coindesk.com
The Binance wallets emptied in Thursday’s hack are the same wallets the exchange lists as proof that customers’ crypto is fully backed, according to a CoinDesk review of Binance’s own reserve data.
That means that Binance’s 1:1 backing of some assets, ether in particular, has likely fallen below 100% until the exchange replaces what was taken.
Every month, Binance publishes a list of wallets it controls and what they hold, and compares those totals with what customers hold on the platform. Its most recent report, dated Oct. 1, includes a wallet labeled “Binance 14,” the wallet at the center of the attack. At the time of the report, it held 1.26 billion $USDT and 89,475 $ETH, among 37 assets.
The attacker used an Ethereum feature called EIP-7702, which lets a wallet hand control to a piece of software. After getting Binance 14’s key to sign that permission, the attacker turned the wallet into a sweeper that forwarded incoming funds to their own address. Etherscan shows 167,464 $ETH moving from Binance 14 at 20:24 UTC, or 4:24 pm ET, followed by 28,005.6 $ETH from Binance 16, both into the attacker’s wallet. Nearly 15 minutes later, 195,460 $ETH (around $442 million) was sent to a second address.
That loss falls on a thin cushion, as on Oct. 1 Binance held exactly enough $ETH to cover customer balances (a 100% reserve ratio) and 108.26% of customers’ $USDC. The roughly 204,500 $ETH taken represents approximately 5.6% of Binance’s $ETH reserves, leaving Binance’s $ETH backing near 94%. The attacker’s smaller positions, including ENA, UNI, PEPE and AAVE, represent anywhere from 7% to 15% of Binance’s reported holdings of each.
Binance and its co-CEO Yi He have said user funds are safe. In practice, that means customers’ balances will be honored even though assets behind them were stolen. Founder Changpeng Zhao also said he expects users to be fully recovered.
Stablecoin issuers have frozen much of the haul, with Tether CEO Paolo Ardoino saying more than 1.567 billion $USDT was frozen, while Zhao said Circle’s $USDC freeze was around $823 million. Ripple also froze around $200 million in assets and World Liberty Financial froze $27 million worth of its USD1 stablecoin.
