Binance covers losses from North Korean hacker attack using SAFU fund

Scale of the incident and perpetrator liability

The Binance exchange has begun addressing the aftermath of the largest cyber hack in the company's history. According to Reuters, hackers from North Korea are behind the attack. The total size of the losses is estimated at approximately $6.3 billion. Of this amount, around $3 billion was successfully frozen in USDT and USDC stablecoins. The remaining funds — approximately $3.3 billion — were withdrawn in the form of Bitcoin and altcoins, and their recovery remains uncertain.

Details of the technical breach

Preliminary data from Binance representatives indicates that the perpetrators compromised the laptop of a DevOps engineer on the platform. This allowed them to gain access to a service container and the transaction signing system, enabling them to withdraw assets without leaking private keys. During the attack on one of the Ethereum hot wallets, using the EIP-7702 standard, hackers withdrew 167,464 ETH, $1.615 billion in USDT, and over 60 other tokens. Simultaneously, funds were withdrawn across nine other blockchains. The exact mechanism of the infrastructure compromise is currently under investigation.

Financial support for users and exchange status

The company's statement emphasised that user assets remain safe. The exchange has committed to fully covering the losses using the SAFU insurance fund and its own funds. The size of the SAFU fund prior to the incident was approximately $1 billion, so Binance will have to use its own assets in the amount of approximately $2.3 billion to compensate for the losses.

At present, deposits are operating in normal mode. Withdrawals have been temporarily suspended, but according to management, this function is expected to be restored within 48 hours. After the investigation is completed, the company will publish a technical report and an updated Proof of Reserves.

Market reacts to the news

The cyber attack caused significant volatility in the cryptocurrency market. In the last 24 hours, positions worth $1.54 billion were liquidated, of which $1.2 billion accounted for longs.