Binance Says $5B in Matching Tokens Are Set Aside for Hack Losses

Binance’s central claim

Binance says it has more than $6.34 billion in company funds earmarked for losses from a reported $6.3 billion hack. The exchange’s key claim is that $5 billion of that amount is held in the same tokens that were stolen. Matching the assets could make repayment more direct: Binance might be able to return the relevant tokens without first selling other holdings and buying replacements. But that claim depends on details the company hasn’t yet provided, and independent verification remains a key open question.

“The $5 billion is held in the exact token assets that are required. These assets are in Binance custody,” a company spokesperson told Cointelegraph. Binance hasn’t said when it acquired the tokens, which assets it still needs to buy, or when any remaining purchases will be complete. The spokesperson declined to identify the wallets, citing security reasons. That leaves outsiders with a specific assurance about the size and composition of the holdings, but little information they can use to check it themselves.

The exchange says the holdings will appear in its next proof-of-reserves report, which lists assets held to back customer balances. That report may provide a useful checkpoint, though the company funds it describes are distinct from the assets backing customer balances. Binance also says it sends weekly reports on company funds to the Financial Services Regulatory Authority, the regulator for Abu Dhabi Global Market in the United Arab Emirates. The company says that reporting requirement was in place before the hack. For readers trying to assess the claim, the timing and scope of the next public disclosure matter as much as the headline total.

Recovery figures remain difficult to verify

Binance said about $3 billion in affected assets had been frozen with help from blockchain partners. Those frozen funds aren’t included in the company funds it says are set aside to cover losses, so they’re a separate part of the recovery picture. The exchange hasn’t disclosed how much of the stolen cryptocurrency has been recovered. A freeze can limit the movement of funds, but it doesn’t by itself establish that the assets have been returned or are available to compensate affected parties.

Blockchain intelligence firm TRM Labs said funds were drained from Binance wallets across 10 blockchains on Thursday, and attributed the attack to North Korean hacking group TraderTraitor. Binance confirmed the incident on Friday, describing it as a $6.3 billion hack. It was reported as the largest cryptocurrency theft on record. The scale makes the distinction between funds frozen, funds recovered, and funds Binance says it can contribute especially important. Those figures describe different stages of a response, and shouldn’t be treated as interchangeable.

CertiK told Cointelegraph it needs more information from Binance to assess whether the claimed $5 billion in matching tokens can be independently verified on-chain. Earlier Friday, CertiK CEO Ronghui Gu estimated that roughly $3 billion in frozen assets and Binance’s $1.17 billion emergency fund might cover about 66% of the reported losses, leaving a possible $2.1 billion shortfall. That estimate uses the figures then available; it doesn’t settle whether the newly claimed company holdings exist in the stated form or can be used for repayment.

Gu put that potential gap at about 1.3% of Binance’s reported $165 billion in exchange reserves. Those reserves include assets backing customer balances, which makes them different from a pool of company funds available to absorb losses. Analytics firm Nansen said it couldn’t verify what funds Binance had beyond its roughly $1.16 billion emergency fund, or where money to cover the remaining losses would come from. The numbers here are underwhelming as evidence: they show the scale of the claimed resources, but leave key questions about their availability unanswered.

Related: EIP-7702 didn’t cause Binance hack, but may have amplified losses

Binance points to company resources

Founder Changpeng Zhao said the company’s SpaceX holdings, linked to a $500 million investment in Elon Musk’s Twitter takeover, were worth more than $1 billion. Co-founder Yi He said Binance’s revenue for the year was sufficient to cover the losses, so the exchange wouldn’t need to sell its SpaceX stake. These statements point to potential financial capacity, but they don’t explain how much of that capacity is immediately available or how it fits into the $6.34 billion figure.

Zhao also said Binance accumulates listed cryptocurrencies because customers can use those tokens to pay trading fees. In another post, he said Gulf, Binance’s partner in Thailand, had offered financial support. Those points broaden the company’s account beyond the matching-token claim, while leaving the terms, amount, and practical role of the support unclear in the information provided.

Zhao stepped down as CEO in 2023 and later served four months in a US prison over anti-money-laundering violations. He remains a major Binance shareholder; Forbes estimated his personal fortune at about $115 billion. His statements carry weight because of his continuing connection to the company, but they’re still claims from a major shareholder, not a substitute for independently checkable disclosures.

What the disclosures need to establish

For now, the $5 billion claim is central to Binance’s recovery account, but the exchange’s next reserves report and further wallet-level evidence will determine how much outsiders can confirm. A useful disclosure would need to make clear which assets are held, how they relate to the reported losses, and whether the company can direct them toward repayment. The exchange has cited security as the reason for withholding wallet identities, so the challenge is to provide meaningful verification without exposing information it considers sensitive.

This is more significant than it looks. If you’re working in this space, the episode is a reminder that a large stated balance and a verifiable recovery plan aren’t the same thing. (And this is the part most people overlook.) The timing of the holdings, the distinction between company and customer assets, and the status of frozen funds all shape what the headline total actually means.

For affected parties, clarity will depend on evidence that connects the promised resources to the losses and explains how the funds can be used. Binance has pointed to matching tokens, an emergency fund, revenue, other company holdings, and an offer of support from a partner. A tally is only the start. The next disclosures will show whether those resources form a credible account of recovery.

Magazine: Cybersecurity’s Black October: How to protect yourself