Binance sets aside $6.34B to cover $6.3B hack losses as $3B stays frozen
In brief
- Binance set aside over $6.34 billion to cover $6.3 billion in stolen assets, the exchange said.
- About $3 billion of the stolen funds remained frozen, according to Binance.
- Binance said $5 billion of the set-aside was already held in the affected tokens.
- Chainalysis said attackers may be using automation to move and redistribute stolen funds.
- Aave resumed V3 and V4 deposits and borrowing after a precautionary freeze.
How Binance says it'll cover the gap
Binance said $5 billion of the $6.34 billion set aside was already held in the same tokens hit by the attack. It's buying the rest through market and over-the-counter transactions to cover token shortfalls. Some of those purchases could take longer (the exchange cited low liquidity and OTC settlement times). The allocation excludes frozen or protected assets.
Co-CEO Yi He said Binance is buying altcoins in quantities matching those stolen as it prepares updated proof of reserves, through OTC deals and on exchanges. She added that the SAFU fund and company holdings include substantial amounts of Bitcoin and Ether.
A Binance spokesperson told Cointelegraph the $5 billion in matching tokens is held in the exchange's custody, but declined to disclose wallet addresses, citing security reasons. Binance said it submits weekly reports on company funds to Abu Dhabi's Financial Services Regulatory Authority, under a requirement that predated the hack.
It didn't say when it acquired those assets.
The breach and the trail of funds
Binance first pointed to a possibly compromised laptop. Its investigation has since uncovered "additional points of breach," the exchange said, and it's still gathering facts with law enforcement (Binance disclosed that cooperation in an X post without naming the agencies). Outflows stopped when withdrawals were paused, and Binance said it remained on track to resume withdrawals in 45 hours. Deposits weren't affected.
Chainalysis said the attackers may have been using automation, with funds repeatedly circulating among addresses and sometimes returning to wallets used earlier in the sequence.
“Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”
Blockaid CEO Ido Ben-Natan said attackers could have stolen the funds without Ethereum's EIP-7702 upgrade, though it may have helped them bypass security checks. He said compromised signing systems likely enabled the attack. Ambire CEO Ivo Georgiev also said the funds could've been taken through other methods, and warned that engineers could overlook revoking malicious EIP-7702 delegations.
The defi ripple
Aave resumed new deposits and borrowing across all Aave V3 and V4 markets after a precautionary freeze that followed the hack. Withdrawals and repayments stayed available throughout, and Aave said its contracts weren't affected. Founder Stani Kulechov confirmed lending and borrowing were re-enabled, saying all positions remained overcollateralized.
Frequently asked questions
How is Binance covering the losses from the $6.3 billion hack?
Binance said it set aside more than $6.34 billion in company funds, $5 billion of which was already held in the affected tokens. It said it's buying the remaining assets through market and over-the-counter transactions, and that some purchases could take longer because of low liquidity and OTC settlement times.
When will Binance resume withdrawals after the hack?
Binance said it remained on track to resume withdrawals in 45 hours and that deposits weren't affected. The exchange said outflows stopped when it paused withdrawals.
