Binance reserves $6.34 billion to cover losses from major hack

Binance said on Friday it has set aside $6.34 billion of its own funds and reserves to cover losses from a security breach of the crypto exchange, a platform where people trade digital assets. The exchange was hacked on Thursday and estimates its loss at about $6.3 billion. Investigations and recovery efforts with law enforcement are ongoing.

According to Binance, about $5 billion of the reserved amount is already held in the same digital assets that were affected. The remaining roughly $1.3 billion is being bought through market and over-the-counter channels. The exchange cautioned this process could take longer due to thin liquidity and settlement delays.

Key points

• Binance has committed $6.34 billion in company funds to cover hack losses.
• About $5 billion is held in the affected tokens; the remaining $1.3 billion is being purchased.
• Industry partners have frozen approximately $3 billion in related assets, which is not part of the reserve.
• Binance co-CEO Richard Teng said a compromised DevOps engineer's laptop led to the attack, not a leaked wallet private key.
• Withdrawals are suspended, but users can still deposit assets.

What Binance's statement says

Binance did not specify which tokens were affected. Earlier, the security firm Blockaid said it was investigating billions in outflows from Binance hot wallets — wallets connected to the internet used for daily transactions — across Ethereum, Arbitrum, and Avalanche.

Co-CEO Richard Teng said the initial investigation points to a compromised DevOps engineer's laptop. He said this gave an attacker access to a service container used to submit unauthorized withdrawal transactions. Teng noted the incident involved a more complex process than simply exploiting one employee's permissions, and Binance has found no evidence of a wallet private key leak.

"Your money is safe, and we're covering every loss," Teng wrote.

Partners freeze about $3 billion

Binance said the reserve does not include roughly $3 billion in assets that industry partners have frozen.

Tether CEO Paolo Ardoino said separately that the stablecoin company — Tether issues USDT, a digital token pegged to the US dollar — froze over $1.57 billion in USDT. Circle confirmed more than $800 million in USDC, another dollar-pegged stablecoin, had been frozen.

Ripple "promptly" froze roughly $200 million in associated funds, according to co-CEO Yi He. World Liberty Financial said in an X post that it worked with BitGo and other partners to freeze about $27 million in stablecoins and $2 million in its own tokens.

Links to North Korean hackers not confirmed

Blockchain intelligence firm TRM Labs said several elements of the attack resemble previous incidents linked to North Korean hackers, including last year's $1.5 billion Bybit breach. Binance has not attributed the incident to any particular group, so this remains a reported observation rather than a confirmed finding.

TD Cowen said the breach exposed risks in exchange custody and cybersecurity, but did not undermine the underlying utility of digital assets or blockchain networks. This is the firm's assessment, not a confirmed fact.

What is confirmed

• Binance committed $6.34 billion in company funds and reserves to cover the losses.
• About $5 billion is held in affected tokens; roughly $1.3 billion is being bought.
• The exchange was hacked on Thursday and pegged its loss at $6.3 billion.
• Withdrawals are suspended; deposits remain open.
• Frozen assets reported by partners include over $1.57 billion in USDT (Tether), over $800 million in USDC (Circle), about $200 million (Ripple), and about $29 million combined (World Liberty Financial with partners).

What is still unclear

• Binance has not named the affected tokens.
• No group has been attributed to the attack; TRM Labs' comparison to North Korean-linked incidents is not confirmed by Binance.
• The purchase of the remaining $1.3 billion in tokens could take longer due to thin liquidity and settlement delays.

Why this matters

Binance is one of the largest crypto exchanges, and a breach of this size affects users who hold assets on the platform. The exchange says users' funds are covered and deposits remain open, but withdrawals are paused while investigations continue. The freeze of roughly $3 billion by partners such as Tether and Circle shows how stablecoin issuers can block movement of stolen funds.

What happens next

Binance says investigations and recovery efforts are ongoing alongside law enforcement. The exchange will continue buying the remaining tokens, though it warned this could take longer than expected. Withdrawals remain suspended for now.

Sources

• The Block

Read also: Binance Investigates Possible Hack as Suspicious Outflows Reach Billions