Tiger Research：币安遭遇 63 亿美元史上最大黑客攻击，只靠承诺赔付真的够吗？

This article comes from Tiger Research. Binance, the world's largest cryptocurrency exchange, has suffered a hack. Blockchain research institutions and security firms confirmed the occurrence of this catastrophic event after collaboratively tracking abnormal on-chain fund movements.

All parties have confirmed this incident as the largest-scale hack theft in the history of the crypto industry. The core facts confirmed so far are summarized below.

Key Points

• Binance's official preliminary estimate puts the total losses from this hack at approximately $6.3 billion. This figure makes it the highest-value attack incident in crypto history.
• The attackers infiltrated Binance's internal systems by maliciously compromising an employee's personal computer. Subsequently, the hackers did not directly submit a single transfer but instead exploited Ethereum's EIP-7702 feature to carry out the attack.
• The hackers successfully induced the system into signing a malicious authorization. This authorization allowed a malicious program designated by the hackers to drain 63 different token assets in a single sweep within minutes.
• Looking back at history, FTX's collapse was caused by internal misappropriation of customer assets for speculation. In contrast, Binance's losses this time stem entirely from an external hacker intrusion, and the platform itself still maintains a large asset reserve.
• Nevertheless, the $3 billion in assets that have been urgently frozen by major stablecoin issuers cannot be immediately returned in the short term. This means that at the current stage, Binance must first self-fund and advance the entire $6.3 billion gap.

Scale of Losses and Incident Timeline

Figure: Review of the key timeline of the largest hack in history suffered by Binance

Binance, the world's largest cryptocurrency exchange, has suffered a hack. Blockchain research institutions confirmed this sudden security incident immediately after discovering abnormal on-chain transfer patterns.

The entire hack evolved rapidly within hours, from covert onset to full exposure. The key time points recorded by all parties are as follows:

05:24 AM: The hackers drained 167,464 ETH and approximately $1.6 billion in USDT assets from Binance's hot wallet in a single sweep.

05:32 AM: Independent on-chain detective Spreek was the first to publicly raise the alarm on social platforms, noting that extremely abnormal large-value fund transfers were occurring at Binance-related addresses.

06:15 AM: Binance co-founder Changpeng Zhao publicly stated that Binance did indeed appear to have been hacked.

06:16 AM: Binance's official Twitter posted its first formal announcement, stating that the team was urgently investigating potential security vulnerabilities in the system.

06:18 AM to 06:25 AM: Circle urgently froze $800 million worth of USDC, and Tether followed by freezing $1.57 billion worth of USDT assets.

09:13 AM: Binance announced a full suspension of deposit and withdrawal services across the platform and explicitly committed to fully covering all user losses in this incident.

09:52 AM: Binance officially confirmed that, with on-chain assistance from various parties, approximately $3 billion of the stolen funds had been successfully frozen and intercepted on-chain.

11:23 AM: Binance formally released its preliminary investigation results. The report showed that the platform-wide total loss was approximately $6.3 billion.

Based on Binance's $6.3 billion loss estimate, this amount is more than 4 times the previous industry record held by Bybit ($1.46 billion).

Full Review of the Attack Methodology

As of now, Binance has only released a preliminary investigation brief and has not yet disclosed a complete technical investigation report. However, based on public on-chain data and analysis by multiple security experts, the attack path is basically clear.

Forged Signature Requests: The Common Fatal Weakness in Recent Exchange Hacks

Figure: Diagram of signature verification and forged request logic for internal asset outflows at centralized exchanges

In the multiple large-scale exchange hacks that have occurred recently in succession, the attackers did not directly steal the private keys themselves. Instead, they targeted the signature verification step in the withdrawal process.

When a centralized exchange needs to transfer crypto assets to an external on-chain address, the transaction must be signed and confirmed by a dedicated system that holds the private keys.

To safeguard assets, large exchanges generally adopt cold wallets (offline private key storage) and multi-signature wallets (requiring separate approval and confirmation by multiple authorized parties).

However, before the final signing action is executed, the system must first verify whether the withdrawal request was initiated by a legitimately authorized employee. This verification step has precisely become the attackers' core target.

Once hackers successfully compromise an internal employee's work device, they can use it as a springboard to send seemingly fully compliant forged transaction signature requests to the signing system.

Upon receiving instructions with legitimate credentials, the signing system often mistakenly judges them as genuine authorizations, thereby automatically signing and broadcasting the illicit withdrawal transaction.

In recent real-world security cases, the vast majority of attackers first compromised internal employees' physical devices through social engineering tactics.

Social engineering attacks essentially exploit human weaknesses and human negligence rather than pure code-level vulnerabilities in software. Hackers typically use spear-phishing or job recruitment schemes to deliver malicious payloads.

In multiple previous severe incidents, attackers likewise succeeded by using infected employee devices as the breakthrough point.

Take the $1.46 billion hack suffered by Bybit in February 2025 as an example: the attackers sent fake job resumes to employees, covertly implanted malicious trojans, and successfully hijacked internal requests.

In the May 2024 DMM Bitcoin incident in which $305 million was lost, North Korean hacker groups similarly posed as recruiters and infiltrated by delivering targeted payloads to specific engineers.

In both typical cases, the attackers first gained intranet access by deceiving internal personnel, and then used the infected terminals to forge fund transfer requests.

The Core Differences That Set the Binance Hack Apart

Figure: Breakdown of Ethereum's EIP-7702 authorization mechanism and the batch asset theft process

Judging from existing signs, Binance's breach this time also began with typical social engineering infiltration.

Binance's official brief confirmed that an internal engineer's laptop was compromised, and it was through this device that the hackers successfully infiltrated Binance's intranet environment.

However, the key driver behind the geometric explosion in total losses this time is a new feature introduced by the Ethereum ecosystem: EIP-7702.

The EIP-7702 mechanism allows ordinary externally owned accounts (EOAs) to sign a delegation authorization designating a smart contract program to temporarily execute preset operations on behalf of that account.

The attackers exploited this in an extremely insidious way. After infiltrating Binance's intranet system, the hackers successfully manipulated the employee terminal and induced the target hot wallet to sign an EIP-7702 authorization instruction.

Just 3 minutes later, the hackers activated the malicious contract program. In an extremely short period, the program swept through 63 different token assets in succession like a whirlwind.

In traditional attacks of the past, hackers had to separately construct and submit a signature request for each token. As a result, the entire theft process typically took a long time.

The lengthy time window often gave exchange risk control systems time to issue alerts and block transactions. For example, in the Bybit incident, the hackers took 1 hour and 16 minutes to complete the transfer.

But in Binance's case, the hackers completed the batch outflow of dozens of mainstream assets in an instant with just a single EIP-7702 authorization signature. This left the defenders almost no reaction time.

Will Binance Follow in FTX's Footsteps and Collapse?

The core question of greatest concern across the entire market right now is whether this massive loss will cause Binance to collapse spectacularly like FTX did back then.

An External Attack Fundamentally Different from FTX's Misappropriation of Funds

Figure: Essential comparison between FTX's internal misappropriation and insolvency and Binance's external hacker attack

From the perspective of the root cause of the crisis, the problems faced by Binance and FTX are fundamentally different in nature.

The root cause of FTX's downfall was by no means an occasional external hacker theft, but rather management's long-term covert illegal misappropriation of customer assets to provide bottomless leveraged lending to the affiliated hedge fund Alameda.

When the Terra-Luna collapse in May 2022 triggered a market-wide stampede, Alameda's external creditors rushed to recall their loans. FTX then misappropriated billions of dollars in customer deposits to fill the hole.

As asset prices plummeted and collateral values went to zero, FTX had in fact fallen into a permanent balance-sheet insolvency of more than $8 billion, and thus instantly crumbled when the bank run erupted.

In stark contrast, Binance's crisis this time stems purely from a single-point asset theft caused by external hackers. There is no fatal black hole in Binance's own balance sheet structure involving active misappropriation of funds.

Does Binance Have Sufficient Financial Strength to Withstand and Cover the Losses?

Figure: Comparison between Binance's total asset reserves and the $6.3 billion stolen loss as a proportion

Binance's official estimated total loss is $6.3 billion. This scale accounts for approximately 4.4% of the roughly $144 billion in total assets disclosed by the Binance platform.

From a ratio perspective alone, a 4.4% asset shrinkage appears to be within a tolerable range on paper. However, at the actual operational funding level, the situation is far more complex.

Although $3 billion of the stolen assets have currently been urgently frozen by on-chain issuers, this huge sum cannot be converted into usable cash for Binance until the cumbersome and complex judicial recovery process is completed.

Therefore, at the current stage, Binance must rely on its own hard-cash reserves to first fully cover the liquidity exposure of up to $6.3 billion.

This leads to a more severe second test: the wave of withdrawals after deposit and withdrawal channels reopen.

Covering the book losses is one thing, but against the backdrop of extreme market panic, whether it can withstand a concentrated wave of withdrawals from a massive number of users acting like frightened birds is another life-or-death test.

Before formally restarting withdrawal services, Binance's management must clearly explain to the entire market its funding guarantee plan for coping with large-scale liquidity outflow.

The most critical core question among them is: before the frozen $3 billion is actually recovered, through what channels will Binance provide sufficient advance funding for the withdrawal exposure?

Risks of Bank Runs, Stampedes, and Chain Reactions

Figure: Scenario analysis of potential withdrawal pressure and liquidity outflow after exchanges restart deposits and withdrawals

Binance has now committed to covering all losses out of its own pocket. This statement has largely stabilized market sentiment in the early stage of the incident.

However, looking back at the history of the crypto industry, once panic spreads and evolves into a self-fulfilling irrational bank run, even platforms that were originally solvent can easily fall into a liquidity exhaustion trap.

This is not only the most severe test Binance has faced since its founding, but also the ultimate touchstone for whether a centralized exchange can rely on its substantial reserves to weather the storm smoothly after suffering a severe blow from an extreme hacker attack.