By cryptoadmin Binance moved aggressively to reassure users after the largest crypto exchange suffered the largest cryptocurrency theft in history.
In an update shared with CoinDesk, the exchange said it set aside over $6.34 billion for the incident, with $5 billion already held in the exact token assets that were affected.
In other words, Binance is using its own corporate money to secure matching cryptocurrencies so that affected user balances can be restored one-for-one without altering or taking customer funds.
It is completing the purchase of the remaining amount by buying the tokens through public markets and over the counter so the reserves match exactly what users lost.
“These figures do not include frozen or protected assets. Currently, $3 billion has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets. We will continue to use company resources to cover confirmed shortfall… Ultimately, all user funds will be verified publicly through our Proof of Reserves. We will weather this storm,” a company spokesperson said in an email.
The company is also banking on its Secure Asset Fund for Users (SAFU) facility, an emergency reserve that has typically held around $1 billion in bitcoin BTC$77,437.46 for exactly this kind of event.
What happened
Late Thursday, attackers drained an estimated $6.3 billion from Binance’s hot wallets across multiple blockchains. Most of the coins, which included bitcoin, ether ETH$2,232.99 and stablecoins USDT and USDC among smaller tokens, left in a burst that lasted only about 20 minutes.
Binance initially pointed to a compromised DevOps engineer’s laptop that let the attackers submit unauthorized withdrawal requests through internal systems. The company later said it found additional exploit points, while maintaining that it has not seen any evidence that any wallet private keys were stolen. It didn’t give details about the additional attack vectors.
Blockchain analysis firms, including Chainalysis and TRM Labs, linked the exploit with high confidence to North Korea’s hacker group responsible for previous large-scale thefts given the sophistication and speed of the attack.
Read all of CoinDesk's coverage of the Binance hack here
Chainalysis said it is seeing money-laundering techniques it has never observed before. Thousands of transactions are taking place in a very short time, which suggests the attackers are using automated scripts rather than moving money by hand.
Instead of sending funds directly to a final destination, they are repeatedly circulating the coins among many addresses, often sending them back to wallets that appeared earlier in the chain.
One recurring pattern involves many addresses receiving exactly 1 TRX before receiving and immediately transferring larger amounts, which Chainalysis describes as a programmatic process designed to scramble the trail at scale.
Aidan Larkin, co-founder and CEO of Asset Reality, a seized-asset company, called the approach “agentic money laundering.”