Binance Taps Reserves to Cover $6.3 Billion Hack, Largest in Crypto

Summary

• Hackers stole $6.3 billion from Binance wallets, the largest crypto theft recorded, the exchange said.
• Tether, Circle and other firms froze roughly $3 billion, leaving about $3.3 billion with the attackers.
• Binance says company funds will cover the gap, testing whether a $1.23 billion emergency reserve suffices.

The latest

Binance is covering a $6.3 billion theft that overwhelmed the emergency fund it built for exactly this scenario. The exchange said hackers drained its digital wallets after breaking into an engineer's laptop, among other breaches, and that stablecoin issuers Tether and Circle helped freeze about $3 billion. Co-Chief Executive Richard Teng said on X that Binance would cover all losses from the SAFU fund and company funds.

Details

• The breach: Binance said attackers plundered $6.3 billion from its hot wallets, the company-controlled digital wallets that record which tokens belong to each customer. Entry came partly through a Binance engineer's laptop. Cybersecurity researchers attributed the operation to North Korea's TraderTraitor hacking group and said it dwarfed any previous incident of its kind.
• The reserve: The exchange maintains an emergency pool called the Secure Asset Fund for Users, or SAFU, created for cyber incidents. Blockchain data showed it held $1.23 billion in bitcoin as of Thursday. The hack knocked bitcoin's price lower across the market, leaving the reserve already $100 million smaller than that figure.
• The funding plan: A Binance spokesman said the exchange has reserved more than $6.3 billion of company funds, including the SAFU amount, to cover affected user assets. Of that, $5 billion sits in the same cryptocurrencies the hackers took. Binance is buying the remaining $1.3 billion through market channels, a step the spokesman said could take longer.
• The frozen funds: Binance said it is fronting the money itself and will repay itself with the $3 billion in frozen assets once released. No timetable was given for that release. Once the hot wallets are replenished from company reserves, Binance said, customer holdings on the platform will be unchanged.
• Withdrawals halted: The exchange blocked withdrawals while its team ran security checks, and said Friday that services should resume within two days. Binance, with a de facto base in the United Arab Emirates, says it does not accept U.S. customers. Sister exchange Binance.US said it was unaffected.
• The scale: The loss is modest against Binance's balance sheet. Nansen, a blockchain analytics firm, puts total crypto assets across its wallets at $167 billion, covering user funds, company assets and the SAFU reserve. Binance also holds assets that do not appear in blockchain data, and processed $34 trillion in trades last year, charging fees on them.
• The ratings view: Cristiano Ventricelli, a vice president at Moody's Ratings, said the hack illustrates the risk concentration built into large centralized intermediaries. He added that stronger institutional controls can reduce some vulnerabilities, but the scale of assets under custody amplifies the impact of any successful breach.
• The Musk clash: Musk posted a grimacing-face emoji in reply to an X user's screenshot of a tweet by jailed FTX founder Sam Bankman-Fried. Binance founder Changpeng Zhao answered that Binance holds a SpaceX stake valued above $1 billion, and told Musk: "Elon, have a lot of respect for you, but bad time to troll."
• Inside the company: Zhao, Binance's majority owner and biggest shareholder, posted Friday that the remaining gap was still painful but manageable. Co-CEO Yi He said annual revenue was enough to cover the losses and that selling the SpaceX shares was not yet necessary. Zhao replied he was not considering a sale.

Background

Binance invested $500 million in Twitter in 2022 as part of Musk's takeover; the platform, renamed X, was acquired by SpaceX earlier this year. That deal is the origin of the SpaceX stake Zhao cited.

Between the lines

Binance's own numbers frame the gap as survivable: $167 billion in wallet assets and $34 trillion in annual trading volume against a $3.3 billion unrecovered loss. The pressure point is timing, not solvency. The SAFU fund covered under a fifth of the theft, the $3 billion in frozen funds has no announced release date, and the final $1.3 billion must be bought on the open market in the same tokens whose prices the hack moved.

What's next

Watch whether withdrawals reopen on the two-day timeline Binance gave, when Tether and Circle release the roughly $3 billion in frozen assets, and how quickly Binance completes its $1.3 billion market purchase.

Source: The Wall Street Journal