Who’s money was it?
It was Binance customers' money — user deposits the exchange held in its hot wallets — and Binance is now replacing it with its own company funds so users don't take the loss.
The answer decides who eats a $6.3 billion loss, and Binance has promised its customers won't.
4 details4 sources2 disagreements
- The attacker drained Binance's hot wallets across 11 blockchains — the wallets exchanges use to hold customer deposits for withdrawals, starting with 233M XRP on the XRP Ledger.
- The stolen assets were overwhelmingly customer-held tokens: $3.46B in stablecoins (USDT/USDC), 18,270 BTC worth $1.48B, and 612.7M USDT on Tron, per Elliptic's on-chain analysis.
- Binance is covering the loss from its own pockets: it set aside $6.34B of company funds — half its $1B SAFU fund, surplus futures-insurance funds and corporate treasury — and has bought replacement tokens covering about 95% of the theft.
- Covering the loss is not recovering it: Elliptic counts roughly $3.25B in non-freezable crypto still under attacker control across more than 800 addresses.
Room for disagreement
- Binance's 'covered' claim is not independently confirmed: security firm CertiK said it needed more information to verify the exchange's assertion that it held $5B in replacement crypto.
- CNBC notes that restoring backing for 90% of assets does not mean Binance recovered the funds — roughly $3.25B in assets that issuers cannot freeze remains under the attacker's control, per Elliptic.
I thought crypto was more secure and traceable, yet we have had huge thefts like this for over a decade. Seems like crypto is actually less secure.
The blockchain itself is secure and traceable — the weak point is centralized exchanges like Binance holding billions in hot wallets, which is why these thefts keep happening.
Keeping crypto on an exchange means trusting that company's security and balance sheet, not the blockchain.
4 details3 sources2 disagreements
- The blockchain wasn't hacked; the attacker compromised Binance's systems — initially a DevOps engineer's laptop — and drained hot-wallet private keys, the BBC notes.
- Traceability works: the FBI blamed North Korea's TraderTraitor, listed more than 600 Ethereum addresses, and roughly $3 billion of stolen assets was frozen by exchanges and stablecoin issuers.
- This is a recurring pattern: the $1.5 billion Bybit hack in 2025 and the $320 million Liquid Network exploit in 2026 also targeted centralized custody, not the underlying blockchains.
- As CNBC notes, when you leave crypto on an exchange, you are relying on that company's controls and its balance sheet — and a pledge to make customers whole is only as strong as the resources behind it.
Room for disagreement
- Some argue crypto is inherently less secure because transactions are irreversible and pseudonymous, so stolen funds are often laundered before they can be recovered. Others counter that blockchain forensics has improved dramatically — the FBI's rapid attribution and the freezing of roughly half the Binance haul show traceability is a real deterrent.
- Bitcoin advocates would add that the problem is centralized exchanges, not crypto: self-custody removes the counterparty risk entirely, though it shifts the burden to the individual to secure their own keys.
Well, like I said this has been happening for years. It doesn’t really matter if it is traceable, yet can be stolen. Are they losing all their customers?
No — Binance isn't losing all its customers; withdrawals resumed without a run, and early data suggests most users are staying put despite the record hack.
The test of an exchange after a theft isn't just whether it repays users, but whether it keeps their trust — and so far the world's biggest exchange appears to be holding onto it.
5 details4 sources1 disagreement
- Binance reopened bitcoin, ether, BNB and 12 other assets on Nov. 1 and said withdrawals were processing normally, with no reports of a queue or a run on the exchange.
- The exchange said it had covered 95% of the $6.3 billion stolen — about $6 billion — using company funds, and pledged to refill its $1 billion SAFU insurance reserve.
- Binance's proof-of-reserves snapshot taken Oct. 31 shows 100% or higher backing for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, with a full cryptographic proof expected by Nov. 3.
- Roughly $3 billion of stolen assets have been frozen, including over $1.5 billion by Tether and about $800 million by Circle, which cuts how much the hackers can actually keep.
- Binance is the dominant exchange by trading volume, and past hacks at other platforms show users often return after losses are covered — though a public-confidence hit is hard to measure in real time.
Room for disagreement
- Some analysts argue the reputational damage is severe regardless of reimbursement — a hack of this size undermines the 'secure, self-custody' pitch of crypto and could push users toward hardware wallets or competitors, while others note that Binance's fast, full coverage is exactly what kept users from fleeing after past exchange hacks.
More poor decisions…
Yes — beyond the hack itself, Binance made several follow-on decisions that drew criticism, most notably tapping its user-protection funds and reopening withdrawals before an independent proof-of-reserves was available.
How Binance manages the aftermath will decide whether users trust it — and the wider crypto exchange model — after the largest heist on record.
4 details5 sources2 disagreements
- Binance said it drew on part of its $1 billion SAFU emergency fund, a portion of its futures insurance fund and its corporate treasury to replace stolen tokens — funds that exist specifically to protect users in exactly this scenario, which some critics saw as a sign the company's risk buffers were thin relative to its hot-wallet exposure.
- The exchange resumed bitcoin, ether and other withdrawals on November 1 after saying it had covered about 95% of the $6.3 billion, but the full cryptographic proof-of-reserves was not expected until around November 3, meaning users could not independently verify backing for days after withdrawals reopened.
- Binance initially said the breach came from a compromised DevOps laptop, then co-CEO Richard Teng acknowledged investigators found additional breach points — raising questions about how much the company understood about its own security when it set its Sunday reopening target.
- Binance's decision to hold billions in hot wallets at all is the underlying poor decision: the blockchain wasn't broken; the exchange's custody setup was the point of failure, as analysts at TRM Labs, Chainalysis and Elliptic have repeatedly noted about exchange hacks.
Room for disagreement
- Binance argues its decisions were prudent: using SAFU and the futures insurance fund is exactly what they are for, withdrawals reopened without a run, and it set aside $6.34 billion of company money so users bear no loss. Critics counter that needing to tap emergency funds at all shows Binance's custody and risk management failed, and that resuming withdrawals before the proof-of-reserves was published asked users to trust the company's word.
- Coverage also diverges on how much of the replacement came from the futures insurance fund: Binance says it used only surplus above required levels, but it has not disclosed the fund's exact contribution, leaving outside observers unable to verify the claim.
I thought the ceo was previously sent to prison?
Yes — that was Changpeng Zhao (CZ), Binance's founder and then-CEO, who served four months in federal prison in 2024 after pleading guilty to failing to maintain an effective anti-money laundering program. He is no longer CEO; Richard Teng and co-founder Yi He now run the exchange.
It explains why the person leading Binance's response to the record hack is not the CEO most people remember — CZ stepped down as part of the 2023 US settlement and is now a convicted felon, though still Binance's largest shareholder.
4 details3 sources1 disagreement
- CZ pleaded guilty in November 2023 to one count of violating the Bank Secrecy Act and agreed to pay a $50 million personal fine; Binance paid $4.3 billion in a parallel settlement with the DOJ, Treasury and CFTC.
- He was sentenced to four months in prison in April 2024 — far shorter than the three years prosecutors sought — and reported to a federal facility in Lompoc, California, in May 2024.
- As part of the settlement, CZ agreed to step down as CEO and was barred from any management role at Binance; Richard Teng, a former Singapore regulator, took over and now serves as co-CEO alongside co-founder Yi He.
- CZ was released in September 2024 and has since been active on X, where he commented on the hack by noting Binance owns SpaceX shares worth over $1 billion as a loss buffer.
Room for disagreement
- CZ's sentence drew sharp debate: prosecutors argued his willful failure to enforce anti-money-laundering controls enabled billions in illicit flows and deserved three years, while his defense — and the judge — emphasized his cooperation, lack of prior offenses and that no evidence tied him to the underlying criminal transactions.
Hmm, was it an inside job?
No public evidence points to an inside job — the FBI, Chainalysis, TRM Labs and Elliptic all attribute the hack to North Korea's state-sponsored TraderTraitor group.
The distinction matters: an insider would mean Binance's own controls failed; a state-sponsored hack means a foreign government breached the world's largest exchange — and got away with the biggest crypto heist on record.
4 details3 sources1 disagreement
- The FBI said on Oct. 31 that TraderTraitor, the same North Korean unit behind the $1.5 billion Bybit hack, was responsible, and listed more than 600 ethereum addresses tied to the stolen funds for crypto firms to block.
- Co-CEO Richard Teng described the initial entry point as a compromised DevOps laptop running malware designed to delete evidence; investigators later found 'additional breach points' beyond that laptop, but all tied to the external attack, not a Binance employee.
- The attackers manipulated a transaction-approval system so funds left a hot wallet without passing normal approval controls, using Ethereum's EIP-7702 account-delegation feature and a self-destruct mechanism to erase traces — tactics consistent with Lazarus Group's known playbook.
- Binance has frozen about $3 billion with industry partners, and the FBI expects further laundering of the stolen assets into ethereum, which is typical of TraderTraitor operations.
Room for disagreement
- No major investigator disputes North Korean attribution, but the probe is still open — Teng confirmed 'additional breach points' beyond the laptop, and Binance has not released a full forensic report, so how the attackers gained that level of internal access is not yet fully public.
0
AI answers with web search. May be wrong.
