Binance Reserves $6.34 Billion to Cover Record Crypto Heist

Binance has set aside more than $6.34 billion in company funds to cover the losses from a hack that stole over $6 billion. The exchange announced the reserve on Friday, marking the event as the largest cryptocurrency theft on record.

Blockchain intelligence firm TRM stated that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains. The bulk of the transfer occurred in about 20 minutes. TRM attributed the attack to TraderTraitor, a hacking unit it describes as North Korea's elite cyber force.

Chainalysis co-founder and CEO Jonathan Levin agreed with this assessment on X. He said the attack likely involved TraderTraitor. A Binance spokesperson told reporters that the company is working with law enforcement partners to confirm the identity of the criminals.

The exchange initially suggested the incident involved a compromised laptop. Later investigations revealed additional points of breach. Binance co-CEO Richard Teng posted a video on X on Friday to address the situation.

Teng confirmed that Binance's hot wallet was affected. He explained that user assets are primarily held in cold wallets, which are offline. Assets move to hot wallets only when users initiate withdrawals. He said the tech and security teams are still investigating the complex tactics used by the attackers.

Teng noted that the attack was not carried out by a single person. He mentioned a self-destruct mechanism that complicates the investigation. Binance said it is working with token issuers and other exchanges to trace the stolen funds.

Independent analyst Garrick Hileman noted that while roughly $3 billion in assets were frozen, hackers are likely converting the remainder. He compared the process to money laundering, where stolen goods are mixed with other cryptos to obscure their origin. He said it is unclear how long it will take to turn the stolen assets into usable currency.

Cybersecurity firm NyxLab co-founder Kok Tin Gan raised questions about approval controls. He stated that the attacker likely gained a never-expiring, full-access token to the hot wallet. This allowed them to move funds without standard verification steps.

Binance has suspended withdrawals while it investigates. The company expects to resume withdrawals within one or two days. Deposits remain unaffected. The company promised to cover all user losses and has shared regular updates on its social media channels.

The scale of the theft exceeds the $1.5 billion hit suffered by exchange Bybit in February of last year. The FBI identified North Korea and TraderTraitor as the responsible parties in that incident. Experts warn that cyber attacks of this magnitude may become more common as digital assets grow.

Binance founder Changpeng Zhao noted on X that while this hack is the largest by dollar value, previous attacks on Mt. Gox affected a larger amount of bitcoin. He acknowledged the substantial financial impact of the current incident.