BINANCE SETS ASIDE $6.34BILLION TO COVER LOSSES FROM MASSIVE HACK, BEGINS RECOVERING AFFECTED USER FUNDS
Global cryptocurrency exchange Binance has announced that it has committed more than $6.34 billion in company funds and reserves to cover losses resulting from a major security breach that reportedly affected approximately $6.3 billion in digital assets.
The development comes after attackers reportedly carried out unauthorised withdrawals from Binance wallets in what analysts have described as one of the largest cryptocurrency thefts ever recorded.
In an update on Friday, October 30, 2026, the exchange said it had already secured approximately $5 billion of the affected digital assets and was working to acquire the remaining amount to ensure that customers whose funds were affected would be fully compensated.
Binance explained that the $6.34 billion allocation includes funds held in the same digital assets involved in the incident. The company is purchasing the remaining tokens through cryptocurrency markets and over-the-counter transactions, although it warned that completing the process could take time because of liquidity constraints and settlement delays.
The company said the financial provision was separate from approximately $3 billion worth of affected assets that it had worked with industry partners to freeze. The frozen assets were reportedly secured through cooperation with cryptocurrency companies, stablecoin issuers and blockchain intelligence firms.
Among the companies involved in the recovery effort were Tether and Circle, which reportedly froze substantial amounts of USDT and USDC linked to the incident. Other industry participants, including Ripple and World Liberty Financial, also contributed to efforts to restrict the movement of suspected stolen assets.
Binance said the affected funds would be covered through its Secure Asset Fund for Users (SAFU) and additional company resources. The exchange maintained that customers would not be required to bear the financial losses resulting from the breach.
The security incident reportedly involved unauthorised transactions across multiple blockchain networks. Blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was moved from Binance wallets across 10 blockchains, with most of the transfers taking place within about 20 minutes.
Initial findings by Binance suggested that attackers may have gained access to an internal system through a compromised laptop belonging to a DevOps engineer. The access reportedly enabled the attackers to interact with a service container used to process withdrawal transactions.
However, the exchange later disclosed that its investigation had uncovered additional points of breach, indicating that the incident was more complex than initially suspected.
Binance also stated that it had found no evidence that wallet private keys were leaked. The company said its security team was investigating the full attack path and working with law enforcement agencies and blockchain intelligence partners to identify those responsible.
The breach forced Binance to temporarily suspend withdrawals while it carried out security checks and reviewed the affected systems. Deposits, however, were reported to be operating normally, while withdrawals were expected to resume after the security review, with the company indicating a timeframe of approximately 45 to 48 hours.
The exchange also temporarily suspended some Binance Alpha trading activities as part of its precautionary response. It said the measures were intended to protect customers and prevent further unauthorised transactions while the investigation continued.
Blockchain intelligence firms TRM Labs and Chainalysis have separately linked the attack with North Korea’s TraderTraitor hacking group, expressing high confidence in their assessments. The group has previously been associated with major cryptocurrency thefts, including the $1.5 billion Bybit breach in 2025.
However, Binance has not officially confirmed the identity of the attackers, saying it is cooperating with law enforcement partners to establish who was responsible.
The incident has renewed concerns about cybersecurity risks facing centralised cryptocurrency exchanges, which hold large amounts of digital assets and process transactions across several blockchain networks.
Industry experts have also raised questions about internal security controls, particularly the authorisation systems used to approve large withdrawals. The speed at which the attackers reportedly moved the assets has intensified discussions about the need for stronger verification procedures and additional safeguards against compromised employee devices.
Binance’s response has included efforts to trace the stolen funds, freeze assets where possible, strengthen withdrawal security and prepare an updated Proof of Reserves report. The company said it would publish a detailed technical post-mortem after its investigation and recovery efforts had progressed sufficiently.
The exchange’s founder and former chief executive, Changpeng Zhao, also commented on the incident, expressing confidence that customer funds would be protected. Zhao, who stepped down as chief executive in 2023, said he expected the company to cover the affected users’ losses.
The scale of the breach and the amount Binance has committed to covering the losses have placed the incident at the centre of renewed discussions about trust, accountability and financial protection in the global cryptocurrency industry.
Although the freezing of approximately $3 billion represents a significant recovery effort, questions remain about the whereabouts of the remaining affected assets and how much of the stolen cryptocurrency can ultimately be recovered.
Binance said it would continue working with relevant authorities, blockchain security companies and other industry partners to trace the funds and restore affected customer balances. It also promised to provide further updates as its investigation progresses.
Street News Reporters will continue to monitor developments surrounding the Binance security breach, including the recovery of affected assets, the resumption of withdrawals, the identification of those responsible and the measures being introduced to strengthen the exchange’s security systems.
