Binance hack: no direct impact on the Hodl funds

Last night, Binance, the largest crypto exchange in the world, was hit by a hack. It is the largest theft in the history of the crypto market. Below we explain what happened and what this does and does not mean for investors in the Hodl funds.

What happened?

The investigation is still ongoing. Binance initially pointed to the compromised laptop of an employee as the entry point. In a later update, the exchange said its investigation has uncovered additional points of breach and described it as a complex attack. Through this access, the attacker was able to make withdrawals from the exchange's so-called hot wallets: the wallets that are connected to the internet and used for day-to-day deposits and withdrawals. Within roughly twenty minutes, bitcoin, ether, stablecoins and other tokens were moved out across more than ten blockchains. Binance has not yet published exactly how the attack unfolded. Blockchain analytics firms such as TRM Labs and Chainalysis point to a North Korean hacking group, the same group the FBI linked to the Bybit hack in February 2025. Binance itself has not attributed the attack to anyone yet.

How much was stolen?

Binance estimates the damage at around 6.3 billion dollars. Most of it consists of ether (more than 200,000 ETH), bitcoin (more than 18,000 BTC) and the stablecoins USDT and USDC. For an exchange holding an estimated 144 billion dollars in assets, this is a large but manageable loss.

What has been recovered?

A significant part was frozen almost immediately. Stablecoin issuers Tether and Circle blocked the stolen USDT and USDC on the blockchain within an hour of the theft. Ripple and World Liberty Financial followed with their own stablecoins, and part of the stolen funds was also recovered on the Arbitrum network. In total, around 3 billion dollars is now frozen and out of the hackers' reach. The remainder, mainly bitcoin and ether, is still in the hands of the attackers.

Binance will compensate all losses

Binance has stated that it will fully cover all losses from its emergency fund (SAFU) and its own reserves. Customers of the exchange will not suffer any losses. As a precaution, Binance has temporarily paused withdrawals while it overhauls the security of its withdrawal systems. The exchange expects to resume withdrawals within about two days.

A hack of an exchange, not of the blockchain

It is important to make a clear distinction here. This was a break-in at a centralized company that holds crypto on behalf of its customers, comparable to a bank being hacked or robbed. The blockchains themselves, such as Bitcoin and Ethereum, worked exactly as intended. In fact, the transparency of the blockchain made it possible to trace the flow of funds in real time and freeze a large part of them.

A broader trend

Recently we have seen a sharp increase in hacks, also well outside the crypto market. Vulnerabilities are being found faster, partly due to new technology such as AI, and malicious actors are exploiting them faster as well. Examples include the large data breach at Dutch telecom provider Odido earlier this year, the recent cyberattack on Dutch supermarket chain Albert Heijn, and the vulnerabilities in the programming language PHP that the European cybersecurity agency warned about this month.

What does this mean for the Hodl funds?

This hack has no direct impact on the Hodl funds. We do not hold our investments on Binance or on any other exchange; they are kept in (offline) cold storage, out of reach of attacks like this one. The only effect is indirect, through market prices: following the news, bitcoin and ether fell by around 5 percent. Market reactions to incidents like this are usually short-lived, but we are monitoring the market closely.

Do you also invest in crypto directly?

Stay alert and preferably keep your crypto in cold storage, such as a hardware wallet, rather than on an exchange for the long term. Never store important data such as your recovery phrase digitally (no photo, cloud or notes app); write it down on paper and keep it in a safe place. Also be extra alert to phishing: after a major incident like this, scammers often pose as an exchange or a support desk.

Do you have any questions? Feel free to contact us.