TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Binance says it has allocated more than $6.34 billion in company resources to restore customer balances after an estimated $6.3 billion was stolen from its hot wallets. It says $3 billion in assets has been frozen by industry partners, while withdrawals remain paused during security checks. The exchange has not provided a detailed timeline for restoring withdrawals or recovering the frozen funds.
Binance says it has set aside more than $6.34 billion in company resources to restore customer balances after attackers stole an estimated $6.3 billion from its hot wallets, in what the exchange and source report describe as the largest cryptocurrency theft. The exchange said $5 billion is already held in the affected tokens and that it is acquiring the remaining amount, while withdrawals remain paused for security checks.
In an update shared with CoinDesk on October 30, Binance said the funds it allocated are intended to let it restore affected balances one-for-one using matching tokens. The company said it is purchasing the outstanding tokens through public markets and over-the-counter trades. It described the allocation as company resources, separate from assets frozen by other parties.
Binance said industry partners have frozen $3 billion in assets linked to the incident and that it is working with partners and law enforcement on recovery. The company said that figure is not included in its $6.34 billion allocation. It also said it would use company resources to cover any confirmed shortfall and make user funds verifiable through its Proof of Reserves. Those are statements from Binance; the report does not independently establish how much of the stolen property will ultimately be recovered.
The theft took place late Thursday, according to the report, and involved an estimated $6.3 billion across multiple blockchains. Assets including bitcoin, ether and the stablecoins USDT and USDC were taken in a burst reported to have lasted about 20 minutes. Binance initially pointed to a compromised DevOps engineer’s laptop that enabled unauthorized withdrawal requests through internal systems. It later said it had identified additional exploit points, but did not describe them. Binance said it had seen no evidence that wallet private keys were stolen.
Customer Balances and Withdrawals
The announced allocation is intended to reassure customers that their recorded balances will be restored without using or reducing other customer funds. That distinction matters because the theft is large enough to raise immediate questions about whether an exchange can meet withdrawal requests and maintain customer access while investigating a security incident. Binance says its resources are sufficient to cover the reported losses, but the announcement is not the same as a completed recovery or a public, independent verification of every balance.
For customers, the immediate practical effect is that deposits remain open but withdrawals are paused. Binance has said the pause is tied to security checks, rather than announcing a permanent suspension. The duration and scope of those checks affect when customers can access funds, and the exchange has not confirmed a firm reopening time in the update described by CoinDesk.
The incident also carries implications beyond Binance. The report says analysts at Chainalysis and TRM Labs linked the attack with high confidence to a North Korean hacking group. That attribution is an assessment by the firms, not a publicly established finding in the material provided. If correct, the scale and speed of the theft may add pressure on exchanges and other crypto businesses to coordinate monitoring and response, as well as strengthen controls over large or unusual withdrawals.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Nano X Bluetooth Crypto Wallet
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
How the Theft Unfolded
Binance’s account of the suspected entry point has developed since the initial report. The exchange first cited a compromised DevOps engineer’s laptop and unauthorized withdrawal requests routed through internal systems. It later referred to additional exploit points, without specifying what they were. It also said it had found no evidence that wallet private keys were taken. Those statements leave open how the attackers gained the access needed to initiate the withdrawals.
Blockchain analysts cited in the report described a rapid, automated movement of funds through many addresses. Chainalysis said it had observed laundering techniques it had not previously seen, including repeated transfers between addresses and a recurring pattern in which wallets received a small TRX transfer before moving larger sums. The firm’s description points to a method of complicating the transaction trail; it does not establish that the funds have become unrecoverable.
Binance also has a Secure Asset Fund for Users, or SAFU, an emergency reserve that the report says has typically held around $1 billion in bitcoin. The company’s stated $6.34 billion response is described as company resources, and the report does not specify how much, if any, of the announced amount comes from SAFU. The fund’s usual size is therefore background, not a breakdown of the current allocation.
“agentic money laundering”
— Aidan Larkin, co-founder and CEO of Asset Reality
Recovery and Security Details
Several key details have not been disclosed. Binance has not explained the additional exploit points it says it found, provided a full account of how the unauthorized withdrawals passed its controls, or published an independently verified breakdown of the affected balances and matching reserves. It has said it has no evidence that private keys were stolen, but the report does not include a technical investigation establishing the full extent of the compromise.
The $3 billion in frozen assets are not the same as recovered funds. The report says Binance is working with industry partners and law enforcement to recover them, but gives no timetable or final recovery amount. It is also unclear how quickly the exchange can acquire every remaining affected token, particularly tokens with limited trading liquidity. The report notes that the FUN token fell 90% early on October 30, but does not provide a comparison period or establish how that price movement relates to Binance’s purchases.
Attribution also remains qualified. Chainalysis and TRM Labs reportedly linked the attack to a North Korean group with high confidence, but the supplied report does not describe a public government finding or disclose the evidence behind that assessment. Binance has not stated when withdrawals will resume; the report says it had previously indicated a rough estimate of 45 to 48 hours.
Security Checks and Public Reserves
Binance says it is continuing security checks while keeping withdrawals paused and deposits open. The next immediate milestones are a decision on when withdrawals can resume, further details on the exploit and the publication of the promised Proof of Reserves information. The company has said it will issue updates as recovery work continues, but has not given a schedule for those disclosures.
Separately, Binance and its partners will continue efforts to trace and recover frozen assets. The amount ultimately returned, the time needed to acquire any remaining tokens and the treatment of smaller, less liquid assets have not been confirmed. Customers and other exchanges will be watching for verifiable details about the restoration of balances and the safeguards added before normal withdrawals restart.
The incident has also prompted calls for shared industry measures. OKX founder Star Xu proposed faster settlement for transfers between verified exchanges, extra checks and short delays for large transfers to unknown addresses or smart-contract approvals, and real-time alerts and joint monitoring. These are proposals, not announced industry-wide rules. The report says DefiLlama recorded 322 confirmed incidents in 2026 so far, with more than $8.7 billion in losses; that figure is a year-to-date count and total, not a comparison against a stated baseline.
Key Questions
How much did Binance say it set aside?
Binance said it allocated more than $6.34 billion in company resources to restore customer balances after the theft. It said $5 billion was already held in the affected tokens and that it was acquiring the remaining amount.
How much was stolen, and how much has been frozen?
The reported theft is estimated at $6.3 billion. Binance said industry partners had frozen $3 billion in assets; that amount is separate from the company’s allocation and is not yet described as fully recovered.
Can Binance customers withdraw funds now?
Withdrawals remain paused while Binance completes security checks, according to the report. Deposits remain open. The exchange has not confirmed a restart time, though it had previously given a rough estimate of 45 to 48 hours.
Who does Binance say carried out the attack?
The supplied report says analysts at Chainalysis and TRM Labs linked the attack with high confidence to a North Korean hacking group. That is an analyst attribution, not a confirmed public finding from a government authority in the material provided.
What remains unknown about the breach?
Binance has not detailed the additional exploit points it says it found or published a full technical account of how the withdrawals were authorized. The final amount of frozen funds that can be recovered, the completion date for matching reserves and the timing of resumed withdrawals also remain unclear.
Source: coindesk.com
