Binance’s Teng Sets Monday Reserve Report Deadline as Withdrawals Stay Paused

Binance co‑CEO Richard Teng announced on Friday that the exchange has set aside $6.34 billion of its own funds to cover losses from a hot‑wallet breach that occurred earlier this week. He pledged that user assets remain untouched and that withdrawals will be restored within roughly 40 hours, with a proof‑of‑reserves report slated for Monday. The breach, which involved an attacker exploiting Ethereum’s EIP‑7702 feature and a self‑destruct mechanism, prompted Binance to pause withdrawals while it conducts a full security review.

Background

The incident unfolded after a compromised engineer’s laptop was initially blamed for the breach, but investigators later uncovered additional entry points. The attacker leveraged Ethereum’s EIP‑7702 delegation to gain on‑chain execution approval over Binance’s hot wallet, bypassing normal approval controls, and deployed a self‑destruct routine that erased tooling and traces. Binance responded by pausing withdrawals to rebuild and rigorously retest its infrastructure, focusing on endpoints, cloud services, key management and signing systems. Industry partners quickly acted, freezing roughly $3 billion in related stablecoins and tokens, while blockchain intelligence firms noted similarities to prior attacks linked to North Korean actors. The exchange plans to purchase the remaining reserve amount through market and OTC channels, despite thin liquidity and settlement delays that could slow the process.

What happened

On Friday Richard Teng posted a video update on X stating that Binance never used customer funds and that the breach only affected its own hot wallet, leaving user assets untouched. He confirmed the exchange has reserved $6.34 billion in company funds, of which about $5 billion is already held in USDC, USDT, Bitcoin, Ethereum and BNB, to cover the hack losses (Source 1). Teng said Binance aims to restore withdrawals within roughly 40 hours, targeting a Sunday deadline, and will publish an initial proof‑of‑reserves by Monday for independent verification (Source 1). Binance paused withdrawals to rebuild and retest its infrastructure, conducting a comprehensive security review across endpoints, cloud infrastructure, key management and transaction‑signing systems while cooperating with law enforcement and blockchain intelligence firms (Source 1). The attacker used Ethereum’s EIP‑7702 feature to gain execution approval over the hot wallet and a self‑destruct mechanism that erased tooling and traces, prompting Binance to halt withdrawals (Source 4). Industry response included Tether freezing more than $1.57 billion in USDT, Circle freezing over $800 million in USDC, Ripple freezing roughly $200 million, and World Liberty Financial with BitGo freezing about $27 million in stablecoins and $2 million in its own tokens, together amounting to roughly $3 billion (Source 1). Blockchain analytics firms TRM Labs and Chainalysis linked elements of the attack to North Korean hacking groups, though Binance has not formally attributed the breach (Source 4).

Market impact

The breach prompted Tether’s CEO Paolo Ardoino to freeze over $1.57 billion in USDT, while Circle confirmed freezing more than $800 million in USDC. Ripple froze roughly $200 million, and World Liberty Financial, working with BitGo, froze about $27 million in stablecoins and $2 million in its own tokens, together representing roughly $3 billion in frozen assets (Source 1). Binance’s own reserve of $6.34 billion includes about $5 billion already held in the exact tokens taken, with the remainder to be sourced via market and OTC channels, a process that may be slowed by thin liquidity and settlement delays (Source 1). The attacker moved approximately 5.19 million TRX, worth about $1.73 million, from a Tron wallet to twelve addresses between 11:37 a.m. and 12:12 p.m. ET on Friday, according to Arkham data (Source 4). Aave temporarily froze its markets as a precaution but later unfroze all contracts, stating that positions remained over‑collateralized (Source 4).

Why it matters

The breach underscores the vulnerability of hot‑wallet architectures even for the world’s largest exchange, prompting Binance to allocate a massive $6.34 billion reserve and to pause withdrawals for a full security overhaul. The coordinated industry response, with major stablecoin issuers freezing billions, highlights the systemic risk such attacks pose to liquidity and confidence across the crypto ecosystem. Attribution hints toward North Korean hacking groups, suggesting geopolitical dimensions to crypto‑related thefts. Binance’s commitment to cover losses with its own balance sheet, as emphasized by Michael Saylor, may set a precedent for future incident response, while the upcoming proof‑of‑reserves report could become a benchmark for transparency. The incident also illustrates how novel blockchain features like EIP‑7702 can be weaponized, raising questions about protocol‑level safeguards.