AI-generated illustration

Binance Co-CEO Richard Teng said the exchange hopes users will be able to withdraw funds again before the Sunday deadline it has set, as work on the aftermath of a security incident is expected to be finished within 40 hours.

In a video message posted on the X social media platform, Teng said all losses from the cyberattack will be covered from company funds and that customer assets were not affected.

Withdrawal service to return after testing

Teng said withdrawals were halted so the exchange could examine, rebuild and test its entire infrastructure system. The service will not be brought back before it passes comprehensive tests, he said.

"We hope users will be able to withdraw funds before our Sunday deadline, within work expected to be completed in 40 hours," Teng said.

Losses to be covered from company funds

Teng said Binance has set aside more than $6.34 billion in company funds to cover the stolen assets, with about $5 billion of that amount held in token assets directly affected by the attack, including USDC, USDT, Bitcoin, Ethereum and BNB.

Because the company keeps a large share of its daily operating earnings in crypto assets, it can absorb the loss with its own resources, Teng said. The remaining amount will be covered through purchases on the market and over-the-counter channels.

Customer funds were not affected

Teng said customer funds were not hit by the incident. "We never use customer funds, so they were not affected in any way. This incident affected Binance's own hot wallet," he said, adding that user assets are held under the exchange's established security architecture.

The large majority of assets are stored in cold wallets and are moved to a hot wallet only when a user makes a withdrawal, according to Teng.

Investigators trace a complex attack

Technology and security teams are continuing their review of the incident. "This attack was not carried out by a single individual," Teng said.

Early findings suggested that a compromised laptop may have played a role in the security breach, but later checks identified other breach points, which led Teng to describe it as a complex attack. The attacker used a mechanism that destroyed the tools and traces left behind, making the attack harder to track and examine.

The attacker used the known multi-signature protocol EIP-7702 to gain the authority to run on-chain transactions on the hot wallet, and that authorization did not pass through the usual approval controls, Teng said.

Security review and reserves report

Teng thanked the partners that moved quickly to freeze the affected assets, the international law enforcement agencies supporting the investigation and users for their patience. Work to address user losses is continuing without interruption, he said.

The company is carrying out a broad security review covering endpoints, cloud systems, key management and signing processes. It will complete the purchases of the remaining assets and verify them in a Proof of Reserves report.

Binance aims to publish a comprehensive Proof of Reserves report by Monday, with preliminary information to be provided before then, Teng said.

Key takeaways

• Binance Co-CEO Richard Teng said the exchange hopes to resume withdrawals before its Sunday deadline, with work expected to take 40 hours.
• More than $6.34 billion in company funds has been set aside to cover the stolen assets, including about $5 billion held in affected tokens.
• Teng said customer funds were not affected; only Binance's own hot wallet was hit.
• Teng described the incident as a complex attack not carried out by one person, with the attacker exploiting the EIP-7702 multi-signature protocol.