The incident involving the withdrawal of approximately $6 billion from Binance turned out to be far more complex than the exchange presented. A careful analysis of on-chain data reveals fundamental discrepancies between the public version of events and what is actually recorded on the blockchain.
The key unanswered question: who signed the transactions
The central mystery is who exactly authorized the withdrawal of assets using the hot key of Binance's own wallet. The exchange estimated the damage at approximately $6.3 billion, while Arkham data points to $6.01 billion withdrawn across nine networks. The transactions are traceable on Etherscan, and independent researchers recorded them at 20:32 UTC — earlier than the exchange made its first official statement.
The first transfer affected Binance 14 wallet at 20:24 UTC. In a single transaction, about $2.5 billion in ETH, USDT, and roughly 60 other tokens was moved. The mechanism worked thanks to EIP-7702, which allows an ordinary wallet to delegate control to a smart contract. According to one analyst's assessment, the attacker signed 50 such delegations using the key of Binance 14 wallet itself.
At the same time, Binance stated in its announcement that no signs of private key compromise had been detected. A natural question arises: who or what, in that case, signed these authorizations? Just 12 minutes later, ten more hot wallets of the exchange across four networks were sending funds to the same attacker's address.
Three hours of withdrawals and stablecoin freezes
According to Arkham data, the withdrawal of funds lasted from 20:10 to 23:05 UTC — about three hours. At 21:15 UTC, Binance founder Changpeng Zhao wrote that user funds were safe. Twenty-nine minutes later, the attacker drained Binance 14 again, taking another $200 million in USDT. In total, Etherscan recorded three separate withdrawals from this wallet: at 20:24, 21:04, and 21:44 UTC. The compromise remained active for more than two hours, and deposits were suspended only around 00:07 UTC.
The attacker took $1.6 billion in USDT and $823 million in USDC — the assets that are easiest to freeze on the network. Stablecoin issuers froze approximately $2.4 billion in about two hours. Binance reported the freezing of around $3 billion and promised to cover the remainder from the SAFU fund and its own funds.
This is where the gap in the figures emerges: SAFU holds 15,000 BTC, or approximately $1.15 billion at the current rate, while the shortfall is estimated at almost $3.3 billion. Until a full report and an updated proof-of-reserves are published, it remains unclear exactly how the largest exchange was hacked and how reliably it is protected now.
Cryptalist analysis: The discrepancies between on-chain data and the official chronology create a reputational risk for the entire centralized exchange industry. Until a transparent technical report and an up-to-date proof-of-reserves are presented, the market is entitled to factor a heightened counterparty risk premium into Binance's valuation. Investors should closely monitor the exchange's next steps in disclosing information.