Binance disclosed a comprehensive recovery strategy following a $6.3 billion hack of its hot wallet on October 29. Co-CEOs Yi He and Richard Teng announced the plan in the exchange's second Security Incident Update, committing the company to absorb all financial losses rather than passing costs to users.
The phased withdrawal restart was targeted to begin approximately 34 hours after the announcement, contingent on completed security checks, remediation efforts, and validation of affected systems. Deposits and other unaffected services remained operational during the recovery process.
Funding the Recovery
Binance pledged coverage through its Secure Asset Fund for Users (SAFU) and corporate treasury. More than $6.34 billion in company funds were allocated to address the loss, with $5 billion already held in the affected token assets including USDC, USDT, BTC, ETH, and BNB. This represented approximately 80 percent of losses. The exchange was purchasing additional matching tokens through market and over-the-counter channels to cover the remainder.
Asset Recovery Efforts
Approximately $3 billion in stolen assets had been frozen onchain, according to Binance. Blockchain analytics firm Elliptic independently verified freezes of $2.84 billion as of October 30, primarily in USDT and USDC. Recovery efforts continued through coordination with law enforcement, token issuers, intelligence firms, and other exchanges.
Binance planned an initial proof-of-reserves snapshot within 12 hours of its announcement, with results expected by November 2, displaying platform holdings against customer balances.
Investigation Findings
Initial findings indicated that a compromised DevOps engineer's laptop enabled unauthorized withdrawal submissions. The breach involved bypassed approval controls and a self-destruct mechanism that destroyed tools and traces. Binance stated it found no evidence of leaked wallet private keys and had contained compromised infrastructure while revoking affected authorizations.
Blockchain security firm Hypernative identified compromised signing access and valid signatures from Binance-controlled keys. Analysis indicated the use of EIP-7702, an Ethereum feature allowing a regular wallet to execute smart-contract code, to run attacker-controlled code through a Binance wallet. Internal and external specialists were reconstructing the full attack sequence, with further verified technical findings expected within approximately 48 hours of the announcement.
