ABX

Update on the Binance hot wallet exploit and RSR: The stolen RSR has been sold, Reserve’s contracts were not affected, and RSR holders don’t need to do anything. If you held RSR on Binance, follow @binance’s updates. They’ve said “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.” We take this to indicate they intend to re-purchase all assets lost in the exploit, including 3.38B RSR, to make their users whole. However, we have not been briefed on the specifics of how Binance intends to cover losses and have not done any of our own financial analysis of Binance’s ability to absorb this loss. The attacker took 3.38B RSR from Binance. Between 8:53 and 9:08 PM ET on Oct 29, they swapped all of it on Uniswap v3 for 1,856 ETH ($4.1M). As far as we can see onchain, they no longer hold any RSR, though it remains possible that the onchain swaps included wash trades with obscured attacker-funded wallets. See: etherscan.io/token/0x320623b… Before the sale, we pulled Reserve treasury-provided onchain liquidity so it couldn’t serve as the attacker’s exit. It appears that arbitrage bots and other traders bought the RSR instead. RSR is immutable with no admin keys, so no one, including us, can freeze it. The RSR token and Reserve protocol contracts were not affected. Since the attacker apparently no longer holds RSR, we believe it can’t be used in bulk against Reserve DTF governance. We are continuing to monitor the situation for any potential cascading effects of so many tokens being stolen and sold at once. For now we do not see any cause for pausing any Reserve products, so everything remains in normal operation.