Binance Faces $6.4B Theft by North Korean Hackers, Covers Losses with SAFU Funds

1. 06:00
   CointelegraphSelected

   Binance Hackers Convert $6.3 B in Stolen Crypto Before Authorities Freeze Assets

   The largest crypto‑world theft began at 8:04 pm UTC Thursday when attackers linked to the North Korean group behind last month’s Bitget hack seized roughly $6.3 B in cryptocurrency from Binance. They immediately moved the stolen stablecoins—USDT and USDC, which can be frozen by their issuers—into non‑frozen assets such as BTC and ETH. Within an hour, $500 M of USDT had been sent to a single address, and $325 M was sold for ETH by 20:59 UTC. Stablecoin issuers Tether and Circle, along with other entities, began blacklisting the attackers’ addresses within minutes, freezing about $1.567 B in USDT and $823 M in USDC. Binance reported that around $3 B of the stolen funds were on‑chain frozen, and it is collaborating with law enforcement, issuers and blockchain analytics firms to trace the remaining assets. Decentralized protocols also acted: Arbitrum’s Security Council moved $30.5 M in ARB and ETH into a frozen wallet, and Aave V3 saw a $60 M USDT deposit from an attacker‑linked wallet. While freezing stops the attackers from spending the assets, it does not automatically recover them for Binance or its users.

2. 00:34
   DecryptSelected

   Binance Sets Aside $6.34 B to Cover Hack Losses, CEO Confirms Customer Funds Safe

   Binance CEO Richard Teng announced that the exchange has reserved more than $6.34 billion of company funds to reimburse all losses from a recent hack that targeted Binance’s hot wallet. Five billion dollars of that reserve is already held in the exact tokens stolen—USDC, USDT, BTC, ETH and BNB—while the remaining amount is being acquired through market and OTC channels. Teng said the attacker used a self‑destruct mechanism and an EIP‑7702 delegation to bypass Binance’s normal approval controls, and that the theft was carried out by a coordinated group rather than a single individual. Binance plans to restore withdrawals by Sunday, conduct a full security review of endpoints, cloud, key management and signing, and publish a full proof‑of‑reserves report by Monday. The attacker continues to move funds on Tron, with about 5.19 million TRX (≈$1.73 million) transferred to 12 addresses between 11:37 a.m. and 12:12 p.m. ET on Friday. The move underscores Binance’s ability to absorb a loss of this magnitude through its crypto‑based operating earnings and its commitment to protecting customer assets, which are held in cold wallets and only moved to hot wallets for withdrawals.

1. 21:14
   The Block

   Binance Allocates $6.34 B to Cover Hack Losses, Partners Freeze $3 B in Affected Assets

   Binance has set aside $6.34 billion to cover losses from a recent hack that compromised user funds. In addition, industry partners have frozen an extra $3 billion in affected assets to protect investors and maintain market stability. The move follows the exchange’s announcement that the hack had impacted a significant portion of its holdings, prompting a coordinated response from the broader crypto ecosystem.

2. 20:31
   DecryptSelected

   Binance Loses $6.4 B in North‑Korean Hack, Users Covered by SAFU Fund

   A North‑Korean hacker group stole roughly $6.4 B from Binance, the largest crypto theft ever, by compromising a DevOps engineer’s laptop. The stolen assets were spread across three blockchains: about $3.5 B in ETH, $1.4 B in BTC and $630 M on Tron. Stable‑coin issuers Tether and Circle used their built‑in freeze mechanisms to lock about $2.39 B, leaving $2.6‑$3.2 B still unaccounted for. Binance announced it had set aside $6.34 B from its SAFU fund to fully cover user losses and stated that user funds are “completely safe.” Aave also froze its V3 and V4 markets on Ethereum to prevent the attacker from using the stolen funds to create bad debt. The incident caused Bitcoin to dip below $77.5 k, ETH under $2,200, and BNB under $700, with over $1.33 B in positions liquidated.

The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.