Binance Pledges to Cover Hack Losses as EIP-7702 Role Is Debated

By Coinvote

Published October 31, 2026 - 11:23 UTC | 6 mins read

Binance says it has reserved more than $6.34 billion of its own money to cover a hot wallet theft that blockchain analytics firms tie to North Korea's TraderTraitor. Security experts disagree on how much Ethereum's EIP-7702 feature mattered, a question with lessons for exchanges and wallet teams.

Binance puts company money behind the losses

In a video address on Friday, CEO Richard Teng said Binance would pay for all losses from this week's theft out of company money. According to Decrypt, Teng stressed that customer funds were never touched and that the attack hit a Binance hot wallet.

Teng explained that most user assets sit in cold wallets and move to a hot wallet only when a user withdraws. He also said Binance can absorb a loss of this size because it keeps much of its operating earnings in crypto. The exchange had earlier said it would draw on its SAFU emergency fund and company funds.

The Defiant reported that Binance is reworking its withdrawal service following the breach, whose size the exchange puts in the billions of dollars. Cointelegraph, citing Binance's confirmation on Friday, called it the largest hack in crypto history.

What Teng says the attacker did

Teng said the operation was not the work of a single person. Binance initially blamed a compromised laptop, though it has since identified further breach points. Decrypt reports Teng also said a self-destruct mechanism erased the attacker's tools and traces, complicating the investigation.

The central technical claim concerns EIP-7702, an Ethereum feature that lets ordinary wallets run smart contract code. Teng said the attacker relied on it to gain approval to execute onchain actions from a hot wallet. In his words, that delegation did not pass through Binance's normal approval controls. According to Teng, this is the reason Binance halted withdrawals while it rebuilds and tests its systems again.

Decrypt reported that TRM Labs and Chainalysis, both blockchain analytics firms, pin the theft on North Korea's TraderTraitor group. Cointelegraph adds that Teng said investigators have found no evidence that wallet private keys leaked.

The key numbers behind the response

Binance's recovery plan rests on a few figures that Teng gave in his address. The attacker's laundering activity is also continuing, based on Arkham data cited by Decrypt.

More than $6.34 billion of company funds is reserved to cover the stolen assets.
Roughly $5 billion of the reserve is already held in the same assets that were stolen, among them USDC, USDT, BTC, ETH and BNB.
The exchange is buying the remainder through market and over-the-counter channels.
Arkham data show a Tron wallet it links to the hacker moved about 5.19 million TRX, roughly $1.73 million, to 12 addresses in a window on Friday from 11:37 a.m. to 12:12 p.m. ET.
Binance aims to bring withdrawals back before its Sunday deadline, and a complete proof-of-reserves report is due by Monday.

Experts split on whether EIP-7702 changed the outcome

Cointelegraph's reporting pushes back on the idea that the Ethereum feature was the root cause. Ido Ben-Natan, co-founder and CEO of security firm Blockaid, said attackers could have stolen the funds without EIP-7702. In his view, the upgrade offered a way to do it in one sweep, where attackers would otherwise have needed multiple transactions, and perhaps a way around some checks.

Ben-Natan's reading is that a compromised developer's computer gave attackers a path into Binance's wallet-signing infrastructure. From there, he said, they reached a position to propose transactions to a very secure signer. He summed it up this way: the signer "signed a transaction that they shouldn't have."

Ivo Georgiev, co-founder and CEO of wallet provider Ambire, went further and said EIP-7702 made little difference because the hackers could already authorize transactions. He warned, however, that exchange engineers might forget to revoke a malicious delegation after regaining control of their systems. Community member VEER described the attack as broader than one malicious signature but said the feature gave attackers a handy sweep button.

Why EIP-7702 drew scrutiny before this week

Ethereum introduced EIP-7702 in May 2025 as part of its Pectra upgrade. It gives standard wallets access to smart-contract functions, including batching several transactions together and having another party pay gas fees. A user signs a delegation that points their account to contract code, and that code then governs what the account can do.

Concerns surfaced quickly, according to Cointelegraph. In May 2025, trading firm Wintermute reported that most early delegations pointed to malicious contracts built to drain compromised wallets. In September 2025, holders of World Liberty Financial tokens reported losses tied to malicious delegations. VEER also cited security warnings raised during 2024 discussions of the proposal.

The history shows why a delegation that skips internal approval flows is a concern for any team holding large balances in Ethereum-compatible wallets. It does not settle whether the feature was decisive in the Binance case.

Where the accounts agree and differ

All three outlets describe a multibillion-dollar loss, and Decrypt and The Defiant both report that Binance is rebuilding its withdrawal infrastructure. Decrypt supplies the most operational detail, including the reserve size, the timeline for restoring withdrawals and the on-chain movements. The Defiant's summary is limited to the rebuild, the estimate and the destroyed tools and traces. Cointelegraph supplies the outside expert view.

The main difference is emphasis. Teng's account, as relayed by Decrypt and The Defiant, centers on the EIP-7702 delegation that avoided Binance's approval controls. Cointelegraph's experts treat compromised signing systems as the likelier enabler and the feature as a possible amplifier. Cointelegraph also describes the first suspected entry point as an engineer's laptop, while Decrypt refers only to a compromised laptop.

Decrypt also relays a broader perspective from Binance co-founder Changpeng Zhao. He said it is the biggest theft measured in dollars but not measured in bitcoin, citing the 650,000 BTC lost at Mt. Gox, over 5% of supply. Because Binance is covering the losses itself, he said, users will not be left affected as they were at Mt. Gox and FTX. "It hurts, but we survive," he wrote.

Aave's role and what to watch next

According to TRM Labs, cited by Decrypt, the attacker borrowed ETH against USDT on Aave while racing stablecoin freezes. Aave froze markets on its V3 and V4 deployments as a precaution, halting new deposits and borrowing while still processing withdrawals and repayments. On Friday it unfroze them all, and founder Stani Kulechov wrote that Aave was unaffected and all positions remain overcollateralized.

Several questions remain open. Will Binance meet its Sunday target for restoring withdrawals? Will the proof of reserves report due Monday confirm the exchange's account of its balances? Will the security review Binance is running across endpoints, cloud systems, key handling and signing alter how exchanges treat delegation approvals? Blockaid's Ben-Natan argued that transaction simulation could help flag malicious requests before they are approved.

Readers who track Ethereum projects can follow new listings on New Ethereum Tokens Listed Today, and those watching the meme sector can check Best Ethereum Meme Coins Today.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$77,351	-0.3%	-4.0%	$1.56 trillion
Ethereum (ETH)	$2,244	+0.1%	-5.2%	$274.20 billion
TRON (TRX)	$0.320014	-5.9%	-3.5%	$30.41 billion
Aave (AAVE)	$133	+5.5%	-5.2%	$2.05 billion
World Liberty Financial (WLFI)	$0.050031	-1.2%	-5.3%	$1.59 billion

CoinGecko data as of 2026-10-31 (UTC); DeFi TVL from DefiLlama: Ethereum $43.95 billion.

On Coinvote

New Ethereum Tokens Listed Today: 2,931 projects tracked, 4 new listings in 7 days, 78 community votes today.
Best Ethereum Meme Coins Today: 258 projects tracked, 2 new listings in 7 days, 11 community votes today.

FAQ

Are Binance customer funds affected by the hack?

Richard Teng said the attack hit Binance's own hot wallet and that no customer funds were used or affected, according to Decrypt. Binance says it will cover all losses from company funds, with more than $6.34 billion reserved.

Did EIP-7702 cause the Binance hack?

Teng said the attacker's EIP-7702 delegation got around the exchange's usual approval controls. Cointelegraph quotes Blockaid's Ido Ben-Natan saying attackers could have drained the funds without it, with compromised signing systems the likelier enabler.

When will Binance resume withdrawals?

Teng said Binance hopes to restore withdrawals before its Sunday deadline after rebuilding and retesting its infrastructure. A full proof of reserves report is planned by Monday, with an initial view before then.