Following the hack, Binance said its emergency reserve, known as the Secure Asset Fund for Users (SAFU), and corporate funds would cover all losses, CoinDesk reported Friday (Oct. 30). It also reported approximately $3 billion frozen on-chain through cooperation with partners. Freezing these assets prevents further movement but does not establish that they have been returned.
Binance allocated more than $6.34 billion, excluding frozen assets, with $5 billion already held in the affected tokens, the report said. That commitment places the immediate financial burden on the exchange rather than making customers wait for investigators to recover the proceeds.
Sandeep Pyapali, founder and CEO of stablecoin infrastructure company Mesta, described to PYMNTS the conditions for fulfilling that promise.
“User balances are only truly safe if the exchange replaces the missing assets quickly, reopens withdrawals in an orderly way and proves its reserves again,” Pyapali said.
Recovery follows different routes depending on what was stolen. Tether and Circle froze about $3 billion after the Binance hack, PYMNTS reported Friday, citing Reuters. Issuer-controlled stablecoins retain an avenue for intervention after funds leave an exchange.
Bitcoin has no issuer with equivalent powers, Eric Jardine, head of research at Chainalysis, told PYMNTS Friday. Authorities generally need the private keys or cooperation from an exchange or another custodian holding the funds.
“A court order alone cannot make the bitcoin network transfer coins,” Jardine said.
Stablecoin issuers, by comparison, potentially immobilize stolen funds before an attacker moves or converts them, then support recovery through the applicable legal process. That does not guarantee restitution.
“Both assets can be traced, but tracing and recovery are different tasks,” Jardine said.
Who Can Act After the Money Moves
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
Cross-border recovery depends on identifying institutions with control over the assets and reaching them with actionable requests. An exchange’s offshore operations do not eliminate these avenues, although jurisdiction and legal procedures affect how they proceed.
“Recovery moves faster when investigators preserve evidence immediately, identify where the funds are held, and send precise, legally supported requests to issuers and custodians,” Jardine said.
Established relationships and parallel coordination among authorities also reduce delays, he said.
Attribution requires similar care. Funds from the Binance hack commingled on-chain with funds from the Bitget compromise attributed to North Korea, Jardine said. He described that as suggestive of common ownership, linking the events to a North Korean hacker. The investigation remains ongoing, and speculation about how the attack was conducted would be premature.
The implications extend to banks and FinTechs considering stablecoin wallets. The PYMNTS Intelligence report “The Wallet Effect: How Credit Unions Can Close the Digital Currency Access Gap” found in June that strong interest among credit union members rose from 5% for direct stablecoin payments to 12% when access involved a digital wallet. Meanwhile, 70% were unsure whether their credit unions supported stablecoin services. The findings measured interest and awareness, rather than actual use.
For providers pursuing that interest, custody contracts, reimbursement obligations and access during an outage warrant attention alongside the wallet interface. A stablecoin’s dollar peg does not protect against theft from the institution holding it.
Exchanges should strengthen security across both conventional computing systems and blockchain infrastructure, Jardine said.
The financial exposure also demands board oversight, according to Chris Dimitriadis, chief global strategy officer at ISACA.
“This is ultimately a governance question, and it belongs in the boardroom, not just the security team,” Dimitriadis said in comments provided to PYMNTS Friday.
For all PYMNTS digital transformation coverage, subscribe to the daily digital transformation newsletter.
Add as Preferred Source
