Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'

Binance announced on October 30 that it has set aside more than $6.34 billion of its own funds to cover the $6.3 billion loss from a hack that hit its hot wallet on October 29. CEO Richard Teng said the exchange will replace the stolen tokens, with $5 billion already held in the exact assets taken, and pledged that customer funds remain untouched. The company aims to resume withdrawals within roughly 34 hours and will publish a full proof‑of‑reserves report by early November.

Background

The breach occurred at about 20:05 UTC on October 29 when Binance’s hot wallets were compromised, allowing an attacker to withdraw roughly $6.3 billion in digital assets, including USDC, USDT, BTC, ETH and BNB. Binance’s internal investigation initially pointed to a compromised laptop but later uncovered additional points of intrusion, though no private keys were found to be leaked. Blockchain analytics firms TRM Labs and Chainalysis have linked the theft to a North Korean hacking group known as TraderTraitor, a link also reported by Reuters. Binance’s Secure Asset Fund for Users (SAFU) and corporate treasury are being used to absorb the loss, with about 80 percent of the stolen tokens already replenished. Coordination with law‑enforcement agencies, blockchain intelligence firms, asset issuers and industry partners has frozen roughly $3 billion of the stolen assets across multiple blockchains. The exchange also paused withdrawals to rebuild and retest its infrastructure, conducting a full security review covering endpoints, cloud, key management and signing. Meanwhile, decentralized lending protocol Aave unfroze its markets after confirming that its contracts were unaffected and that all positions remained over‑collateralised.

What happened

On October 29 Binance’s hot wallets were breached, resulting in unauthorized withdrawals of about $6.3 billion worth of crypto, according to the company’s statement (source 3). CEO Richard Teng told users in a video address that Binance will cover every dollar lost with its own money, reserving over $6.34 billion, of which $5 billion is already held in the exact tokens taken (sources 1, 2). The exchange is buying the remaining assets through market and over‑the‑counter channels (sources 1, 2). Teng explained that the attacker used a self‑destruct mechanism that erased tooling and traces, and exploited the Ethereum EIP‑7702 delegation to bypass Binance’s normal approval controls, prompting the temporary pause of withdrawals (sources 1, 2). TRM Labs and Chainalysis attributed the theft to the North Korean group TraderTraitor (sources 1, 2, 4). Binance reported that about $3 billion of the stolen assets have been frozen through coordination with law‑enforcement and industry partners (sources 3, 4). The company plans to restore withdrawals in phases within roughly 34 hours and to publish an updated proof‑of‑reserves report by Monday, November 2 (sources 3, 4). Aave, which the attacker briefly used to borrow ETH against USDT, unfroze all its markets after confirming no impact on its contracts (sources 1, 2). Binance also said it found no evidence that private keys were leaked and will release a detailed technical report within about 48 hours (sources 3, 4).

Market impact

The hack removed approximately $6.3 billion in digital assets from Binance’s hot wallet, representing a sizable shock to the crypto market. Binance has already replenished about 80 percent of the stolen tokens, with $5 billion held in the exact assets taken and the remainder being purchased on market and OTC venues (sources 1, 2, 3, 4). Around $3 billion of the stolen funds have been frozen across blockchain networks, limiting further price pressure (sources 3, 4). The attacker moved roughly 5.19 million TRX, valued at about $1.73 million, to twelve addresses on a Tron wallet between 11:37 a.m. and 12:12 p.m. ET on the day of the breach (sources 1, 2). Binance’s ability to absorb the loss stems from keeping a large portion of its operating earnings in crypto, which it says allows it to cover the loss without tapping user deposits (sources 1, 2). The temporary withdrawal pause and subsequent phased resumption are expected to stabilize user confidence, while the forthcoming proof‑of‑reserves report aims to provide transparency on the exchange’s asset backing.

Why it matters

The incident underscores the systemic risk that a breach of a major centralized exchange can pose to the broader crypto ecosystem, as the theft involved multiple high‑value tokens and triggered coordinated freezing actions across blockchain networks. Binance’s decision to cover the loss entirely from its SAFU fund and corporate treasury signals a strong commitment to user protection, potentially setting a precedent for other exchanges facing similar crises. The attribution to a North Korean hacking group highlights the geopolitical dimension of crypto theft, where illicit proceeds may fund state‑level activities, as noted by cybersecurity experts cited by Reuters. The use of the EIP‑7702 delegation to bypass approval controls raises concerns about emerging smart‑contract features that could be exploited if not properly vetted. Finally, the rapid response—freezing $3 billion, conducting a full security review, and planning a proof‑of‑reserves audit—demonstrates how industry collaboration with law‑enforcement and analytics firms can mitigate damage and restore market confidence after a large‑scale breach.