Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'

What it is

On 30 October 2026, Binance CEO Richard Teng said in a video address that the exchange will cover all losses from the hot-wallet hack, about $6.3 billion, from company funds. Teng said customer funds were never touched. Decrypt reports the statement and adds figures and operational dates.

How it works

Teng said the attack "was not carried out by one person." Binance first traced it to a compromised laptop, then found additional breach points. The attacker used EIP-7702, an Ethereum feature that lets standard wallets run smart contract code, to get onchain execution approval over a hot wallet. Teng said that delegation "did not pass through our normal approval controls." A self-destruct mechanism destroyed the attacker's tooling and traces, which slows the investigation. TRM Labs and Chainalysis attribute the theft to TraderTraitor, the North Korean group.

Preconditions / Affected

Only Binance's own hot wallet was hit. Teng said most user assets sit in cold wallets and move to the hot wallet only on withdrawal. The page does not say how the delegation was authorised, or which breach points beyond the laptop were found.

What to do

The page gives dates and status, not engineering guidance for other teams.

• Binance paused withdrawals to rebuild and retest its infrastructure. It aims to restore them by Sunday after the statement.
• A full proof of reserves report is due Monday, with an initial view before then.
• Binance is reviewing endpoints, cloud, key management and signing.
• Aave unfroze all V3 and V4 markets on 30 October. They had been frozen as a precaution, which paused new deposits and borrows while withdrawals and repayments continued. Founder Stani Kulechov said Aave was unaffected and all positions remain overcollateralized.

Caveats

• Binance says $5 billion of the $6.34 billion reserve is already held in the stolen tokens (USDC, USDT, BTC, ETH, BNB). It is buying the rest on the market and over the counter.
• Teng says Binance can absorb the loss because it keeps much of its operating earnings in crypto. The proof of reserves has not yet been published.
• TRM Labs says the attacker borrowed ETH against USDT on Aave while racing stablecoin freezes.
• The attacker is still moving funds. Between 11:37 and 12:12 ET on 30 October, a Tron wallet Arkham attributes to the hacker sent about 5.19 million TRX (roughly $1.73 million) to 12 addresses.
• Co-founder Changpeng Zhao said this is the largest theft in dollar terms but not in Bitcoin terms, citing Mt. Gox's 650,000 BTC.