Newsletter
- Anbin’s CEO, Richard Teng, stated that the exchange will cover all losses incurred due to hacking, with over $6.34 billion in company funds set aside, of which $5 billion is designated for affected tokens of the same type.
- Teng indicates that the attacker used self-destruction mechanisms to remove tools and traces, and took advantage of the EIP-7702 delegation mechanism, which bypasses Binance's regular approval controls.
- Binance plans to resume withdrawals by the end of the week and will release a full reserve certificate on Monday; in the meantime, attackers are still transferring funds on the Polkadot network.
Anbin’s CEO, Richard Teng, stated in a video speech on Friday that Anbin will cover all the losses caused by this week’s hacking incident with its own funds, and added that customer funds were never affected.
According to the speech transcript he posted on X, Teng stated: "We promise to cover all hacker losses with company funds. Your assets are safe."
Teng said that Binance has reserved over $6.34 billion in company funds to cover the stolen assets, of which $5 billion is already held in the exact form of the stolen tokens, including USDC, USDT, BTC, ETH, and BNB. For the remaining amount, the exchange is purchasing through market and over-the-counter channels.
Teng indicates that this hacker attack was targeted at Binance's own hot wallets, not customer funds. 'We never use any customer funds, so they were not affected,' he said, and added that most user assets are stored in cold wallets and only transferred to hot wallets when users initiate withdrawals. He also stated that Binance was able to absorb such a large scale of loss because the company retains a considerable portion of its operating profits in crypto assets.
Binance previously stated that it would cover all losses through its SAFU emergency fund and company funds.
How the attack was carried out
Teng indicates that this hacker attack 'was not carried out by a single person.' Binance initially traced it back to a compromised laptop, but subsequently discovered more entry points. Teng states that the attackers also used a self-destruction mechanism to destroy their tools and traces during the operation, making the investigation even more difficult.
According to Teng, the attackers took advantage of EIP-7702 – a feature of Ethereum that allows ordinary wallets to execute smart contract code – in order to gain on-chain execution permissions for a hot wallet. “This authorization did not go through our normal approval process,” he said, which is also the reason why Binance suspended withdrawals in order to rebuild and retest its infrastructure. Blockchain analysis firms TRM Labs and Chainalysis attribute this theft to the North Korean hacking group TraderTraitor.
Teng indicates that Binance aims to restore withdrawal services before the deadline on Sunday. Currently, a comprehensive security review is underway, covering aspects such as terminals, cloud environments, key management, and signatures. Binance plans to release a full reserve certification report on Monday and will provide a preliminary overview in the meantime.
The attackers are still transferring funds. According to Arkham data, between 11:37 a.m. and 12:12 p.m. on Friday Eastern Time, a Polkadot wallet attributed to the hackers by Arkham transferred approximately 5.19 million TRX to 12 addresses, worth about $1.73 million.
The decentralized lending protocol Aave announced on Friday that it had lifted the freezes on all markets for its V3 and V4 deployments. According to TRM Labs, the attacker borrowed ETH using USDT as collateral on Aave while racing against time to deal with the stabilization coin freeze. Aave stated that after the initial news of the hack emerged, they froze the relevant markets as a preventative measure, suspending new deposits and loans, but withdrawals and repayments continued as usual. Founder Stani Kulechov wrote: “Aave was not affected, and all positions still maintain over-collateralization.”
Changpeng Zhao, co-founder of Binance ( Changpeng “ CZ ” Zhao ), stated that although this $6.3 billion theft case is the largest in terms of dollars, it is not the largest in terms of the number of bitcoins stolen. He mentioned that Mt lost 650,000 BTC, which exceeded 5% of the total supply at that time. He said that unlike Mt, Gox, and FTX where almost all users were affected, Binance will bear the losses themselves this time. “It’s painful, but we can get through it,” Zhao Changpeng wrote.
