Binance Holds $5B in Matching Tokens to Cover Hack Losses

Update (Oct 30, 12:57 UTC): Binance announced it has set aside more than $6.34 billion to cover losses from its recent hack, with $5 billion already held in the exact tokens required. The holdings will appear in the exchange's next proof-of-reserves report.

Update (Oct 30, 12:57 UTC): According to Fast Company, the historic attack has caused Bitcoin and other tokens to fall as the broader crypto market faces a major shock.

TRM Labs and Chainalysis have both identified the North Korean hacking group TraderTraitor as the actor behind the largest crypto theft on record – an estimated $6.4 billion siphoned from Binance wallets across ten blockchains on Thursday afternoon. The firms say the attribution is made with “high confidence” based on on‑ and off‑chain intelligence, linking the attack to the same group blamed by the FBI for the $1.5 billion Bybit hack earlier this year.

Attribution and Attack Vector

The analysts note that the attacker’s operational wallet was funded through Tornado Cash, mirroring previous North Korea‑linked operations. On Ethereum, the hacker exploited an EIP‑7702 delegation introduced in the Pectra upgrade to turn a Binance hot wallet into a sweeper, using 50 pre‑signed authorizations prepared in advance. On nine other chains, funds were moved via ordinary signed transfers, suggesting a compromise of Binance’s hot‑wallet signing infrastructure.

Funds Movement and Laundering

After the theft, the illicit proceeds were rapidly laundered. Chainalysis observed “never‑seen‑before” laundering patterns, with thousands of automated transactions circulating funds among addresses. The attacker sold USDT to market makers, borrowed ETH against USDT on Aave, and now holds over 420,000 ETH and 18,270 BTC – roughly $2.4 billion beyond any issuer’s reach. Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion, while Arbitrum’s Security Council froze additional assets.

Binance Response

Binance says it has set aside more than $6.34 billion of its own funds to cover user losses, $5 billion of which is already held in the exact tokens that were stolen. The exchange is purchasing the remainder via market and OTC channels and continues to work with law enforcement and blockchain intelligence firms to trace, freeze and recover assets.

Key facts

• TRM Labs and Chainalysis attribute the hack to TraderTraitor with high confidence.
• Estimated loss: $6.4 billion across ten blockchains.
• Funds were commingled with proceeds from the Bitget exploit.
• Binance reserves $6.34 billion to cover user losses.
• Over $2.4 billion in ETH and BTC remain beyond issuers’ control.