Binance Sets Aside $6.34 Billion to Cover Its Hack

gm, Defiers!

These are the biggest stories in DeFi and crypto:

• Binance reserved $6.34B to cover the hack
• Chainalysis linked the hack to North Korea
• Aave reopened with nine assets at zero LTV
• Bitcoin fell below $80K on $1.34B of liquidations
• Trezor told CryptoBilis buyers to move funds

Binance says it has reserved more than $6.34 billion of company funds to cover Thursday's hack, which it estimates hit about $6.3 billion in assets. About $5 billion of that reserve is already held in the same tokens that were stolen. Co-CEO Richard Teng said the hacked hot wallet held Binance's own funds and that most customer assets sit in cold wallets. He said withdrawals should restart before Sunday, with a full proof-of-reserves report by Monday, Nov. 2.

The roughly $3 billion that partners froze sits outside that reserve. Binance counts it separately because a frozen token has not been returned. Changpeng Zhao, who no longer runs Binance, posted his own rough math. In his count, the frozen funds and an emergency fund he puts above $1 billion leave a gap of about $2 billion. He said Binance holds more than $1 billion in SpaceX shares to help fill it. Neither figure has been verified. Binance's own page valued that fund at about $1 billion in bitcoin as of Oct. 13.

DeFi felt some of the shockwaves. Aave froze its markets on Thursday evening, a day after it raised borrowing limits for bitcoin and ether collateral. It reopened them today, but nine assets, including USDT and USDC, cannot back new loans for now. LlamaRisk said a wallet linked to the exploiter had borrowed 19,762 WETH on Aave's main Ethereum market.

Lenders with no Binance exposure also slowed. Jupiter Lend said a liquidity crunch was delaying withdrawals, although it holds no funds at Binance. At 7:14 a.m. ET, depositors in its Earn product had claims on 418.5 million USDC, and 3.35 USDC could leave right away. Jupiter's own documentation warns that funds lent out to borrowers can delay withdrawals during a mass exit.

So the two groups depend on different things. Binance customers depend on Binance's own balance sheet, and any frozen funds that come back add to it. DeFi lenders depend on their borrowers: Jupiter said withdrawals will process as borrowers repay or new deposits arrive.

When Binance publishes its reserve report, check that your own balance is in it.

Read more below!

As of 16:26 UTC, Oct. 30. Data: CoinGecko, Aave, Hyperliquid. Full list

HACKS

Binance Says It Has Reserved Over $6.34 Billion to Cover Hack Losses

Binance said investigators found additional points of breach beyond the engineer's laptop it first suspected. Teng said the attacker used an EIP-7702 delegation to control a hot wallet without passing Binance's normal approval controls, and called it more than a one-click attack. Binance is rebuilding its withdrawal service and reviewing employee devices, cloud systems and key management. It is buying the remaining replacement tokens through market and over-the-counter trades, which thin liquidity could slow. Co-founder Yi He had said early Friday that withdrawals would start resuming within 48 hours.

Binance Says It Has Reserved Over $6.34 Billion to Cover Hack Losses

thedefiant.io

HACKS

Chainalysis Links $6.4 Billion Binance Hack to North Korea

Chainalysis linked the hack to North Korea with a “high degree of confidence,” after stolen funds mixed with funds from last month's Bitget exploit. It says the attacker swapped $325 million of stablecoins for ether in about 20 minutes to get ahead of freezes. Arkham counts $911 million swapped into ETH and TRX and $2.9 billion still movable. Some tokens were stopped: Synthetix used admin control to recover 8.4 million SNX, and USDT0 froze 6.19 million tokens.

DEFI

Aave Reopens Markets but Keeps Nine Assets at Zero LTV

Aave's zero-LTV rule blocks borrowing against the restricted assets, while users can still supply, borrow and repay them. On V3, liquidation thresholds stay the same, so existing health factors do not move. LlamaRisk's plan would cut the V3 Core WETH cap from 2.4 million to 1.79 million WETH. On Ink, Tydro reopened with new loans blocked, then restored borrowing with a lower USDC cap. Unit, which moves assets into Hyperliquid, delayed every deposit and withdrawal to slow stolen funds.

MARKETS

Bitcoin Trades Below $80,000 as Long Liquidations Hit $1.34 Billion

Bitcoin fell below $80,000 as $1.34 billion of long positions were liquidated in 24 hours, according to CoinGlass. Total crypto market value fell 6.2% to $2.61 trillion. Coinbase and Strategy shares fell 11.6% and 9.8% by 9:45 a.m. ET, more than bitcoin's 4.65% drop, though neither reported Binance losses. A wallet linked to the exploiter sold 134.1 million FUN, and FUN fell 95.5% in one Uniswap pool. 1INCH fell about 13%. Trading jumped Thursday on Uniswap, Curve and Hyperliquid; our explainer shows why a price gap between venues can still lose money.

SECURITY

Trezor Urges CryptoBilis Buyers to Move Funds After Implant Report

Trezor told buyers who got its wallets from reseller CryptoBilis since March to move funds to a new wallet with a fresh recovery phrase. An Indonesian customer reported an extra circuit board with a cellular module in a Safe 5. Trezor says the implant reportedly reads the recovery phrase from the screen and sends it over a mobile network. Trezor has not examined that device and found no tampering in four others. No buyer has reported a loss. On Oct. 13, Trezor said it had no reports of tampered devices.

Other Stories Worth Your Time

Binance Hack’s Bitcoin Sits Unspent Across 19 Addresses — plus an exploit-linked wallet moved 14,040 ETH, and MistTrack linked a theft route to Phemex.

CoinDCX Halts New Futures Positions, Citing Liquidity Provider — the Indian exchange did not name the provider.

Scroll Details Permissioned AI Network Plan and Ethereum Token Migration — SCR and USX would move to Ethereum mainnet; a formal proposal is still to come.

Circle to Cut Legacy USDC Crosschain Limits From Oct. 31 — the legacy routes stop on Dec. 1.

Uniswap, a16z and DEF Seek DeFi Exemptions From Illinois Crypto Tax Rules — the draft could make some fee-charging DeFi platforms collect tax.

Anchorpoint Plans Native HKDAP Issuance on Solana — plus Standard Chartered says it provides custody in Luxembourg and DIFC.

Ripio CEO Acknowledges Error After wARS Conversion Complaints — the peso token converted below its peg inside the app.

Trending on The Defiant