Hardware Ready Ready to Bench?
On October 29 at 10:23 PM EDT, Binance announced a cybersecurity breach that led to unauthorized withdrawals. According to initial estimates reported by CoinDesk and Wu Blockchain, the total impact of the incident amounts to $6.3 billion. The attack involved the platform’s hot wallets, including ‘Binance 14’, and several blockchain chains, exploiting the EIP-7702 standard to transfer assets in batches.
Why it matters
The event has reignited the debate on the effectiveness of decentralization as a security advantage in the digital asset sector. CoinDesk highlights a paradox: platform centralization was identified as a factor that made the attack possible, but at the same time allowed for the recovery or saving of $3 billion due to the ability to intervene rapidly. Binance suspended withdrawals for approximately 45 hours to perform remediation operations, keeping deposits active. The company allocated $6.34 billion in corporate funds to cover the incident, ensuring coverage of user losses.
The numbers
The two sources agree on the initial estimate of the total impact: $6.3 billion. Wu Blockchain specifies that frozen on-chain assets amount to $3 billion (with a previously verified figure of $2.54 billion), while CoinDesk indicates that centralization allowed for saving or recovering $3 billion. Binance communicated that it allocated $6.34 billion to address the emergency. Additionally, the value of tokens already held corresponding to the affected assets was estimated at $5 billion.
What remains to be understood
According to Sisi, a Binance representative, the preliminary investigation indicates that a DevOps engineer’s laptop may have been compromised, allowing access to a service container. However, the complete path of the attack and how valid on-chain signatures were generated are not yet confirmed. Shenyu, co-founder of Cobo, emphasized that there is no definitive evidence that wallet private keys were stolen; a valid signature can also derive from the abuse of an authorized system requesting signatures without direct access to the key. Cosine, founder of SlowMist, clarified that the attacker chose EIP-7702 primarily to simplify batch token transfers, and that the mechanism itself is not defective. Malicious authorizations were revoked after the incident.
Sources: CoinDesk, Wu Blockchain.
This article is for informational purposes only and does not constitute financial advice or an investment recommendation.
* Content created with the assistance of artificial intelligence systems.