Binance Backs 90% of Lost Funds From Its Own Reserves
Binance confirmed in its third recovery bulletin, issued on Saturday, that it has replaced 90% of the approximately $6.3 billion taken from its hot wallets during the Thursday breach. The exchange emphasized that the financial burden would fall on the company rather than its customers, stating plainly that it would "absorb the financial impact of these stolen funds, not our users."
According to the update, balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are now fully backed at 100%. The remaining 10% of the loss sits in lower-liquidity tokens that Binance says will require more time to replenish through open-market purchases and over-the-counter desks.
The funding is being drawn from three internal sources: a partial withdrawal from the Secure Asset Fund for Users (SAFU), a portion of the futures insurance fund, and the exchange's corporate treasury. On Friday, Binance disclosed that it had earmarked more than $6.34 billion in company assets, of which $5 billion was held in the very same tokens targeted by the theft. The exchange added that it intends to restore SAFU to roughly $1 billion and that its futures insurance fund still exceeds the minimum level mandated by its risk-management rules.
Importantly, none of the replaced capital has been recovered from the attacker. TRM Labs reported that approximately $2.7 billion had been frozen by the close of Thursday, with Tether, Circle, Ripple, World Liberty Financial, and Arbitrum's Security Council all contributing to the freeze. However, the thief still held more than 420,000 ETH and 18,270 BTC—valued at roughly $2.4 billion—that remained outside any issuer's ability to seize. Chainalysis placed the total frozen amount at around $2.8 billion, while Binance's own figure sits near $3 billion.
Attribution and the Evolving Breach Narrative
Both TRM Labs and Chainalysis have attributed the theft to TraderTraitor, the North Korean hacking collective that the FBI previously blamed for the $1.5 billion Bybit hack in February 2025. By TRM's accounting, the Binance heist totals approximately $6.36 billion, making it roughly four times the size of the Bybit incident. Binance itself has stopped short of naming a specific suspect.
The exchange's explanation of how the intrusion occurred has also evolved. Its initial update suggested the breach may have involved a compromised DevOps engineer's laptop that granted an attacker access to a service container. By Friday, Binance acknowledged that its investigation had "uncovered additional points of breach," while reassuring users that it found no evidence the wallet private keys themselves had been leaked.
A separate social-media thread drew attention to a user who had allegedly tweeted the exact date and time of the Binance hack two months before it materialized, prompting speculation about whether the individual possessed advance knowledge. Binance CEO Changpeng Zhao appeared to be publicly seeking the person's contact information, though the claim remains unverified.
On-Chain Mechanics and the Attacker's Cash-Out
TRM's deeper on-chain analysis revealed a two-pronged technical approach. On Ethereum, the attacker leveraged an EIP-7702 delegation mechanism supported by 50 pre-signed authorizations, effectively converting a Binance hot wallet into a token sweeper under the attacker's control. Across the other nine affected chains, funds moved to the attacker through standard signed transfers. TRM concluded that the evidence "points to a compromise of Binance's hot wallet signing infrastructure."
The thief moved quickly to monetize the haul before freezes took full effect. Approximately 325 million USDT was offloaded to market makers in exchange for roughly 122,300 ETH, executed at a discount exceeding 10%. The attacker also borrowed ETH against USDT on the Aave lending protocol before Aave froze the affected markets.
Chainalysis noted that the stolen assets are being shuffled back and forth among multiple addresses, a pattern consistent with layering. TRM expects the next phase of the money trail will flow through cross-chain bridges, decentralized swap services, and OTC brokers.
Withdrawal Timeline and Proof-of-Reserves Verification
Binance has indicated that withdrawals will be restored in stages, contingent on additional security checks. The exchange captured a fresh proof-of-reserves snapshot at midnight UTC on Saturday. Users holding any of the ten fully backed tokens will be able to confirm their balances are backed at least 1:1 once a full zero-knowledge proof is generated, a process Binance estimates will be complete by Tuesday.
The situation underscores the ongoing vulnerability of centralized exchanges to sophisticated state-linked threat actors and raises questions about the resilience of hot-wallet signing infrastructure in the face of pre-authorized delegation attacks.