Binance sets aside $6.34B to cover hack losses as about $3B stays frozen
In brief
- Binance set aside more than $6.34 billion in company funds to cover hack losses.
- $5 billion of that was already held in the affected tokens, Binance said.
- About $3 billion remains frozen as recovery work continues with law enforcement.
- Chainalysis CEO Jonathan Levin said North Korea's TraderTraitor likely carried out the attack.
How Binance is filling the gap
The allocation excludes frozen or protected assets, Binance said, and it's working with law enforcement and industry partners to recover the roughly $3 billion that's frozen.
Co-CEO Yi He said Binance is buying altcoins in quantities matching those stolen (through OTC deals and on exchanges) as it prepares updated proof of reserves. She said the SAFU fund and company holdings include substantial amounts of Bitcoin and Ether. Some purchases could take longer because of low liquidity and OTC settlement times, the exchange said.
Binance said it remained on track to resume withdrawals in 45 hours. Deposits weren't affected, and outflows stopped once withdrawals were paused, it said.
This is a live, developing story.
What Binance says happened
Co-CEO Richard Teng said in an X post that the attacker didn't simply use one engineer's permissions. He described "a more complex attack process," not a single "one-click" action. Preliminary findings still point to a compromised DevOps engineer's laptop, which may have let the attacker reach an internal service and submit unauthorized withdrawals, Teng said. Investigators found no evidence of a wallet private-key leak, he added, and Binance will cover all losses from SAFU and company funds.
The exchange separately said it had uncovered "additional points of breach" and was still gathering facts with law enforcement.
Attribution and laundering
Chainalysis CEO Jonathan Levin said the hack was likely carried out by North Korean group TraderTraitor, citing links to a previous hack. He put the theft at $6.4 billion (slightly above Binance's estimate) and said industry partners had frozen approximately $3 billion.
“Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”
Chainalysis said funds repeatedly circulated among addresses, sometimes returning to wallets used earlier in the sequence.
Blockaid CEO Ido Ben-Natan told Cointelegraph the attackers could have stolen the funds without Ethereum's EIP-7702 upgrade, though it may have helped them bypass security checks. He said compromised signing systems likely enabled the attack. Ambire CEO Ivo Georgiev also said other methods would've worked, and he warned that engineers could overlook revoking malicious EIP-7702 delegations after regaining control of their systems.
Frequently asked questions
How is Binance covering the losses from the hack?
Binance said it set aside more than $6.34 billion in company funds, with $5 billion already held in the affected tokens. It's buying the remaining assets through market and over-the-counter transactions, and co-CEO Richard Teng said all losses would be covered by the SAFU fund and company funds.
Who is believed to be behind the Binance hack?
Chainalysis CEO Jonathan Levin said the hack was likely carried out by the North Korean group TraderTraitor, citing links to a previous hack. Binance hasn't named a culprit and says it's still gathering facts with law enforcement.
