Binance reserves $6.34bn to cover stolen assets after cyberattack – CEO

Binance, the world’s largest cryptocurrency exchange, said it has reserved more than $6.34 billion in company funds to cover assets stolen in a recent cyberattack, assuring customers that their funds were not affected.

Richard Teng, Binance’s co-chief executive officer, disclosed this in a video address following the security breach on Friday, saying the company was committed to covering all losses from its own funds.

Earlier on Friday, the company estimated the financial impact of a security incident in an X post, which involved unauthorised withdrawal transactions of about $6.3 billion.

It said the cryptocurrency platform will cover all losses through its Secure Asset Fund for Users (SAFU) and company funds.

According to Mr Teng, in a video on Friday evening, $5 billion of the reserved amount is already held in the same cryptocurrency tokens affected by the incident, including USDC, USDT, Bitcoin, Ethereum and BNB.

“We are committed to covering all hacked losses through our company funds. Your assets are safe,” he said.

The Binance Co-CEO added that Binance was recovering some of the stolen assets and was working to acquire the outstanding amount through cryptocurrency markets and over-the-counter (OTC) channels.

Mr Teng said the incident affected the exchange’s own hot wallet and not customers’ funds, explaining that Binance holds most users’ assets in cold wallets and transfers them to hot wallets when withdrawals are requested.

“We NEVER use any customer funds, so they are not impacted. What was affected in this incident was Binance’s own hot wallet,” he said.

He said the company would publish an initial proof-of-reserves report, which was expected by Monday, to enable public verification of its assets.

Additional points of breach

Earlier, the company’s preliminary investigations suggested that the incident may have involved a compromised laptop belonging to a DevOps engineer, which allegedly enabled an attacker to access a service container and submit unauthorised withdrawal transactions.

However, while providing an update on the investigation, Mr Teng said Binance’s initial assessment had been expanded by subsequent findings, which revealed additional points of breach.

He described the incident as a complex attack, saying the attacker deployed a self-destruct mechanism that erased tools and traces, making it more difficult for the company to investigate.

According to him, the attacker exploited the EIP-7702 multi-signature protocol to obtain on-chain execution approval over a hot wallet. The delegation bypassed Binance’s normal approval controls.

“This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop; however, our subsequent investigation has uncovered additional points of breach,” he said.

The exchange has suspended its withdrawal service while it rebuilds and tests the infrastructure. Mr Teng said Binance hoped to restore withdrawals before its Sunday deadline, which he put at within 40 hours of his address.

He said the company was also conducting a security review covering its endpoints, cloud infrastructure, key management and transaction-signing systems.

“Third, we are completing the purchase of the remaining assets and will verify in our Proof of Reserves. We will be sharing a full Proof of Reserves report by Monday, and we are hoping to give an initial view of Proof of Reserves before that,” the Binance Co-CEO added.

Mr Teng said Binance was working with law enforcement agencies, blockchain intelligence firms, token issuers and other cryptocurrency exchanges to trace and recover the stolen funds.

He also hailed industry partners who had helped freeze the affected assets and supported the company’s response.

The company, he said, would continue working with authorities to ensure those responsible were held accountable.