Binance Reserves $6.34bn of Company Funds to Cover Hack Losses, Says Customer Assets Untouched

Binance will absorb the full cost of this week's hack using its own money, chief executive Richard Teng said in a video address on Friday, stressing that customer balances were not affected.

The exchange has set aside more than $6.34bn of company funds to make good the stolen assets, according to Teng, in what Binance co-founder Changpeng Zhao described as the largest crypto theft ever measured in dollars.

How Binance plans to cover the loss

Teng said roughly $5bn of the reserved sum is already held in the same tokens that were taken, a basket that includes USDC, USDT, bitcoin, ether and BNB. The remainder is being acquired through open-market purchases and over-the-counter desks, he said.

Matching the replacement assets to the stolen ones token for token matters. It means the exchange is not exposed to price swings between the assets it holds and the liabilities it needs to restore, and it avoids the need to rebalance large positions after the fact.

According to Teng, the company can absorb a loss of this scale because it keeps a large share of its operating earnings in crypto rather than converting them to cash. Binance had said earlier in the week that losses would be met from a combination of its SAFU emergency fund, which was set up to protect users in extreme events, and its corporate balance sheet.

In a transcript of the address that Teng posted on X, he framed the commitment directly to users, telling them their assets were safe and that all hacked losses would be covered from company funds.

A hot wallet, not customer funds

Teng said the attacker compromised one of Binance's own hot wallets, which are internet-connected wallets used to process day-to-day activity. He said Binance never draws on customer funds for its own operations, and that most user assets sit in cold wallets, which are kept offline and are only moved into a hot wallet when a customer requests a withdrawal.

That distinction is central to Binance's argument that users are insulated. Exchanges typically keep only a fraction of holdings in hot wallets precisely to limit the damage from a breach of this kind, while the bulk of assets remains in offline storage.

Still, the sheer size of the figure set aside suggests the hot wallet in question was holding a very large balance, which is likely to draw scrutiny of how much exchanges keep online at any one time.

How the attack unfolded

Teng said the breach was not the work of a single individual. Binance's investigators first traced it to a compromised laptop, but have since identified further points of entry. He added that the attacker used a self-destruct mechanism that wiped tooling and traces during the operation, complicating the investigation.

The technical route into the wallet relied on EIP-7702, an Ethereum feature that allows ordinary wallets to run smart contract code. According to Teng, the attacker used it to obtain onchain execution approval over a Binance hot wallet, and that delegation bypassed the exchange's usual approval controls.

That gap is the reason Binance halted withdrawals, Teng said, so that it could rebuild and retest its infrastructure. The episode is likely to prompt wider discussion about how newer protocol features interact with the internal signing and approval processes that custodians rely on.

TRM Labs and Chainalysis, both of which track activity on blockchains, have linked the attack to TraderTraitor, a hacking group from North Korea. State-linked groups from the country have been blamed for a string of large crypto thefts in recent years, and the attribution places this incident within that broader pattern.

Funds still on the move

The attacker has continued to shift assets. On Friday, between 11:37am and 12:12pm ET, a Tron wallet that blockchain intelligence platform Arkham links to the hacker sent about 5.19m TRX, worth roughly $1.73m, to 12 separate addresses, according to Arkham data.

Splitting funds across many addresses is a common laundering technique, designed to make tracing harder and to reduce the chance that any single freeze or seizure captures a large share of the proceeds.

The hack also spilled briefly into decentralised finance. According to TRM Labs, the attacker borrowed ether on the lending protocol Aave, posting USDT as collateral, in an apparent attempt to move value out of stablecoins before issuers could freeze them.

Aave froze its markets as a precaution after the first reports, pausing new deposits and borrowing while allowing withdrawals and repayments to continue. On Friday it said all markets on its V3 and V4 deployments had been unfrozen. Founder Stani Kulechov said the protocol was unaffected and that all positions remained overcollateralised.

Why it matters

Zhao sought to put the theft in historical context. He said that while it is the largest in dollar terms, it is not the largest when measured in bitcoin, pointing to Mt. Gox, which lost 650,000 BTC, more than 5% of the supply at the time.

He also drew a contrast with the collapses of Mt. Gox and FTX, where nearly all users suffered losses. In Binance's case, he said, the company is covering the shortfall itself. "It hurts, but we survive," Zhao wrote.

That comparison goes to the heart of how the market is likely to judge the episode. A breach of this size would have been fatal for most exchanges. If Binance can replace the assets in full, restore withdrawals promptly and demonstrate that customer balances are intact, the incident may be remembered more for the response than the loss itself.

There are, however, open questions. Binance's capacity to absorb the hit depends on its crypto-heavy treasury, which also means its financial cushion moves with market prices. Buying the outstanding tokens on the open market and through over-the-counter channels could take time. And the fact that a delegation slipped past normal approval controls raises questions about internal safeguards that the security review will need to answer.

What to watch next

Teng said Binance hopes to restore withdrawals before its Sunday deadline. The exchange is also carrying out a full security review and plans to publish a complete proof of reserves report by Monday, with an initial view released before then.

Key milestones in the coming days include:

• Whether withdrawals reopen before Sunday as targeted
• The initial and full proof of reserves disclosures, the latter due by Monday
• Findings from the review of endpoints, cloud systems, key management and signing
• Further movements of stolen funds and any freezes by stablecoin issuers

The proof of reserves report is likely to be the most closely read. It will be the clearest public test of Teng's assurance that customer assets were never touched, and of whether the exchange's balance sheet can carry a loss of this magnitude without strain.