Binance Commits $6.34 Billion of Own Funds to Cover Hack Losses

Binance has reserved more than $6.34 billion of its own funds to cover every dollar stolen in this week's hack, CEO Richard Teng said in a video address on Friday, promising that customer assets were never touched. "We are committed to covering all hacked losses through our company funds. Your assets are safe," Teng said, according to a transcript he posted on X.

Of the $6.34 billion set aside, $5 billion is already held in the exact tokens taken — USDC, USDT, BTC, ETH and BNB — Teng said. The exchange is buying the remainder through market and over-the-counter channels. Binance had earlier said it would absorb losses through its SAFU emergency fund and company money.

Whose money was actually stolen?

The breach hit Binance's own hot wallet, not customer balances, according to Teng. "We never use any customer funds, so they are not impacted," he said. Most user assets sit in cold wallets, he explained, and only move into a hot wallet when a user initiates a withdrawal. The exchange's capacity to absorb a loss of this size comes from keeping much of its operating earnings in crypto rather than fiat.

How did the attackers get in?

The hack "was not carried out by one person," Teng said. Binance initially traced the intrusion to a single compromised laptop but has since identified additional points of breach. The attacker deployed a self-destruct mechanism that destroyed tooling and traces during the operation, making the incident harder to investigate, Teng said.

The technical vector matters. The attacker used EIP-7702, an Ethereum improvement that lets standard wallets execute smart contract code, to obtain on-chain execution approval over a hot wallet. "That delegation did not pass through our normal approval controls," Teng said — the reason Binance halted withdrawals entirely while it rebuilds and retests its infrastructure.

Blockchain analytics firms TRM Labs and Chainalysis have attributed the theft to TraderTraitor, a North Korean hacking group.

What is the recovery timeline?

Binance aims to restore withdrawals before its Sunday deadline, Teng said. The exchange is running a full security review spanning endpoints, cloud infrastructure, key management and signing processes. It plans to publish a full proof of reserves report by Monday, with an initial view released before then.

The attacker remains active on-chain. Between 11:37 a.m. and 12:12 p.m. ET on Friday, a Tron wallet attributed to the hacker by Arkham sent roughly 5.19 million TRX — about $1.73 million — to 12 addresses, according to Arkham data. The movement shows the funds are still being dispersed across chains even as restitution plans proceed.

What happened to Aave's frozen markets?

The hack's fallout reached decentralized lending. The attacker borrowed ETH against USDT on Aave while racing stablecoin freezes, according to TRM Labs. Aave responded by freezing markets on its V3 and V4 deployments as a precaution, pausing new deposits and borrows while withdrawals and repayments continued.

On Friday, Aave confirmed it had unfrozen all markets. "Aave was unaffected, and all positions remain overcollateralized," founder Stani Kulechov wrote on X. The protocol's contracts themselves were never compromised.

How does this compare to past collapses?

Binance co-founder Changpeng "CZ" Zhao put the loss in historical context. While the $6.3 billion theft is the largest in dollar terms, it is not the largest in Bitcoin terms, he wrote, pointing to Mt. Gox's loss of 650,000 BTC — more than 5% of Bitcoin's supply at the time. Unlike Mt. Gox and FTX, where nearly all users were affected and losses were socialized, Binance is covering the damage itself. "It hurts, but we survive," Zhao wrote.

The distinction is operational, not just rhetorical. Mt. Gox creditors waited years for partial restitution because the exchange could not make itself whole. Binance's balance sheet, by Teng's account, can.

What happens next?

All eyes are on the Sunday withdrawal deadline and Monday's proof of reserves report. If Binance hits both, the incident becomes the largest self-covered exchange loss in crypto history. If it misses them, the market's focus shifts from the hack itself to whether the exchange's remediation timeline is slipping — and the attacker's continued fund movements on Tron suggest the investigation is far from closed.