Binance has set aside more than US$6.34 billion of company money to replace crypto stolen from one of its own wallets, the largest heist the industry has recorded, and its chief executive says customer balances will be restored in full.
“We are committed to covering all hacked losses through our company funds. Your assets are safe,” chief executive Richard Teng said in a transcript he posted on X, Decrypt reported.
About US$5 billion of that reserve is already held in the same tokens that were taken, among them USDC, USDT, BTC, ETH and BNB. The exchange is buying the balance on the open market and through over-the-counter channels.
Teng said the breach hit a Binance hot wallet rather than customer holdings. “We never use any customer funds, so they are not impacted.” Most user assets sit in cold storage and move into a hot wallet only when a withdrawal is requested, he said.
Investigators first traced the theft to a compromised laptop used by a DevOps engineer. The exchange later found more entry points. Teng said the attacker also ran a self-destruct mechanism that wiped tooling and traces along the way. “This was not carried out by one person.”
The attacker obtained onchain execution approval over a hot wallet through EIP-7702, an Ethereum feature that lets ordinary wallets run smart contract code. “That delegation did not pass through our normal approval controls,” Teng said. Binance paused withdrawals while it rebuilt and retested its systems in response. Two blockchain analytics firms, TRM Labs and Chainalysis, have linked the theft to TraderTraitor, a North Korean group, the BBC said.
Around US$3 billion of the stolen assets has been frozen with help from industry partners, though much of the haul remains with hackers who have not been identified. The US Secret Service said it was “working around the clock” to “identify, freeze, trace, and recover” the funds. Binance said it is working with the FBI.
Withdrawals are due to resume before a Sunday deadline. Teng said the security review covers endpoints, cloud systems, signing procedures and the way the exchange stores credentials. A full proof of reserves report is promised by Monday, with an initial view released before then.
The fallout reached decentralised finance. Aave, where the attacker borrowed ETH against USDT, froze all markets on its V3 and V4 deployments as a precaution after the first reports, then unfroze them on Friday. “Aave was unaffected, and all positions remain overcollateralized,” founder Stani Kulechov wrote.
Crypto prices fell. Bitcoin was down 5% at US$76,800 in Friday afternoon trading in New York, Coinbase dropped 12% and Robinhood 7.8%.
The attacker is still moving funds. Between 11.37am and 12.12pm Eastern time on Friday, a Tron wallet that Arkham attributes to the hacker sent about 5.19 million TRX, worth roughly US$1.73 million, to 12 addresses.
Binance co-founder Changpeng Zhao said the haul is the largest in dollar terms but not in Bitcoin terms, pointing to Mt. Gox’s loss of 650,000 BTC, more than 5% of the supply. Unlike at Mt. Gox and FTX, where nearly every user was hit, Binance is absorbing this loss itself. “It hurts, but we survive,” he wrote.
Doubts remain over what the pledge is worth. Daniel Tunkel of London law firm Edwin Coe said any claim would “come down to what [customers] have been promised in their contracts”, and whether Binance can be sued for non-performance.
Binance was founded in China in 2017 and has more than 300 million registered users. In 2024 it said it held more than US$160 billion of assets in custody.
