Binance has earmarked more than $6.34 billion of its own money to absorb the fallout from a breach that drained roughly $6.3 billion in customer assets, the exchange said Friday. The reserve exceeds the estimated haul, a deliberate buffer that signals the company intends to make users whole without tapping the industry insurance fund known as SAFU.
The reserve breakdown
About $5 billion of the allocation already sat in the same tokens that were stolen, Binance said. The remainder is being acquired through market orders and over-the-counter deals, a process the exchange warned could stretch out because several of the affected assets trade thinly. The $6.34 billion figure explicitly excludes the roughly $3 billion that investigators have already frozen with the help of stablecoin issuers and law enforcement.
Withdrawals and the proof-of-reserves update
Deposits never paused. Withdrawals are on track to reopen within 48 hours, according to the latest timeline. Co-CEO Yi He said the exchange is buying altcoins in quantities that mirror the stolen balances so that the next proof-of-reserves attestation will show a clean one-to-one backing. She added that SAFU and corporate treasuries hold substantial Bitcoin and Ether positions, though she did not disclose exact amounts.
How the attackers moved
Blockchain analytics firm Chainalysis described the post-exploit flow as unprecedented. Thousands of transactions in a compressed window suggest the operators are running automated scripts to peel and redistribute funds, sometimes looping coins back through addresses used earlier in the chain. The pattern points to a laundering infrastructure built for speed rather than stealth.
The EIP-7702 factor
Security researchers are debating whether Ethereum’s EIP-7702 upgrade facilitated the heist. Blockaid chief executive Ido Ben-Natan said the vulnerability likely originated in compromised signing systems, but that EIP-7702 let the attackers bundle what would otherwise require multiple transactions into a single sweep. Ambire chief executive Ivo Georgiev agreed the funds could have been taken other ways, and warned that engineers restoring control of hacked systems may forget to revoke malicious delegations created under the new standard.
Attribution and open questions
Cybersecurity analysts have pointed to North Korea’s TraderTraitor group, though Binance has not confirmed a culprit. The exchange said its investigation has uncovered additional breach points beyond the initially suspected laptop compromise, and that fact-gathering continues alongside law enforcement.