Binance Pledges $6.34 Billion for Hack Losses, Targets Sunday Withdrawals

Company funds committed to the shortfall

Binance says it has reserved more than $6.34 billion of company funds to cover losses from its October 29 hack. In a Friday update reported by Decrypt, co-CEO Richard Teng said about $5 billion was already held in the same cryptocurrencies that were stolen, with the remaining assets being purchased through exchanges and over-the-counter markets.

The commitment gives users a more specific funding plan after the initial reports of large unauthorized transfers. It remains a company assurance while the exchange works through containment, replacement purchases and verification. Withdrawals were still paused in the October 30 updates reviewed for this article.

Teng said Binance aims to restore withdrawals by Sunday, November 1, and publish a full proof-of-reserves report by Monday, November 2. Those dates are targets, and the restart depends on rebuilding and testing the affected infrastructure.

---

Reserves and recovered assets are separate

The Block reported that the committed company resources exclude roughly $3 billion in assets Binance says industry partners have frozen. The distinction matters for understanding the recovery: corporate funds can cover a shortfall while investigators pursue the stolen assets separately.

A freeze restricts movement of funds. Returning those funds requires additional steps, so a frozen total cannot be treated as completed restitution. Adding frozen assets to replacement reserves also does not produce a reliable final loss figure without accounting for overlaps, ownership and recoveries.

The exchange is acquiring matching tokens rather than relying only on a dollar valuation. That matters because obligations denominated in a particular cryptocurrency can change in dollar value as its price moves. The Block reported that thin liquidity and settlement delays could slow purchases of the remaining assets.

---

The investigation extends beyond one laptop

Binance initially identified a compromised employee laptop, then reported additional breach points. CoinDesk reported that Teng described evidence-destruction mechanisms and an Ethereum account delegation that bypassed the exchange’s normal approval process. The complete sequence of the compromise remained under investigation.

TRM Labs independently described an EIP-7702 delegation that caused a Binance Ethereum hot wallet to execute attacker-controlled code. Its analysis identified pre-signed authorizations and unauthorized transfers on other blockchains, leading the firm to assess that Binance’s hot-wallet signing infrastructure had been compromised.

Ethereum’s EIP-7702 specification allows an ordinary account to delegate execution to smart-contract code. Its security documentation warns that delegated code can have unrestricted access to the account. This makes the approval of a delegation a critical security decision; reviewing an ordinary transfer amount alone would not capture that permission change.

---

Customer backing needs a clear reconciliation

Teng said the attack affected Binance’s own hot wallet and that customer funds were not used. CoinDesk also reported that compromised addresses had previously appeared in Binance’s list of assets backing customer balances. Those statements leave an accounting question that the promised reserve disclosure should address.

The useful evidence will connect the affected wallets, customer liabilities and replacement assets, showing how balances are backed after the incident. A statement that funds are safe cannot by itself establish that reconciliation, just as a paused withdrawal service does not by itself determine the size of an accounting shortfall.

Binance said its review covers employee devices, cloud systems, key management and transaction signing. Reopening access will test whether those operational changes are ready, while reserve reporting addresses the separate question of asset backing.

---

Attribution and recovery remain active

TRM Labs attributed the theft to North Korea’s TraderTraitor group with high confidence, citing onchain and offchain intelligence. That is the investigator’s assessment. Its estimated $6.36 billion theft valuation uses prices at the time assets were taken, which helps explain why developing reports carry different headline totals.

For users following the recovery, the next concrete developments are completed replacement purchases, a confirmed withdrawal restart and the promised reserve report. Binance has committed substantial resources; the coming disclosures will show how that commitment translates into restored access and verifiable backing.