Binance Hit by $6.3 Billion Hack, the Largest in History: Is Simply Promising Compensation Really Enough?

Authors: Ekko An, Ryan Yoon (Tiger Research)

Compiled by: TechFlow

TechFlow Lead: The crypto industry has just witnessed the largest security disaster in history in terms of involved funds. Binance's hot wallet was maliciously breached, resulting in total losses of approximately $6.3 billion, shattering previous historical records for hacks at centralized exchanges. Although officials immediately stated they would cover all losses out of pocket, and issuers like Tether and Circle swiftly froze nearly $3 billion of the stolen funds, market panic and doubt over whether Binance will follow FTX into ruin continue to ferment.

In this in-depth research report, Asia's top Web3 think tank Tiger Research provides a comprehensive retrospective and quantitative breakdown of the incident. Unlike FTX's internal insolvency caused by the reckless misappropriation of user collateral, this crisis stems from external social engineering infiltration targeting employee terminals and the malicious exploitation of Ethereum's EIP-7702 signing feature. However, the frozen assets cannot be directly converted into usable liquidity during the protracted legal and recovery processes, leaving Binance with a heavy financial burden to substantially cover the hard $6.3 billion shortfall in the short term.

The more critical test lies in restoring market confidence. When paused deposits and withdrawals are reopened, will panic evolve into a chain-reaction bank run across the entire network? Can Binance's existing on-book liquidity reserves withstand the extreme stress test of hundreds of billions of dollars in net outflows in a short period? TechFlow provides an unabridged, section-by-section direct translation of Tiger Research's in-depth report, presenting readers with the most objective and hardcore panoramic analysis of exchange solvency.

Binance, the world's largest cryptocurrency exchange, fell victim to a hacker attack. Blockchain research institutions and security firms confirmed the catastrophic event after jointly tracking abnormal on-chain fund movements.

All parties have confirmed this incident as the largest hacker theft in the history of the crypto industry. The core confirmed facts up to now are outlined below.

Key Takeaways

Binance officially estimated the total loss from this hack at approximately $6.3 billion. This figure makes it the highest-value attack in crypto history.

The attackers infiltrated Binance's internal systems by maliciously compromising an employee's personal computer. Subsequently, instead of submitting a single transfer transaction directly, the hackers executed the attack using Ethereum's EIP-7702 feature.

The hackers successfully induced the system to sign a malicious authorization. This authorization allowed malware designated by the hackers to drain 63 different token assets in one go within minutes.

Historically, FTX's collapse was due to unauthorized internal misappropriation of client assets for speculation. In contrast, Binance's losses stem entirely from an external hacker breach, and the platform itself maintains a substantial asset reserve.

Nevertheless, the $3 billion in assets urgently frozen by major stablecoin issuers cannot be returned immediately in the short term. This means that at the present stage, Binance must initially self-fund and front the entire $6.3 billion shortfall.

Once the platform formally reopens deposit and withdrawal channels, a wave of withdrawals triggered by panicked customers, combined with the exposure of stolen assets, is highly likely to trigger unprecedented liquidity run pressure in the short term.

Loss Scale and Event Timeline

Fig: Key timeline retrospective of Binance suffering the largest hacker attack in history

Binance, the world's largest cryptocurrency exchange, fell victim to a hacker attack. Upon discovering abnormal on-chain transfer patterns, blockchain research institutions immediately confirmed this sudden security incident.

The entire hacking attack rapidly evolved from covert initiation to full exposure within hours. Key recorded timestamps are as follows:

05:24: Hackers drained 167,464 ETH and approximately $1.6 billion worth of USDT assets from Binance's hot wallet in a single sweep.

05:32: On-chain independent detective Spreek was the first to publicly issue an alert on social media, pointing out that highly abnormal large-scale fund transfers were occurring at addresses related to Binance.

06:15: Binance co-founder Changpeng Zhao publicly commented that Binance appeared to indeed suffer a hack.

06:16: Binance's official Twitter account released its first formal announcement, stating that the team was urgently investigating potential security vulnerabilities in the system.

06:18 to 06:25: Circle urgently froze $800 million worth of USDC, followed closely by Tether freezing $1.57 billion worth of USDT assets.

09:13: Binance announced a complete pause of all deposit and withdrawal services site-wide, explicitly promising to fully cover all user losses arising from this incident.

09:52: Binance officially confirmed that, with assistance from various parties on-chain, approximately $3 billion in stolen funds had been successfully frozen and intercepted on-chain.

11:23: Binance officially released preliminary investigation findings externally. The briefing showed the overall loss scale across the entire platform was approximately $6.3 billion.

Based on Binance's $6.3 billion loss estimate, this amount exceeds 4 times the stolen amount from the previous industry record holder, Bybit ($1.46 billion).

Full Retrospective of Attack Methodology

To date, Binance has only released a preliminary investigation briefing and has not disclosed a complete technical report. However, combining on-chain public data with analysis from multiple security experts, the attack path has become largely clear.

Forged Signature Requests: The Shared Fatal Flaw in Recent Exchange Hacks

Fig: Schematic diagram of signature verification logic for internal asset withdrawal and forged requests at centralized exchanges

In the recent series of major exchange hack cases, attackers did not steal private keys directly. Instead, they focused their attacks entirely on the signature verification stage within the withdrawal process.

When a centralized exchange needs to transfer crypto assets to an external on-chain address, the transaction must be signed and confirmed by a dedicated system holding the private key.

To safeguard asset security, large exchanges commonly employ cold wallets (offline private key storage) and multi-sig wallets (requiring approval and confirmation from multiple authorized personnel).

However, before finally executing the signature action, the system must first conduct a preliminary verification to confirm whether the withdrawal request was initiated by legally authorized employees. This verification step precisely became the attackers' core target.

Once hackers successfully compromise a certain internal employee's office equipment, they can use it as a springboard to send seemingly fully compliant forged transaction signature requests to the signing system.

After receiving instructions carrying valid credentials, the signing system often misjudges them as genuine authorizations, thereby automatically signing and broadcasting the illegal coin withdrawal transaction.

In recent real-world security cases, attackers almost always first compromised internal employees' physical devices through social engineering tactics.

Social engineering attacks fundamentally exploit human weaknesses and human error, rather than pure code logic vulnerabilities in software foundations. Hackers typically poison targets using spear-phishing or fake job recruitment schemes.

In several prior serious incidents, attackers similarly succeeded by infecting employee devices as their entry point.

Take the $1.46 billion hack case suffered by Bybit in February 2025, for example. Attackers sent forged resumes to employees, secretly implanted malicious trojans, and successfully hijacked internal requests.

In the May 2024 incident where DMM Bitcoin lost $305 million, a North Korean hacker group also posed as a recruiting entity, implementing infiltration through targeted poisoning of specific engineers.

In these two typical cases, attackers first obtained intranet access by deceiving internal personnel, then used infected terminals to forge fund transfer requests.

The Core Differentiators in Binance's Hack

Fig: Breakdown of Ethereum EIP-7702 authorization mechanism and the bulk asset theft process

Based on current indications, Binance's breach also began with a typical social engineering infiltration.

Binance officially confirmed in its briefing that an internal engineer's laptop was breached, and hackers successfully penetrated the Binance intranet environment through this device.

However, the key driver behind the geometric explosion in the total loss amount was a brand-new feature introduced to the Ethereum ecosystem: EIP-7702.

The EIP-7702 mechanism allows standard Externally Owned Accounts (EOAs) to sign a delegation authorization, designating a smart contract program to temporarily execute preset operations on behalf of the account.

The attackers exploited this exceedingly maliciously. After infiltrating Binance's intranet systems, hackers successfully manipulated employee terminals, inducing the target hot wallet to sign an EIP-7702 authorization directive.

Just 3 minutes later, the hackers activated this malicious contract program. Within an extremely short timeframe, the program swept through and continuously drained 63 different token assets.

In traditional attacks previously, hackers had to construct and submit a separate signature request for each token. Consequently, the entire theft process usually took a long time.

This lengthy time window often gave exchange risk control systems ample time to issue alerts and block transactions. For instance, in the Bybit incident, it took hackers 1 hour and 16 minutes to complete the transfer.

But in Binance's case, relying solely on a single EIP-7702 authorization signature, hackers instantly completed the bulk withdrawal of dozens of mainstream assets. This left defenders with virtually no reaction time.

Will Binance Repeat FTX's Fate and Collapse?

The core question currently most concerning all parties across the market is undoubtedly whether this massive loss will cause Binance to crumble suddenly like FTX did back then.

External Attack Vastly Different in Nature from FTX's Misappropriation

Fig: Fundamental comparison between FTX's internal misappropriation leading to insolvency and Binance suffering external hacker attacks

From the perspective of crisis origins, the problems faced by Binance and FTX differ in fundamental dimensions.

The root cause of FTX's collapse was by no means occasional external hacker thefts, but management's long-term clandestine illegal misappropriation of customer assets to provide bottomless leveraged lending to its affiliated hedge fund, Alameda.

When the Terra-Luna crash in May 2022 triggered a platform-wide stampede, Alameda's external creditors rushed to demand loan repayments. FTX subsequently misappropriated billions of dollars in customer deposits to plug the hole.

With plummeting asset prices and zeroed-out collateral, FTX had effectively fallen into permanent balance sheet insolvency exceeding $8 billion, causing it to collapse instantly when the bank run broke out.

In stark contrast, Binance's current crisis stems purely from single-point asset theft caused by external hackers. Binance's own balance sheet structure contains no fatal black hole of active fund misappropriation.

Does Binance Have Sufficient Financial Capacity to Absorb and Cover the Losses?

Fig: Comparison of Binance's total asset reserves versus the proportion of the $6.3 billion stolen loss

Binance officially estimates the total loss amount at $6.3 billion. This scale accounts for approximately 4.4% of the roughly $144 billion in total assets disclosed by the Binance platform.

Viewed purely by ratio, a 4.4% asset shrinkage seems to fall within an acceptable range on paper. However, in actual capital operations, the situation is far more complex.

Although $3 billion in stolen funds has already been urgently frozen by on-chain issuers, this massive sum cannot be converted into readily available cash usable by Binance until the tedious and complex judicial recovery process is completed.

Therefore, at the current stage, Binance must rely on its own hard cash reserves to initially fully cover the liquidity exposure amounting to $6.3 billion.

This gives rise to a much more severe second test: the surge in withdrawals after deposit and withdrawal channels are reopened.

Covering accounting losses is one thing, but under the backdrop of extreme market panic, whether it can withstand concentrated withdrawals from massive numbers of users acting like birds startled by a bow is another life-or-death examination.

Before formally resuming withdrawal services, Binance management must clearly articulate to the entire market the platform's financial guarantee plan for addressing large-scale liquidity withdrawals.

The most critical core question lies in this: before the frozen $3 billion in funds are actually recovered, what exact channels will Binance utilize to provide ample advance funding for withdrawal exposure?

Run Stampede and Chain Reaction Risks

Fig: Analysis of potential withdrawal pressure and liquidity outflow scenarios following exchange deposit/withdrawal restart

Binance has currently committed to covering all losses out of pocket. This statement has stabilized early-stage market sentiment to a significant extent.

However, reviewing the development history of the crypto industry, once panic spreads and evolves into a self-fulfilling collective irrational bank run, even platforms originally capable of solvency are extremely prone to falling into liquidity exhaustion traps.

Whether the platform can safely resolve this unprecedented crisis ultimately hinges entirely on whether Binance can fulfill every withdrawal request without hesitation the moment deposit/withdrawal channels return to normal.

This is not only the most severe test Binance has ever faced since its establishment, but also the ultimate touchstone for verifying whether a centralized exchange can smoothly weather the storm relying on substantial reserves after suffering extreme hacker strikes.