Binance has confirmed that it has reserved more than $6.34 billion in company funds to address losses stemming from a major security breach. The exchange stated that the estimated total impact of the hack is approximately $6.3 billion. Of this amount, around $5 billion was already held in the specific tokens affected by the attack, while the remaining assets are being acquired through market and over-the-counter transactions to cover shortfalls. Binance co-CEO Yi He noted that some purchases may take longer due to liquidity constraints and settlement times.
As of the latest updates, approximately $3 billion of the stolen funds have been successfully frozen. The frozen assets include a wide range of cryptocurrencies and stablecoins such as Tether (USDT), USDC, Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP), and Arbitrum (ARB). The Arbitrum Security Council specifically executed a transaction to freeze $30.5 million involving 74.6 million ARB tokens and 8,425 ETH. Binance indicated that the total amount of frozen assets could increase as investigators continue to trace additional funds in coordination with law enforcement and industry partners.
Cybersecurity analysts have pointed toward North Korea's TraderTraitor hacking group as the likely perpetrator. Chainalysis co-founder Jonathan Levin attributed the attack to this group, citing links to previous exploits, while onchain investigator ZachXBT noted that stolen funds from this incident were commingled with those from an earlier Bitget exploit. TRM Labs also attributed the attack to TraderTraitor with high confidence. The FBI has previously identified TraderTraitor as the group responsible for the ByBit hack in February of the previous year.
Regarding the technical execution of the breach, Binance initially pointed to a compromised DevOps engineer's laptop as the entry point. However, co-CEO Richard Teng clarified that the incident was not a simple "one-click" action but involved a more complex attack process. Investigators have since uncovered additional points of breach beyond the initial laptop compromise. Blockaid CEO Ido Ben-Natan suggested that attackers may have manipulated transaction-signing systems rather than stealing private keys, potentially utilizing Ethereum's EIP-7702 upgrade to bypass security checks in a single sweep.
In response to the incident, Binance temporarily suspended withdrawals and deposits while conducting a security revamp. The exchange expects withdrawals to resume within 48 hours, with deposits already operating normally. To replenish its reserves, Binance is purchasing altcoins in quantities matching those stolen through over-the-counter deals and exchanges. The company affirmed that it would cover all losses using its SAFU fund and company holdings.
The hack has triggered significant market reactions, with Bitcoin trading below $77,000 and BNB falling by 8%. Decentralized lending protocol Aave froze markets across its V3 and V4 deployments after the exploiter deposited 60 million USDT and borrowed approximately $44.6 million in Wrapped Ether. Market makers Wintermute and GSR disclosed their exposure to Binance, stating that it represented less than 20% of their net equity and did not expect major operational disruptions. Standard Chartered analysts suggested the breach could accelerate a shift toward decentralized exchanges, potentially benefiting platforms like Uniswap.
Sources: Cointelegraph.