Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'

Binance will cover every dollar lost in this week's hack with its own money, CEO Richard Teng said in a video address on Friday, adding that customer funds were never touched.

"We are committed to covering all hacked losses through our company funds. Your assets are safe," Teng said, according to a transcript he tweeted.

Binance has reserved more than $6.34 billion of company funds to cover the stolen assets, $5 billion of which is already held in the exact tokens taken, including USDC, USDT, BTC, ETH and BNB, he said. The exchange is buying the rest through market and over-the-counter channels.

Teng said the hack hit Binance's own hot wallet, not customer funds. "We never use any customer funds, so they are not impacted," he said, adding that most user assets are held in cold wallets and only moved into a hot wallet when a user withdraws. Binance's ability to absorb a loss of this size comes from keeping much of its operating earnings in crypto, he said.

Binance had earlier said it would cover all losses from its SAFU emergency fund and company funds.

How the attack worked

Teng said the hack "was not carried out by one person." Binance initially traced it to a compromised laptop but has since found additional points of breach. The attacker also used a self-destruct mechanism that destroyed tooling and traces along the way, making the attack harder to investigate, Teng said.

The attacker used EIP-7702, an Ethereum feature that lets standard wallets run smart contract code, to obtain onchain execution approval over a hot wallet, according to Teng. "That delegation did not pass through our normal approval controls," he said, which is why Binance paused withdrawals to rebuild and retest its infrastructure. Blockchain analytics firms TRM Labs and Chainalysis have attributed the theft to North Korean hacking group TraderTraitor.

Binance hopes to restore withdrawals before its Sunday deadline, Teng said, and is carrying out a full security review covering endpoints, cloud, key management and signing. It plans to publish a full proof of reserves report by Monday, with an initial view before then.

The attacker is still moving funds. Between 11:37 a.m. and 12:12 p.m. ET on Friday, a Tron wallet that Arkham attributes to the hacker sent about 5.19 million TRX, worth roughly $1.73 million, to 12 addresses, according to Arkham data.

Decentralized lending protocol Aave, where the attacker borrowed ETH against USDT while racing stablecoin freezes, according to TRM Labs, said on Friday that it had unfrozen all markets on its V3 and V4 deployments. It had frozen them as a precaution after the first reports of the hack, pausing new deposits and borrowing while withdrawals and repayments continued. "Aave was unaffected, and all positions remain overcollateralized," founder Stani Kulechov wrote.

Binance co-founder Changpeng "CZ" Zhao said that while the $6.3 billion theft is the largest in dollar terms, it is not the largest in Bitcoin terms, pointing to Mt. Gox's loss of 650,000 BTC, more than 5% of the supply. Unlike at Mt. Gox and FTX, where nearly all users were affected, Binance is covering the losses itself, he said. "It hurts, but we survive," Zhao wrote.