Binance says it has committed more than $6.34 billion in company funds and reserves to cover losses from a security breach disclosed this week, after estimating that attackers stole roughly $6.3 billion in digital assets. The exchange has suspended withdrawals while it investigates the incident, pursues asset recovery with law enforcement, and seeks to rebuild holdings in affected tokens.
The commitment places Binance's immediate response among the largest emergency balance-sheet actions publicly described by a cryptocurrency company after a hack. Binance said it already holds about $5 billion of the pledged amount in the same types of digital assets that were taken and is buying the remaining approximately $1.3 billion through market transactions and over-the-counter arrangements.
Richard Teng, co-CEO of Binance, said the exchange's early investigation found that an attacker compromised a DevOps engineer's laptop and gained access to a service container used to submit unauthorized withdrawal transactions. A DevOps, or development operations, employee typically works on systems that connect software development with production infrastructure.
Teng said Binance had found no evidence that private keys controlling its wallets were leaked. That distinction suggests the preliminary investigation is focused on systems used to authorize or transmit withdrawal activity rather than a direct compromise of the cryptographic credentials securing wallet funds.
Withdrawals paused as token purchases begin
Binance said withdrawals are temporarily unavailable, although users can continue depositing assets. The exchange did not say when withdrawals would reopen or identify the digital assets involved in the theft.
Its recovery plan depends partly on purchasing tokens whose available trading supply may be limited. Binance said the roughly $1.3 billion acquisition process could take longer than expected because of thin liquidity and settlement delays.
Purchasing large positions through over-the-counter desks could reduce the exchange's reliance on visible public order books, where a concentrated buying program can move prices quickly. Yet even private transactions require sellers willing to part with the specific assets involved, particularly if stolen funds span less liquid tokens or multiple blockchain networks.
Blockaid, a blockchain security firm, said it was reviewing billions of dollars in outflows from Binance hot wallets on Ethereum, Arbitrum, and Avalanche. Hot wallets are internet-connected wallets used to process routine deposits and withdrawals, making them operationally useful but exposed to a different set of risks than offline storage.
Binance has not publicly named the tokens affected or given a network-by-network loss breakdown. Those details will shape the practical difficulty of replacing the assets, since liquidity, settlement speed, and the ability to freeze stolen balances vary substantially between stablecoins and other cryptocurrency holdings.
More than $3 billion has been frozen
Binance said its $6.34 billion commitment excludes roughly $3 billion in assets frozen by industry partners. Freezes could prevent attackers from moving some stolen funds, though frozen assets would remain subject to legal, technical, and ownership processes before they could be recovered or returned.
Paolo Ardoino, chief executive officer of Tether, said the stablecoin issuer froze more than $1.57 billion in USDT connected to the incident. Circle said it froze more than $800 million in USDC.
Yi He, co-CEO of Binance, said Ripple froze roughly $200 million in related funds. World Liberty Financial said it worked with BitGo and other partners to freeze about $27 million in stablecoins and approximately $2 million of its own tokens.
The scale of the reported freezes illustrates the influence that issuers retain over centrally administered stablecoins. While transfers can occur on public blockchains, issuers may blacklist or freeze addresses under the controls built into their token contracts. That feature can limit an attacker's ability to convert stolen stablecoins, but it does not automatically reverse a transaction or resolve claims over the funds.
Investigation examines North Korea-linked patterns
TRM Labs said several elements of the Binance incident resemble previous attacks associated with North Korean hacking groups. The blockchain intelligence firm pointed to similarities with the theft of about $1.5 billion from Bybit last year.
Binance has not attributed the breach to a specific group. The absence of a formal attribution is material: technical indicators, laundering routes, and operational methods can point investigators toward known threat actors, but public attribution generally requires a higher evidentiary threshold.
North Korea-linked groups have repeatedly targeted cryptocurrency firms because stolen digital assets can be moved across chains, exchanged through intermediaries, and routed through services designed to obscure transaction trails. The reported use of outflows across Ethereum, Arbitrum, and Avalanche would add complexity to recovery efforts by spreading activity among different networks and service providers.
The response will be tested by transparency and restoration
Binance's pledge addresses the immediate question of whether it can make customers whole if recovery efforts fall short. The exchange's stated reserve commitment exceeds its own estimated loss by about $40 million, while the reported asset freezes could materially reduce its eventual economic exposure if the funds are recovered.
The next operational test is restoring withdrawals without creating further security risks or leaving users uncertain about which balances and networks are available. The exchange will also face pressure to provide clearer information on the affected assets, the vulnerability it says enabled unauthorized withdrawals, and safeguards introduced before normal transfers resume.
Cryptocurrency markets declined during the update provided by Binance, with Bitcoin quoted at $76,511, down 3.24%, and ether at $2,210.97, down 2.37%. Those price movements occurred alongside a broad security event and do not establish that the breach alone drove the declines.
For Binance, the immediate measure of its response will be whether its stated reserves, token purchases, frozen assets, and law-enforcement recovery efforts translate into a secure reopening of withdrawals and full coverage of affected customer balances.
Concerned about exchange hacks? Learn how platforms protect users with the Toobit Shield Fund and strengthen your crypto safety.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
