Binance, the world's largest cryptocurrency exchange by trading volume, is confronting one of the most technically sophisticated security breaches in the industry's history. Chief Executive Officer Richard Teng confirmed that the exchange has ring-fenced $6.34 billion specifically to cover losses stemming from a hack that exploited a combination of a self-destruct mechanism and an Ethereum Improvement Proposal 7702 (EIP-7702) delegation — a pairing that allowed the attacker to sidestep Binance's standard approval controls entirely.
Teng moved quickly to reassure the exchange's hundreds of millions of users with a direct message: "Your assets are safe." The scale of the reserve — $6.34 billion — signals that Binance is treating this not as a routine security incident to be managed quietly, but as an existential reputational test requiring a full, public financial commitment. For an exchange that built its dominance in part on the promise of institutional-grade security, the manner of this breach is arguably more damaging than the headline figure.
How the Attack Worked
The mechanics described by Teng point to a deeply premeditated exploit that weaponized relatively new Ethereum infrastructure. EIP-7702 is a protocol-level change that allows externally owned accounts — standard user wallets — to temporarily assume the behavior of smart contracts by delegating execution authority. It was introduced to improve wallet flexibility and user experience, enabling more programmable transaction logic without requiring users to deploy full smart contract accounts. In the wrong hands, however, that same delegation mechanism becomes a vector for rewriting who controls an account's approval logic at the moment of a transaction.
The attacker paired this delegation technique with a self-destruct mechanism — a callable function within smart contracts that wipes contract state and forwards remaining funds to a designated address. By combining EIP-7702 delegation with a self-destruct sequence, the exploit appears to have allowed the bad actor to temporarily inherit control over approval logic, drain the targeted funds, and then erase the malicious contract's footprint, complicating forensic analysis. Binance's normal approval controls — the gatekeeping layer that verifies whether a transaction has the legitimate authorization it claims — were bypassed before they could intervene.
This is not a case of a phishing link or a compromised private key in the conventional sense. It is an attack that lived at the protocol interface layer, exploiting the gap between how EIP-7702 was designed to function and how an exchange's internal security stack was built to inspect transactions. That gap, it turns out, was wide enough to drive $6.34 billion worth of exposure through.
The Reserve: Reassurance or Reckoning?
The $6.34 billion figure warrants close scrutiny. Setting aside a reserve of this magnitude is a meaningful act — it demonstrates that Binance has the liquidity to back Teng's assurances, and it preempts the kind of confidence crisis that has previously caused exchange collapses when users suspect a mismatch between liabilities and assets. The ghost of FTX haunts every major exchange incident, and Teng's decision to publicly name a specific reserve figure is clearly calibrated to prevent a run dynamic from taking hold.
At the same time, $6.34 billion is an extraordinary sum, reflecting either the raw scale of funds at risk, the total exposure the exchange is choosing to guarantee, or some combination of both. Binance has not historically been shy about its financial depth — the exchange has at various points disclosed substantial reserve holdings across its proof-of-reserves attestations — but formally designating funds to cover hack losses of this magnitude sets a new precedent in crisis management for centralized exchanges.
EIP-7702 and the Emerging Attack Surface
The broader implication for the industry extends well beyond Binance. EIP-7702 was finalized as part of the Ethereum Pectra upgrade and has been live on mainnet for only a limited period. Security researchers had flagged theoretical risks around account delegation mechanics during the proposal's review phase, but theoretical risk and live exploitation are separated by a chasm that the wider ecosystem now knows has been crossed.
Every centralized exchange, custodian, and decentralized finance protocol that processes Ethereum transactions needs to ask whether its transaction validation and approval logic was built with EIP-7702 delegation in mind — and specifically, whether it can detect when delegation has been used to temporarily substitute malicious authorization logic for legitimate account controls. The answer, in many cases, is almost certainly no. Security stacks are typically built against known attack patterns; novel protocol features create blind spots precisely because defenders are still learning what they enable.
What This Means
Richard Teng's public posture — a firm financial commitment paired with direct user reassurance — is the correct crisis response, and the $6.34 billion reserve is a credible instrument for preventing panic. But the deeper problem this incident surfaces is structural: the Ethereum ecosystem's push toward more programmable, flexible account logic creates a permanently expanding attack surface that security infrastructure at every level of the stack must continually adapt to cover. The Binance hack is not merely a story about one exchange's security failure. It is a stress test for the entire model of building custodial and non-custodial services on top of rapidly evolving protocol primitives — and the results of that test demand an industry-wide response, not just a reserve fund.
Written by the editorial team — independent journalism powered by Bitcoin News.