On May 7, 2019, Binance's hot wallet was hacked for about 7,000 Bitcoins, valued at around $40 million at the time, accounting for about 2% of its Bitcoin reserves. The attackers bypassed withdrawal risk controls through phishing, trojans, and multiple accounts, triggering an alert after a single transfer, leading the platform to suspend deposits and withdrawals while trading continued.

Jeremy Rubin, a core contributor to Bitcoin, publicly suggested that disclosing the stolen private keys or a subset could coordinate a zero-cost reorganization of the blockchain to reverse the theft. CZ stated that this idea was not initially proposed by the platform, and while the team discussed it, the external perception of the "discussion" itself was viewed as a mistake.

The next day, he confirmed that they would not pursue reorganization: it could damage Bitcoin's reputation and lead to network and community splits, miners would find it hard to coordinate, and it conflicted with the premise of decentralization. At that time, the community's debate over reorganization was more heated than the theft itself.

The losses were covered by the User Security Asset Fund (SAFU) established in 2018, funded by 10% of trading fees. CZ later wrote that the scale of about 7,000 Bitcoins was close to a quarterly burn from a year prior, and the proportion of cash reserves at that time was already lower than earlier decisions to fill gaps with their own funds.

User accounts were not recorded as losses; the platform used reserves to separate exchange risks from on-chain irreversible settlements. The stolen coins did not return to the original address due to reorganization, and subsequent flows were tracked according to normal UTXO.

In market mechanics, what was sold was centralized custody for instant withdrawals, and what was bought was reserves hedging against hot wallet theft. Funds were supplemented to user liabilities from SAFU and company cash, rather than purchasing a historical rewrite from the entire network's hash power; beneficiaries were users holding coins who did not have to bear the risk of chain forks, while the pressured party was the exchange treating the hot wallet as the final settlement layer. The event was driven by governance choices after the theft, rather than a single-day price fluctuation.

Source: Public Information