'Binance will cover all losses' — but what about Korean exchanges? [Crypto360]

Withdrawals resume three days after hack; reserve ratios above 100%

US lawmakers cite need for CLARITY Act; South Korea's basic crypto law still stalled

Regulator raised no-fault liability at first virtual asset committee meeting in March

Binance, the world's largest digital asset exchange, resumed withdrawals three days after suffering a hack that caused roughly 8 trillion won ($5.99 billion) in losses. The exchange has pledged to make customers whole, but the incident has thrust into the spotlight a question that has long lingered in the industry: when a large-scale theft occurs, who is responsible for user losses — and to what extent? In South Korea, regulators have discussed imposing no-fault liability on exchanges, yet the enactment of a basic digital asset law that would enshrine such a requirement remains stalled.

According to proof-of-reserve data Binance published on its official website Sunday, reserve ratios for 10 major digital assets — including Bitcoin (BTC), Ethereum (ETH), Tether (USDT) and XRP — all stood above 100 percent as of Saturday. Proof of reserve is a metric showing the ratio of assets an exchange actually holds against those it owes customers.

By asset, USDC posted the highest reserve ratio at 106.08 percent, followed by Zcash (ZEC) at 103.23 percent, Binance Coin (BNB) at 101.30 percent and XRP at 100.99 percent. Binance held approximately 692,489 Bitcoin, exceeding the net customer account balance of roughly 692,187 BTC. Ethereum reserves were also sufficient to cover the customer balance of about 3.65 million ETH.

Binance said it had replenished about 95 percent of the customer assets depleted by the hack using its own funds. To do so, it drew on its Secure Asset Fund for Users (SAFU) — an emergency reserve built up since 2018 by setting aside a portion of trading fees — as well as part of an insurance fund used to cover losses from futures liquidations.

How the hack unfolded: laptop breach to withdrawal system — The attack appears to have targeted vulnerabilities in the system that approves withdrawal transactions rather than the wallets storing digital assets directly. Under normal exchange operations, sending digital assets externally requires generating a withdrawal request, verifying that the recipient address and amount are correct, and then having a signing system grant final approval.

Kim Tae-il, chairman of the Digital Financial Crime Response Research Institute, said the withdrawal process follows a structure in which a transaction is created, a policy engine validates it, and a signing engine gives final approval. "If an attacker can access the withdrawal system, craft a desired transaction and pass only the policy engine, they can obtain a legitimate signature without ever directly obtaining the private key," Kim said.

According to Binance's preliminary investigation, the hackers breached the laptop of a DevOps engineer to gain access to internal services. Kim said the attackers "infiltrated internal services by hacking the laptop of an employee with access privileges rather than breaking directly into the system itself," and warned that employees managing core systems are increasingly being targeted. "Security for their work devices and access credentials also needs to be strengthened," Kim added.

There are also indications that EIP-7702 — an account delegation feature introduced through Ethereum's Pectra upgrade last May — may have been exploited in the attack. The feature allows a wallet owner to delegate authority to a specific smart contract, enabling that program to execute transactions on the wallet's behalf.

Tiger Research, in a report published Friday, said the hackers "bypassed withdrawal checks by inserting a delegation authorization into the signing system instead of a standard withdrawal request," then seized control of the hot wallet and drained 63 types of tokens — including Ethereum and Tether — in roughly three minutes. The firm warned that "no matter how carefully private keys are stored in cold wallets and multi-signature setups, a problem can arise if a single employee's device is compromised and the signing system fails to filter out fraudulent requests."

Withdrawals resume — but can Binance prevent a bank run? — Even if Binance fully compensates customer losses, the ripple effects on the decentralized finance (DeFi) market may not be so easily contained. According to Llama Risk, the risk management firm for DeFi lending platform Aave, the hackers used 60 million stolen USDT as collateral to borrow 19,762 wrapped Ethereum (WETH), worth roughly $44.6 million at the time. Aave temporarily restricted new deposits and loans to prevent further asset movement; those restrictions were lifted as of Saturday.

Markets also raised concerns that stolen assets used as DeFi loan collateral could generate bad debt — specifically, that a stablecoin issuer freezing those assets could prevent their liquidation and complicate debt recovery. Aave said, however, that as of Friday the collateral value backing the loan stood at $59.9 million, exceeding the outstanding debt of $43.8 million by about $16.1 million, and that existing depositors faced no direct risk.

Global market makers that trade on Binance were not entirely insulated from the fallout either. Evgeny Gaevoy, CEO of Wintermute, said on X (formerly Twitter) that the firm's exposure to Binance was "less than 20 percent of net equity," and assessed that Binance had the capacity to absorb losses "three to four times the size of the damage."

What happens after withdrawals resume is also a key concern. Binance said it planned to gradually restore withdrawal services for major digital assets — including Bitcoin, Ethereum and Solana — starting around 3 p.m. that day, and cautioned that processing delays could occur early on as users rushed to withdraw.

An Kwang-ho, a researcher at Tiger Research, said the bank-run risk at Binance was "the primary concern," but noted that the broader DeFi ecosystem posed a deeper threat. "Digital assets are interconnected across multiple DeFi services, so a cascading outflow of funds can occur," An said. The concern is not hypothetical: when KelpDAO was hacked in April, losses totaled $290 million, but as market anxiety spread, total DeFi deposits fell by $13.2 billion — about 45 times the hack amount — over two days.

Gopax, Probit, Bithumb hit in succession — Korean exchanges on alert — A string of hacking incidents at domestic exchanges has deepened user anxiety. Following breaches at Gopax and Probit last month, Bithumb also suffered a personal data leak after an unauthorized outsider accessed Daou Office, the company's internal mobile groupware system, exposing the resident registration numbers, account numbers and copies of identification documents of 844 customers. At Probit, attackers went further, stealing 100 million won in customer assets and forcing the exchange to suspend its service.

The incidents have prompted questions about how much protection users would receive if a Binance-scale hack hit a domestic exchange. Under the current Virtual Asset User Protection Act, exchanges and other service providers must take out insurance or set aside reserves sufficient to compensate at least 5 percent of the value of digital assets held in hot wallets against hacking and system failures. Won-market exchanges must secure a minimum compensation limit or reserve of 3 billion won, while coin-market exchanges must secure at least 500 million won.

Nor are domestic exchanges legally required to cover all losses. Article 9 of the Electronic Financial Transactions Act stipulates that financial companies and electronic financial service providers must in principle compensate users for damages caused by electronic financial incidents such as hacking, regardless of fault. Digital asset exchanges, however, fall outside the scope of that law, leaving liability obligations difficult to define clearly.

Experts said exchanges need to strengthen their security capabilities while regulators also need to overhaul their inspection methods. Hwang Seok-jin, a professor at Dongguk University's Graduate School of International Information Security, criticized a recent comprehensive security review that financial authorities conducted across the financial sector, saying "a document-based self-assessment covering 12 items has its limits."

Hwang said authorities should "select certain companies by sector and conduct direct on-site inspections, ensuring that corrective measures are taken when vulnerabilities are found." The professor also argued that an exchange's security competence "should be judged not by the absence of a hacking incident, but by how quickly it can detect an attack, contain the damage and protect customer assets."

US CLARITY Act back in focus — when will Korea's basic law arrive? — The wave of hacking incidents has intensified calls for legislation to shore up the digital asset market and user protection frameworks.

In the United States, the Binance hack has renewed attention on the CLARITY Act, a digital asset market structure bill. Republican Sen. Cynthia Lummis said Saturday that had the CLARITY Act been in place, it "would have provided legal protection for digital asset companies to freeze suspicious transactions immediately upon request from law enforcement," adding that "if even a minute is lost, the funds can be gone forever."

In South Korea, discussions on enacting a basic digital asset law have dragged on for nearly two years with little legislative progress. Financial authorities are drafting a government bill that would cover the issuance and distribution of digital assets and the regulation of service providers, but have yet to submit it to the National Assembly. The Financial Services Commission is pushing to submit the bill in time for deliberations by the National Assembly's Finance Committee legislation subcommittee this month.

Regulators had earlier considered incorporating no-fault liability for exchanges into the basic law. At the FSC's first virtual asset committee meeting in March, discussions included tightening internal controls and cybersecurity standards for exchanges, as well as imposing no-fault liability on operators when users suffer losses from hacking or other incidents. An FSC official told The Herald Business in June that the commission was "reviewing the introduction of no-fault liability" and would "also refer to provisions under the Electronic Financial Transactions Act."

Cha Sang-jin, an attorney at law firm Become, said the basic digital asset law "must be enacted as soon as possible" so that digital asset users can receive a level of protection comparable to what financial consumers enjoy under the Electronic Financial Transactions Act. "Without the basic law in place, there is inevitably a gap in user protection between the digital asset sector and the traditional financial sector," Cha said.

kyoung@heraldcorp.com