Binance says hackers who stole billions in crypto spent months planning heist

Summary

Binance revealed that attackers drained major cryptocurrency holdings by exploiting Ethereum's EIP-7702 delegation mechanism across its hot wallets. Containment teams froze $2.85 billion in assets while executing a complex procedure to revoke on-chain authorizations.

Key Takeaways

1. The attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism.
2. Binance hot wallets on Solana and Optimism sent approximately 970,500 SOL and 44.2 million OP to attacker-controlled addresses.
3. Binance immediately initiated multiple containment measures, including suspending withdrawals to restrict further outflows, coordinating with partners to freeze affected tokens, and taking steps to revoke unauthorized permissions. These efforts froze a total of $2.85 billion in assets.

Statement Breakdown

• Claimed Facts: 95% of statements the article presents as facts
• Opinions: 5% of statements classified as editorial or subjective
• Claims: 0% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The reporting relies on detailed technical incident descriptions attributed directly to Binance. It provides specific token amounts, technical mechanisms, and asset figures without citing independent outside investigators. Sourcing is consistent and focused entirely on the exchange's internal findings.

Bias assessment: Technical Incident Reporting. The presentation is neutral, analytical, and strictly focused on cybersecurity mechanics. It documents the sequence of events and containment steps without editorializing or adopting promotional framing.

Note: Relies entirely on technical disclosures and asset estimates provided by Binance.

Credibility flag: Company Disclosure

Claimed Facts (2)

• Reports a specific transfer of cryptocurrency that can be verified against transaction logs.
• States a quantifiable technical action taken on-chain by the threat actors.

Opinions (1)

• Presents an evaluation of the operational difficulty encountered during the response effort.

Key Sources

• Binance — Cryptocurrency exchange that investigated and contained the security incident
• Dan Goodin — Security editor reporting on the technical post-mortem