Binance will cover all losses from a recent hack using its own company funds, CEO Richard Teng said Friday. The exchange has reserved more than $6.34 billion to compensate for stolen assets, with $5 billion already held in the exact tokens taken, including USDC, USDT, BTC, ETH, and BNB.
Teng emphasized that customer funds were never accessed in the breach. "We never use any customer funds, so they are not impacted," he said, noting that most user assets are held in cold wallets and only moved to hot wallets when users initiate withdrawals. The hack targeted Binance's own hot wallet infrastructure.
How the Attack Occurred
The attacker exploited multiple security vulnerabilities in a coordinated operation. Teng indicated the breach involved a compromised laptop and additional points of entry. The attacker used EIP-7702, an Ethereum feature allowing standard wallets to execute smart contract code, to gain approval over the hot wallet without passing through Binance's normal approval controls.
The attacker also deployed a self-destruct mechanism that destroyed tooling and traces, complicating the investigation. Blockchain analytics firms TRM Labs and Chainalysis attributed the theft to North Korean hacking group TraderTraitor.
Recovery Timeline and Security Review
Binance paused withdrawals to rebuild and retest its infrastructure and aims to restore them before Sunday. The exchange is conducting a full security review covering endpoints, cloud, key management, and signing processes. A complete proof of reserves report is expected by Monday.
The attacker continued moving funds after the initial breach, transferring approximately 5.19 million TRX worth roughly $1.73 million across multiple addresses on the Tron network Friday.
Industry Impact
Decentralized lending protocol Aave, where the attacker borrowed ETH against USDT during the incident, temporarily froze all markets on its V3 and V4 deployments as a precaution. The platform unfroze markets after confirming it was unaffected and that all positions remained overcollateralized.
Binance co-founder Changpeng Zhao noted that while the $6.3 billion theft represents the largest hack in dollar terms, it is smaller than Mt. Gox's loss of 650,000 BTC. Unlike those incidents, Binance is absorbing the losses itself rather than affecting users.
