Binance said on October 31 that it had replaced 90% of the assets stolen in a $6.3 billion crypto hack, using company funds to buy replacement tokens. The FBI attributed the Binance crypto hack to North Korea’s state-sponsored TraderTraitor unit, while the exchange kept withdrawals suspended and pledged that customers would bear no financial losses.
Key takeaways
- The FBI identified TraderTraitor as responsible for the theft.
- Binance earmarked around $6.34 billion internally to cover losses.
- Less-liquid tokens account for the unreplaced 10%.
- A reserve snapshot covers 10 tokens at minimum 1:1 backing.
How the Binance crypto hack bypassed approval controls
Co-CEO Richard Teng said the attackers abused the multi-signature protocol EIP-7702 to obtain on-chain execution approval over a Binance hot wallet. The transfers bypassed the exchange’s normal approval controls, he said.
In an October 30 video posted on X, Teng said the investigation initially pointed to a compromised laptop but subsequently uncovered additional breach points. He said more than one person had carried out the attack.
The attackers also used malicious software designed to erase evidence. Teng described a self-destruct mechanism that destroyed tools and traces during the operation, making the breach harder to investigate.
Company reserves fund replacement as withdrawals stay paused
Binance said it used its own money to repurchase stolen tokens and had set aside around $6.34 billion internally to cover the losses. Funding came from part of its $1 billion Secure Asset Fund for Users, or SAFU, its Futures Insurance Fund and its corporate treasury.
SAFU is a bitcoin reserve maintained to protect customers against security breaches. The exchange said the remaining 10% of stolen assets consisted of less-liquid tokens that would take longer to buy.
“Our users will not bear the financial impact of this incident,” Teng said on X, alongside a commitment to replace the remaining assets.
Withdrawals stopped after the Binance crypto hack while the exchange investigated and rebuilt the withdrawal service. Teng said services would resume only after rigorous testing. On October 31, Binance said it remained on track to reopen withdrawals on November 1.
FBI tracks conversions into Ethereum
The FBI said law enforcement had observed TraderTraitor members converting stolen assets into Ethereum. The agency said it expected “further laundering” through related technology.
Before the FBI’s attribution, blockchain intelligence firms TRM Labs and Chainalysis had expressed high confidence that North Korean actors were responsible. Chainalysis said stolen Binance funds had commingled with proceeds from another exchange hack the previous month that was also widely attributed to North Korean actors.
The US Secret Service said on October 30 that it was working with private-sector partners to identify, freeze, trace and recover the funds. According to the statement, the agency was working alongside the United States Attorney’s Office for the District of Columbia and additional law enforcement partners.
Reserve snapshot covers 10 tokens
Binance took a fresh proof-of-reserves snapshot at 00:00 GMT on October 31. It said holders of the covered tokens would be able to verify minimum 1:1 backing once the full proof became available.
Included in this snapshot are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Teng said Binance would publish the full proof-of-reserves report by Monday, November 2.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.