Crypto Hack Recovery Has a Problem Bigger Than Stolen Keys

Key Takeaways

• Binance seeks 8,426 ETH and 74.6M ARB.
• Frozen coins: under 1% of $6.3B stolen.
• Binance reports 98% of stolen assets replenished.
• April’s Kelp release drew a court restraining notice.

In a constitutional proposal posted on the Arbitrum governance forum on November 5, Binance asks token holders to release about 8,426 ETH and 74.6 million ARB to its recovery address. The exchange expects the process to take around 49 days and warns it could run longer if legal action against the assets has to be resolved first. Nothing has been approved yet. The next step on Binance’s schedule is a Snapshot temperature check after a week of forum discussion.

A Small Slice of a $6.3 Billion Theft

The coins come from the October 29 attack on Binance’s hot wallets, which the exchange put at roughly $6.3 billion, the largest crypto theft on record. Two days later, the FBI attributed the theft to North Korea and named TraderTraitor, the group it also blamed for the $1.5 billion Bybit hack.

Arbitrum’s Security Council acted at 8:08 a.m. Hong Kong time on October 30, roughly four hours after Binance says the outflows began. According to its emergency action disclosure, the council moved the attacker’s Arbitrum holdings to a holding address that only an ArbitrumDAO vote can unlock. Coindoo has covered how the council moved the hacker’s crypto without its private key. Valued at about $30 million at the time, the haul amounts to less than half a percent of Binance’s estimated loss.

Binance Has Already Bought Back the Coins

Binance’s customers are not waiting on that vote. In its November 4 recovery update, the exchange said it had set aside more than 100% of the funds needed from its own resources. It had already replenished about 98% of the stolen amount by buying tokens through market and OTC channels, with the remaining 2% made up of less liquid tokens that are taking longer to acquire.

That changes what the frozen ETH and ARB are for. The proposal’s abstract says the released funds would help make affected users whole, but its “Use of Funds” section is more precise. Where Binance has covered users’ losses, it may step into those users’ rights over the stolen assets. The returned coins would then go toward the incident’s losses and costs, including refilling the SAFU fund or treasury reserves Binance drew on. With nearly all of the stolen amount already replaced from company money, a successful release would in practice largely reimburse Binance for an outlay it has already made.

Why Replacing Coins Beats Replacing Dollars

By buying back tokens instead of crediting customers with cash, Binance took the price risk onto its own books. Customer balances are owed in coins. A reserve fixed at theft-time dollar values only closes that gap if prices hold still while the exchange rebuys.

A hypothetical shows the size of that risk. If ETH rose 20% between the theft and the repurchase, a sum fixed at the original value would buy back only about 83% of the missing coins. A 20% fall would work the other way and leave a surplus.

The frozen assets would come back in kind: the same 8,426 ETH and 74.6 million ARB, whatever their dollar value on delivery. Until then, Binance carries the market risk on that slice. When it arrives depends on two separate clocks, Arbitrum’s governance calendar and the courts.

Where the 49 Days Come From

The governance clock is set by Arbitrum’s DAO constitution. Binance’s estimate follows the full lifecycle for a constitutional proposal, the same sequence the Kelp DAO release proposal laid out stage by stage in April.

From forum post to delivery

Forum discussion (optional)7 days Snapshot temperature check (optional)7 days Delay before on-chain voting opens3 days On-chain vote14 days Arbitrum waiting period8 days Arbitrum-to-Ethereum message finalizationAbout 7 days Ethereum waiting period3 days Estimated totalAbout 49 days

Binance kept both optional early stages, which the constitution recommends but does not require. Dropping them would still leave a minimum of about 35 days, because the on-chain vote and the waiting periods after it cannot be skipped. Delegate dzack23 made that calculation when token holders pushed to accelerate the Kelp release. The same delegate argued that using the council’s emergency powers to speed up a refund would breach the constitution, since a slow recovery is not a security emergency.

April’s Kelp Release Shows Where Delays Come From

The Kelp case is also the clearest guide to the second clock. After the April 18 Kelp DAO bridge exploit, the council froze about 30,766 ETH, and Aave Labs led a proposal to route it into a recovery effort for affected rsETH holders. While delegates were still debating, lawyers for families holding unpaid terrorism judgments against North Korea served Arbitrum DAO with a New York restraining notice through the forum on May 1. They argued that the ETH counted as North Korean property because LayerZero had attributed the hack to the Lazarus Group.

Delegates approved the release with roughly 91% of voting power, and on May 9 a Manhattan federal judge modified the notice so the ETH could move to Aave, The Block reported. The price of that compromise was that Aave agreed to be bound by the notice as if it had been served directly. The creditors’ claims followed the coins, and the court reserved decision on the remaining questions. Aave had argued that a thief does not gain ownership of property simply by taking it.

Binance arrives with a firmer version of the same premise. In April, the North Korea link rested on a protocol’s attribution. This time it comes from the FBI. No restraining notice had been posted in the Binance thread at the time of writing. Its only reply, from delegate Zeptimus, called returning the funds to their owner “the right thing to do.”

Zcash Upgrade Locks Sprout Coins Even With the Right Keys

Binance Has Written April’s Compromise Into Its Terms

The proposal reads as if it was drafted with that dispute in view. It notes that third parties have previously claimed assets frozen on Arbitrum One on the theory that they belong to whoever is blamed for an exploit. Binance represents that the frozen coins trace back to assets taken from wallets it owned or controlled, and that, to its knowledge, no one else has an interest in them. In case a court sees it differently, Binance accepts these conditions in advance:

If a court gets involved

• The proposal stays off-chain, and no coins are delivered, while any restraining notice or court order is in effect, unless a court modifies or lifts it. Binance pays to seek that.
• Binance treats any such legal process as if it had been served on Binance directly.
• Delivered coins stay at the recovery address, unmoved and unmixed with other funds, until the process ends.
• Binance defends any claim at its own cost and turns the assets, or their value, over to whoever a court finally rules is entitled to them.

The first condition means delegates would not be asked to execute a transfer while a notice is live, the position Arbitrum found itself in during April. The second copies the term Aave accepted to get its release through court. Here, Binance accepts it before anyone has filed.

Who Covers Arbitrum If the Release Is Challenged

The other half of the legal package protects Arbitrum’s side of the transaction. Binance’s Abu Dhabi Global Market entities, led by Nest Exchange Limited, would indemnify the Arbitrum Foundation, Offchain Labs and every Security Council member against claims tied to the freeze and the release. The indemnity has no cap and is governed by New York law. Binance must sign the agreements before the proposal goes on-chain, whereas Aave’s April version was due only after the vote passed.

Binance’s indemnity also reaches further than Aave’s. It covers any delay in or refusal to deliver the coins, and any compliance with a court order, including a transfer of the frozen assets to someone other than Binance. Binance would therefore pay Arbitrum’s legal costs even in the scenario where a court sends the coins elsewhere.

Delegates who vote get thinner cover. As in April, they are protected only indirectly: Binance would reimburse the Foundation for payouts to delegates from Arbitrum’s captive insurance product, which covers claims arising from participation in DAO governance. Delegates objected to that structure during the Kelp debate. One of them, TodayInDeFi, noted that delegate protection was bounded by the product’s $10 million aggregate limit, with no fallback if it did not pay. Binance’s proposal leaves that arrangement unchanged.

What Decides Who Ends Up Paying

Three signals mark the path from here. The first is the Snapshot temperature check, which on Binance’s schedule follows one week of forum discussion. The second is any restraining notice or court filing aimed at the frozen ETH and ARB, which under Binance’s own terms would halt the on-chain step until a judge acts. The third is whether delegates again press for direct indemnification before an on-chain vote.

The question of who pays is already mostly settled. Binance has covered the theft from company funds. These frozen coins decide how much of that cost it recovers from this one source, and a court, rather than the DAO, could still have the final word on where they go.