Binance says 90% of stolen assets replenished, targets Sunday withdrawals

Binance's Recovery Strategy

Binance has swiftly moved to address the financial fallout from the $6.3 billion hack, announcing that 90% of the stolen assets have been replenished. This rapid recovery effort is being funded through a combination of the exchange's corporate treasury, a partial deployment from its Secure Asset Fund for Users (SAFU), and a portion of its futures insurance fund. A spokesperson for Binance explicitly stated that the exchange itself would bear the financial burden, ensuring that users would not suffer losses from the incident. This commitment is vital for maintaining user confidence in the platform's ability to safeguard assets, even in the face of significant security breaches.

The strategic use of multiple internal funds underscores Binance's preparedness for such events, although the exact contribution from each source and the minimum required balance of the insurance fund were not disclosed. The exchange's proactive communication about its replenishment efforts, moving from 80% to 90% in a single day, aims to reassure its vast user base. This approach highlights the importance of robust internal financial mechanisms and insurance protocols for large-scale cryptocurrency exchanges operating in a high-risk environment.

TraderTraitor Attribution

The recent $6.3 billion hack, which Binance is now actively recovering from, has been identified by TRM Labs as the largest cryptocurrency hack on record. The firm has attributed this sophisticated attack to North Korea's TraderTraitor hacker group, a designation that adds a geopolitical dimension to the incident. The attribution to a state-sponsored entity suggests a high level of organization and resources behind the attack, posing significant challenges for cybersecurity in the crypto space. This identification also raises questions about international cooperation in combating such illicit activities and the potential for further regulatory scrutiny on exchanges.

Industry partners, including Tether and Circle, played a role in mitigating the damage by freezing approximately $3 billion in affected assets shortly after the hack. While these frozen funds are separate from Binance's direct replacement efforts, their action demonstrates a coordinated industry response to contain the spread of stolen funds. The involvement of such prominent stablecoin issuers in freezing assets highlights the interconnectedness of the crypto ecosystem and the potential for collective action to combat cybercrime, even when dealing with highly sophisticated threat actors like TraderTraitor.

Zero-Knowledge Proof

In its efforts to provide transparency and verify its claims of asset replenishment, Binance has published a new reserves snapshot. However, the exchange acknowledges that the full cryptographic proof, specifically a zero-knowledge proof, is still in the process of being generated. This computational workload is substantial, with Binance estimating that it takes approximately 40 to 50 hours to complete. The generation of a zero-knowledge proof is a complex cryptographic process designed to allow one party to prove to another that a statement is true, without revealing any information beyond the veracity of the statement itself.

Binance's update on X confirmed that customer balances in Bitcoin (BTC), Ether (ETH), and eight other assets are fully backed. The remaining 10% shortfall primarily consists of less liquid tokens, which the exchange is actively acquiring through market and over-the-counter transactions. The commitment to generating a full zero-knowledge proof, despite its time-consuming nature, is a critical step towards rebuilding trust and demonstrating verifiable solvency. This level of cryptographic assurance is increasingly expected by users and regulators in the wake of major security incidents, as it provides an immutable and auditable record of an exchange's financial health.