Binance spokesperson: Stolen funds came from its own hot wallet; customer funds were not affected
Crypto journalist Eleanor Terrett wrote that in response to questions about why Binance still said user funds were safe after a hacker attack of about $6 billion on Binance, a Binance spokesperson said customer funds were not affected and that the transferred funds came from one of the trading platform’s own hot wallets. Binance said most customer funds are kept in cold wallets and are transferred to hot wallets only when users withdraw funds.
The spokesperson said that most of Binance’s operating income is held in the form of crypto assets, and the company has retained a significant portion of it and reinvested it into the business and security because it believes in the long-term value of crypto assets and the industry. He said this is why the company is able to immediately bear such a large loss with its own funds.
This statement is consistent with Binance co-CEO Richard Teng’s earlier video statement: user funds are safe, losses will be covered by company funds and the SAFU fund, and no leakage of wallet private keys has been found. In terms of the capital path, the loss is borne by the platform’s own hot wallet rather than customer balances being directly damaged. By holding operating proceeds in crypto assets, the platform creates a buffer that allows large losses to be absorbed internally immediately, benefiting users (whose balances are promised protection), while the cost is borne by the platform’s own capital and reserves.
Original source:
Title: Eleanor Terrett’s post on Binance fund safety
Publisher: Eleanor Terrett (@EleanorTerrett)
Date of publication: 2026-10-30
URL: https://x.com/EleanorTerrett/status/2116172881524584503
Nature of source: journalist’s original post (quoting a Binance spokesperson)
Verification status: full original post read
Supporting content: customer funds were not affected, the theft came from the platform’s own hot wallet, most customer funds are in cold wallets, holding operating proceeds in crypto assets allows the platform to immediately absorb losses with its own funds
ABAB AI Insight
Through Eleanor Terrett’s post, the Binance spokesperson made clear that the source of the roughly $6.3 billion theft was the platform’s own hot wallet, not customer custodial balances. Richard Teng further confirmed in a video that most user assets are stored in cold wallets and are transferred to hot wallets only upon withdrawal, and that the company will cover all losses with company funds and SAFU. This distinction directly answers the market’s question of whether user funds were directly stolen.
On the capital path, the platform holds operating profits in the form of crypto assets and reinvests them in the business and security, creating an internally available buffer. This allows loss absorption to depend neither on external financing nor on sharing the burden with users, but instead on the platform’s balance sheet and reserves. Unlike previous incidents such as Mt. Gox and FTX, where user assets were directly damaged, this structure confines the impact to the platform’s own liquidity layer, with user balances receiving a priority promise of protection.
Comparable cases include exchanges’ practices of managing risk through cold-hot wallet separation and reserve proof mechanisms, as well as some platforms’ practice of making initial payouts with their own funds or insurance funds after security incidents. Binance’s emphasis this time on both not using customer funds and holding proceeds in crypto assets directly links its asset-holding strategy with its loss-absorption capacity.
Specific judgment: given that both the spokesperson and Richard Teng confirmed that customer funds were not affected, and that the platform had already set aside more than $6.34 billion in company funds to cover the loss, the loss-bearing method in this incident is primarily internal absorption by the platform. The key going forward will be whether the updated proof of reserves can fully show the replacement of the stolen assets, and whether the final determination of the attack path changes the attribution of the assets as the platform’s own hot wallet.
ABAB News · Cognitive Law
Separating cold and hot wallets allows the platform to confine losses to its own liquidity layer.
Holding operating proceeds in crypto assets creates an internally available buffer.
The platform’s commitment to cover losses with its own funds puts user balance protection ahead of the actual ownership of assets.