Binance has filed a constitutional proposal on the Arbitrum governance forum asking token holders to release approximately 8,426 ETH and 74.6 million ARB to a recovery address controlled by the exchange. The assets were frozen on Arbitrum after the October 29 attack on the company's internet-connected hot wallets.

Posted on November 5, the proposal is expected to take around 49 days, though Binance cautioned the timeline could stretch if legal action against the assets must be resolved first. Nothing has been approved yet. Under the exchange's proposed schedule, the next step is a non-binding temperature check vote on Snapshot, the off-chain voting platform, following one week of forum discussion.

A Small Slice of a $6.3 Billion Theft

The coins were stolen in the October 29 attack on Binance's hot wallets, a breach the exchange has put at roughly $6.3 billion — the largest crypto theft on record. Two days later, the FBI attributed the hack to North Korea and named TraderTraitor, the group it also blamed for the $1.5 billion Bybit hack.

Arbitrum's Security Council moved within hours. At 8:08 a.m. Hong Kong time on October 30 — roughly four hours after Binance says the outflows began — the council transferred the attacker's Arbitrum holdings to a holding address that only an ArbitrumDAO vote can unlock, according to its emergency action disclosure. Coindoo previously reported on how the council immobilized the hacker's crypto without ever holding its private key. The frozen haul was worth about $30 million at the time, less than half a percent of Binance's estimated loss.

Binance Has Already Bought Back the Coins

Binance's customers are not waiting on that vote. In its November 4 recovery update, the exchange said it had set aside more than 100% of the required funds from its own resources. About 98% of the stolen amount had already been replenished through purchases on markets and over-the-counter channels, with the remaining 2% consisting of less liquid tokens that are taking longer to acquire.

That changes what the frozen ETH and ARB are actually for. The proposal's abstract says the released funds would help make affected users whole, but its "Use of Funds" section is more precise: where Binance has already covered users' losses, it may step into those users' rights over the stolen assets. The returned coins would then go toward the incident's losses and costs, including refilling the SAFU fund — the exchange's emergency insurance reserve — or the treasury reserves Binance drew on. With nearly the entire stolen amount already replaced from company money, a successful release would in practice largely reimburse Binance for an outlay it has already made.

Why Replacing Coins Beats Replacing Dollars

Binance chose to buy back tokens rather than credit customers in cash, and that decision put the price risk on its own books. Customer balances are owed in coins, and a reserve fixed at theft-time dollar values only closes the gap if prices stand still while the exchange rebuys.

A hypothetical shows how large that exposure can be. If ETH rose 20% between the theft and the repurchase, a sum fixed at the original value would buy back only about 83% of the missing coins. A 20% fall would work in reverse and leave a surplus.

The frozen assets would return in kind — the same 8,426 ETH and 74.6 million ARB, at whatever dollar value applies on the day of delivery. Until then, Binance carries the market risk on that slice. When the coins arrive depends on two separate clocks: Arbitrum's governance calendar and the courts.

Where the 49 Days Come From

The governance clock is set by Arbitrum's DAO constitution. Binance's estimate follows the full lifecycle of a constitutional proposal — the same sequence the Kelp DAO release proposal laid out stage by stage in April.

Binance kept both optional early stages, which the constitution recommends but does not require. Dropping them would still leave a minimum of about 35 days, because the on-chain vote and the waiting periods after it cannot be skipped. Delegate dzack23 made that calculation when token holders pushed to accelerate the Kelp release. The same delegate argued that using the council's emergency powers to speed up a refund would breach the constitution, since a slow recovery is not a security emergency.

April's Kelp Release Shows Where Delays Come From

The Kelp case is also the clearest guide to the second clock. After the April 18 Kelp DAO bridge exploit, the council froze about 30,766 ETH, and Aave Labs led a proposal to route the funds into a recovery effort for affected holders of rsETH, Kelp's liquid restaking token. While delegates were still debating, lawyers for families holding unpaid terrorism judgments against North Korea served Arbitrum DAO with a New York restraining notice through the forum on May 1. They argued that the ETH counted as North Korean property because LayerZero had attributed the hack to the Lazarus Group, the North Korea-linked hacking unit.

Delegates approved the release with roughly 91% of voting power, and on May 9 a Manhattan federal judge modified the notice so the ETH could move to Aave, The Block reported. The compromise came at a cost: Aave agreed to be bound by the notice as if it had been served directly, the creditors' claims followed the coins, and the court reserved decision on the remaining questions. Aave had argued that a thief does not gain ownership of property simply by taking it.

Binance arrives with a firmer version of the same premise. In April, the North Korea link rested on a protocol's attribution; this time it comes from the FBI. No restraining notice had been posted in the Binance thread at the time of writing. Its only reply, from delegate Zeptimus, called returning the funds to their owner "the right thing to do."

Binance Has Written April's Compromise Into Its Terms

The proposal reads as if it was drafted with that dispute in view. It notes that third parties have previously claimed assets frozen on Arbitrum One on the theory that they belong to whoever is blamed for an exploit. Binance represents that the frozen coins trace back to assets taken from wallets it owned or controlled, and that, to its knowledge, no one else has an interest in them. In case a court sees it differently, Binance accepts these conditions in advance:

• The proposal stays off-chain and no coins are delivered while any restraining notice or court order remains in effect, unless a court modifies or lifts it. Binance pays to seek that relief.
• Binance treats any such legal process as if it had been served on Binance directly.
• Delivered coins stay at the recovery address, unmoved and unmixed with other funds, until the process ends.
• Binance defends any claim at its own cost and turns the assets, or their value, over to whoever a court finally rules is entitled to them.

The first condition means delegates would not be asked to execute a transfer while a notice is live — the position Arbitrum found itself in during April. The second copies the term Aave accepted to get its release through court. Here, Binance accepts it before anyone has filed.

Who Covers Arbitrum if the Release Is Challenged

The other half of the legal package protects Arbitrum's side of the transaction. Binance's Abu Dhabi Global Market entities, led by Nest Exchange Limited, would indemnify the Arbitrum Foundation, Offchain Labs and every Security Council member against claims tied to the freeze and the release. The indemnity has no cap and is governed by New York law. Binance must sign the agreements before the proposal goes on-chain, whereas Aave's April version was due only after the vote passed.

Binance's indemnity also reaches further than Aave's. It covers any delay in or refusal to deliver the coins, and any compliance with a court order, including a transfer of the frozen assets to someone other than Binance. Binance would therefore pay Arbitrum's legal costs even in the scenario where a court sends the coins elsewhere.

Delegates who vote get thinner cover. As in April, they are protected only indirectly: Binance would reimburse the Foundation for payouts to delegates from Arbitrum's captive insurance product, which covers claims arising from participation in DAO governance. Delegates objected to that structure during the Kelp debate. One of them, TodayInDeFi, noted that delegate protection was bounded by the product's $10 million aggregate limit, with no fallback if it did not pay. Binance's proposal leaves that arrangement unchanged.

What Decides Who Ends Up Paying

Three signals mark the path from here. The first is the Snapshot temperature check, which on Binance's schedule follows one week of forum discussion. The second is any restraining notice or court filing aimed at the frozen ETH and ARB, which under Binance's own terms would halt the on-chain step until a judge acts. The third is whether delegates again press for direct indemnification before an on-chain vote.

The question of who pays is already mostly settled. Binance has covered the theft from company funds. These frozen coins decide how much of that cost it recovers from this one source — and a court, rather than the DAO, could still have the final word on where they go.

Source: Coindoo