Binance says it will cover more than $6.3 billion in hack losses with corporate funds

Binance CEO Richard Teng said the exchange will cover the losses from an attack that hit one of its hot wallets with its own funds, while client assets remain secure. For PSPs and risk teams, the key point is the same old one: hot-wallet exposure can become an operational problem fast, but it does not have to become a client-asset problem if custody is separated properly.

1. Teng said Binance has already reserved $6.340 billion in corporate funds to make customers whole after the attack. Of that amount, $5.000 billion is already held in the same cryptocurrencies affected by the incident, including bitcoin (BTC), ether (ETH), USD Coin (USDC), Tether (USDT) and BNB.
2. The remaining coverage will be bought in the markets and through over-the-counter (OTC) transactions. Teng said, “We are committed to covering all losses derived from the hack with company funds,” and added that Binance temporarily suspended withdrawals to review its security infrastructure.
3. According to Teng, the incident affected a hot wallet, meaning an online address used to process transactions such as withdrawals. He distinguished those funds from the company’s custody architecture, where most client assets are kept in cold wallets offline. “We never use client funds,” he said.
4. Binance expects to publish an initial Proof of Reserves report on Monday. In practice, that is a snapshot of the holdings an exchange says it is safeguarding, although the liabilities it captures depend on the methodology used. Teng said the report will include the assets acquired to complete the promised coverage.
5. Teng said the initial investigation pointed to a compromised laptop, although later checks identified other access points. He also said the attackers used a self-destruct mechanism that erased tools and traces during the operation, which complicated forensic analysis. Binance also said the exploit involved EIP-7702, an Ethereum-related technical proposal that lets an account temporarily delegate code execution.

For high-risk operators and their payment providers, this is the part worth watching: Binance is trying to show that a hot-wallet breach can be absorbed by corporate liquidity while customer balances stay ring-fenced in cold storage. That distinction matters when counterparties start asking who bears the loss, how fast withdrawals can reopen, and what exactly a “proof” of reserves does and does not prove.