releases more detail, customers can’t assess whether the incident exposed a narrow weakness or a problem spanning several layers of wallet security.

The suspected use of Ethereum’s EIP-7702 has focused attention on wallet authorization. The feature lets a wallet delegate execution to software, changing how a wallet can carry out actions without changing the basic question of who controls that authority. Blockaid CEO Ido Ben-Natan told Cointelegraph that compromised signing systems likely enabled the theft, while stressing that the attackers could have moved the funds without EIP-7702. The delegation may have helped them bypass safeguards and drain assets in one sweep. That distinction matters: the feature may have shaped the mechanics of the breach, but its presence alone doesn’t establish the cause.

Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without Binance’s normal approval controls. He also said a “self-destruct mechanism” destroyed tools and traces, making the investigation harder. If that account holds, investigators face a familiar problem in digital intrusions: reconstructing a chain of actions after evidence has been deliberately erased. The remaining public details don’t show how much evidence survived or what Binance can still establish about the attacker’s path.

Reimbursement and recovery remain separate questions

Binance says it has reserved more than $6.34 billion in company funds for customer losses. That includes $5 billion in the affected tokens already held by the exchange; the allocation doesn’t count frozen assets. Binance says it is buying the remaining tokens through exchanges and over-the-counter deals. The plan signals that the company is prepared to use its own funds to address the shortfall, but the announced reserve is not the same as a final accounting of losses or a record of assets recovered.

A spokesperson told Cointelegraph the $5 billion was in Binance’s custody, but declined to provide wallet addresses, citing security concerns. CertiK said it couldn’t independently verify the holdings without more information. That leaves readers with an important gap between the exchange’s claim and outside confirmation. Binance may have reasons to limit the public detail, but without verifiable wallet information, the stated holdings remain difficult for outsiders to check.

Industry partners have frozen roughly $3 billion in affected assets. A freeze can restrict movement, but it doesn’t by itself mean the funds have been returned to Binance or made available to customers. Binance hasn’t disclosed how much stolen crypto is back under its control. Chainalysis also observed thousands of transactions in quick succession that could point to automated laundering, with funds moving among addresses and sometimes returning to previously used wallets. The scale and pattern of transfers may help analysts map the funds, though tracking a transaction trail and recovering the assets are separate tasks.

Service disruption and next steps

The theft rattled crypto prices and led decentralized lender Aave to pause new deposits and borrowing as a precaution. Aave reopened its markets Friday afternoon, but Binance withdrawals were still suspended. The contrast shows how an incident at one exchange can prompt precautionary changes elsewhere, even when the affected services operate separately. For customers, the immediate concern is more concrete: whether they can access their funds and when normal withdrawals will resume.

Teng said the exchange was rebuilding withdrawal services and reviewing security across the company. Binance aimed to resume withdrawals within 40 hours of Teng’s Friday update and publish a full proof-of-reserves report by Monday. Those milestones will give customers a clearer view of service recovery and the exchange’s stated reserves, but they answer different questions. A proof-of-reserves report can help show what the exchange holds; it won’t, by itself, explain how the attacker gained authority or establish how much stolen crypto can be recovered.

What customers still need to know

This is more significant than it looks: the breach puts operational controls, public verification and recovery claims under scrutiny at the same time. If you’re working in this space, the central lesson is that wallet security depends on more than keeping private keys out of an attacker’s hands; systems that grant execution authority and the checks around them matter too. (And this is the part most people overlook.) A large reserve can soften customer losses, while weak disclosure can still leave customers unsure about what has been secured and what remains exposed.

Binance’s next updates will be judged on whether they clarify both service status and the path from unauthorized transfers to recovery. The numbers here are underwhelming as a measure of certainty: billions are cited for reserves and freezes, yet the exchange hasn’t said how much stolen crypto it controls again. The unresolved question is plain. How much comes back?

Magazine: Tampered Ledger reported in Singapore a month before news broke: Asia Express

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.