Between $5.57 billion and $5.84 billion in crypto assets were drained from Binance hot wallets across the Ethereum, Arbitrum, and Avalanche networks. On-chain data and Arkham Intelligence recorded the incident as the largest breach in the 18-year history of the crypto industry. The attacker drained balances through EIP-7702 delegation, transferring 167,464 ETH and dozens of tokens to their wallet. The scale of the hack triggered defensive measures across multiple protocols.
How the EIP-7702 Flaw Drained Balances Without Signatures
Three minutes before the balance-draining began, the attacker’s address received initial funding via the Tornado Cash privacy mixer protocol. Armed with those initial funds, the perpetrator activated EIP-7702-based contract delegation. This Ethereum feature allows standard wallets to execute permanent smart contract code, enabling subsequent transfers to be authorized without requiring additional signatures from the wallet’s original owner.
The hacker’s wallet then transferred massive amounts of Binance asset reserves. Arkham Intelligence noted that the movement included $1.45 billion in Bitcoin (BTC), $875 million in Ethereum (ETH), $1.57 billion to $1.615 billion in USDT, $823 million in USDC, $234 million in TRX, and $88.5 million in RLUSD. The attacker also held tens of millions of dollars in altcoins that had not yet been offloaded, including 217.49 million ENA and 7.57 trillion PEPE.
Race Against Time in DeFi Protocols Before the Freeze
The hacker attempted to launder funds by swapping freezable stablecoins into Ethereum via decentralized exchange Uniswap. The exploiter exchanged 36 million RLUSD for 15,439 ETH before the remaining balance was frozen. On DeFi lending protocols, the perpetrator deposited 60 million USDT into Aave V3 to borrow 19,762 ETH. The move prompted Aave to temporarily freeze V3 markets on Ethereum mainnet and Avalanche, while Kamino protocol on Solana also suspended its SOL/BTC lending market.
Stablecoin issuers moved quickly to freeze the hacker’s addresses. Tether froze more than $1.567 billion in USDT, Circle froze $823 million in USDC, and Ripple froze approximately $200 million in assets, including RLUSD. World Liberty Financial and BitGo also froze $27 million in USD1 and $2 million in WLFI, respectively. Binance management confirmed that total stolen assets frozen by stablecoin issuers reached between $2.4 billion and $2.54 billion.
Withdrawals Temporarily Suspended, SAFU Reserves Readied
With major stablecoin exit routes closed, the hacker began offloading altcoins on-chain, including PEPE, UNI, and LINK, in exchange for ETH. Meanwhile, Binance temporarily suspended customer withdrawals until its security investigation was complete.
For Binance customers, the withdrawal pause was met with assurances from exchange leadership. Binance co-founder Changpeng Zhao (CZ) and Co-CEO Yi He confirmed that user funds remain secure under the SAFU scheme and are fully backed by emergency reserves. Account recovery now hinges on the completion of the investigation, while movements of the remaining stolen funds continue to be tracked on-chain.
Reported by Decrypt.
Read also: Bithumb Internal App Breached by Hackers - Customer Crypto Balances Confirmed Untouched
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
