Key Takeaways
- • Binance said it has set aside more than $6.34 billion in company resources to restore customer balances after attackers drained an estimated $6.3 billion from its hot wallets, the largest crypto theft on record, according to a CoinDesk report.
- • Partners have frozen roughly $3 billion in stolen assets, separate from Binance's own reserves, and the exchange says it is working with partners and law enforcement to recover them.
- • Binance has paused withdrawals pending security checks while keeping deposits open, and said withdrawals could resume in roughly 45-48 hours.
- • Chainalysis and TRM Labs linked the attack with high confidence to North Korean hackers, citing unprecedented laundering techniques and automated scripts.
- • OKX founder Star Xu called for industry-wide security standards, friction on large withdrawals to unknown addresses, and faster cross-exchange freeze procedures, as DefiLlama counts 322 confirmed incidents in 2026 with over $8.7 billion in losses.
Summary
Binance said it has set aside more than $6.34 billion in company resources to restore customer balances after attackers drained an estimated $6.3 billion from its hot wallets across multiple blockchains late on Thursday, according to CoinDesk. The exchange said $5 billion of its reserve is already held in the affected token assets, and it is buying the remaining amount through public markets and over-the-counter trades so that reserves match losses exactly. Binance said user funds will not be altered or taken, and that all user balances will be verified publicly through its Proof of Reserves.
The exchange said partners have frozen $3 billion in stolen assets, which it treats separately from its own reserves and does not include in its reserve figures. A company spokesperson said Binance is working with partners and law enforcement to recover the frozen assets and will continue to use company resources to cover confirmed shortfalls. The company also referenced its Secure Asset Fund for Users (SAFU), an emergency reserve that has typically held around $1 billion in bitcoin.
According to the report, most of the stolen coins, including bitcoin, ether, and the stablecoins USDT and USDC, left the hot wallets in a burst lasting about 20 minutes. Binance first attributed the breach to a compromised DevOps engineer's laptop that enabled unauthorized withdrawal requests, then said it had found additional exploit points, while stating it has seen no evidence that wallet private keys were stolen. It did not provide details on the additional vectors. Blockchain analysts at Chainalysis and TRM Labs linked the attack with high confidence to North Korean hackers. Chainalysis said it has observed laundering techniques it had never seen before, including thousands of rapid transactions and repeated circulation of coins among addresses. Asset Reality co-founder and CEO Aidan Larkin described the approach as "agentic money laundering."
Binance has kept deposits open and paused withdrawals during security checks. Recovery of frozen assets and top-ups for any residual shortfalls could take time, particularly for thinly traded tokens; the FUN token fell 90% early on the day of reporting. Broader industry discussion has intensified, with DefiLlama recording 322 confirmed incidents in 2026 totaling more than $8.7 billion in losses. OKX founder Star Xu urged executives to coordinate on security standards, proposing instant settlement between verified exchanges, extra checks on large withdrawals to unknown addresses, real-time incident alerts, and faster lawful freezes involving exchanges and stablecoin issuers.
The exchange said partners have frozen $3 billion in stolen assets, which it treats separately from its own reserves and does not include in its reserve figures. A company spokesperson said Binance is working with partners and law enforcement to recover the frozen assets and will continue to use company resources to cover confirmed shortfalls. The company also referenced its Secure Asset Fund for Users (SAFU), an emergency reserve that has typically held around $1 billion in bitcoin.
According to the report, most of the stolen coins, including bitcoin, ether, and the stablecoins USDT and USDC, left the hot wallets in a burst lasting about 20 minutes. Binance first attributed the breach to a compromised DevOps engineer's laptop that enabled unauthorized withdrawal requests, then said it had found additional exploit points, while stating it has seen no evidence that wallet private keys were stolen. It did not provide details on the additional vectors. Blockchain analysts at Chainalysis and TRM Labs linked the attack with high confidence to North Korean hackers. Chainalysis said it has observed laundering techniques it had never seen before, including thousands of rapid transactions and repeated circulation of coins among addresses. Asset Reality co-founder and CEO Aidan Larkin described the approach as "agentic money laundering."
Binance has kept deposits open and paused withdrawals during security checks. Recovery of frozen assets and top-ups for any residual shortfalls could take time, particularly for thinly traded tokens; the FUN token fell 90% early on the day of reporting. Broader industry discussion has intensified, with DefiLlama recording 322 confirmed incidents in 2026 totaling more than $8.7 billion in losses. OKX founder Star Xu urged executives to coordinate on security standards, proposing instant settlement between verified exchanges, extra checks on large withdrawals to unknown addresses, real-time incident alerts, and faster lawful freezes involving exchanges and stablecoin issuers.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.