• Binance estimates approximately $6.3 billion was stolen in a security breach, with about $3 billion in affected assets frozen so far.
  • Withdrawals remain suspended while the exchange revamps its systems; deposits are operating normally, and restoration is targeted within 48 hours.
  • Binance pledges to cover all losses using its Secure Asset Fund for Users (SAFU) and company resources, but questions linger over the source of the $6.34 billion set aside.

Binance, the world’s largest cryptocurrency exchange, is racing to contain the fallout from one of the largest digital-asset heists on record. The company now estimates that approximately $6.3 billion was stolen in a security breach disclosed earlier this week, according to people familiar with the matter. Around $3 billion of the affected assets has been frozen through cooperation with blockchain partners, Binance said, cautioning that frozen assets should not yet be treated as recovered cash or completed customer reimbursement.

Withdrawals Halted as Investigation Widens

Customer withdrawals remain suspended while Binance overhauls its withdrawal systems and related address controls. Deposits are functioning normally, the company said in its latest statements. Binance expects to begin restoring withdrawals within approximately 48 hours—a target, not a confirmed reopening. The exchange has also committed to publishing an updated proof-of-reserves disclosure following remediation, though a detailed technical post-mortem will have to wait until its investigation is complete.

The probe has broadened beyond an initial finding that a software-infrastructure engineer’s laptop was compromised. Binance subsequently disclosed “additional points of breach,” emphasizing that the attack was more complex than the misuse of a single employee’s permissions. The company says it has found no evidence of a wallet private-key leak. Blockchain intelligence firms TRM Labs and Chainalysis attribute the attack to North Korea-linked TraderTraitor, though Binance has not confirmed that attribution and no public U.S. government attribution has been established.

The U.S. Secret Service is coordinating with the U.S. Attorney’s Office for the District of Columbia and law enforcement partners to identify the cyber criminals responsible, according to a statement cited in media reports. The agency’s involvement is consistent with its mandate to investigate financially motivated cybercrime affecting payment systems. The headline signals investigative coordination—not that suspects have been identified, charged or convicted.

Financial and Market Repercussions

Binance has pledged to cover every loss using its Secure Asset Fund for Users, or SAFU, and company resources. Reuters (TRI) reports that Binance says it has internally set aside approximately $6.34 billion, but has not explained the source of those funds in detail. SAFU is described as a roughly $1 billion bitcoin reserve, meaning the stated loss substantially exceeds that dedicated reserve and would require additional company resources unless recoveries reduce the ultimate cost. The sources reviewed do not provide a current, independently verified revenue, profit or consolidated liquidity statement sufficient to judge Binance’s ability to absorb the loss. Its reassurance that customer funds are safe therefore remains a company assurance rather than an independently established solvency conclusion.

Cryptocurrency prices fell following the news, with the immediate economic exposure concentrated in Binance, its customers and the wider digital-asset market. The available reporting does not quantify a material effect on national or global economic growth. Two industry issues stand out: exchange concentration and customer access, as a security failure at the largest exchange can interrupt customers’ ability to move assets even when the company promises to cover losses; and stablecoin issuers’ intervention powers, as issuers including Tether, Circle (CRCL), Ripple and World Liberty Financial froze affected tokens, illustrating how issuer-controlled assets can assist containment.

Leadership and Industry Context

Binance operates under co-CEOs Richard Teng and co-founder Yi He, who joined Teng in a dual-leadership structure in December 2025. Teng originally became CEO in 2023 after founder Changpeng Zhao pleaded guilty to violating U.S. money-laundering laws and stepped down. The immediate response involves security-system changes; the reviewed coverage does not announce a hack-related leadership departure or broader corporate restructuring.

The closest precedent is the approximately $1.5 billion Bybit theft on February 21, 2025, which the FBI attributed to North Korea. The reported Binance loss is more than four times that amount. Both incidents focus attention on the systems that authorize transactions, rather than simply on whether a wallet is described as online or offline. TRM’s analysis points specifically to compromised transaction-signing infrastructure—making the eventual technical findings particularly important for other exchanges.

Separately, on October 27, the D.C. U.S. Attorney’s Office announced expanded Scam Center Strike Force actions, reporting more than $1 billion in restrained cryptocurrency and 700 seized fraudulent investment websites. That illustrates the broader enforcement emphasis on cross-border crypto crime, but it is a separate operation—not evidence that those scam networks committed the Binance theft.

In the short term, the decisive tests are whether Binance restores withdrawals on schedule, whether additional assets can be frozen, and whether its promised reserve disclosure supports its loss-coverage assurances. Recovery remains uncertain: approximately $3 billion frozen is a significant containment result, but it does not settle the disposition of the remaining assets or the final financial cost. The Bybit precedent shows why investigators face urgency—TraderTraitor actors have previously moved and converted stolen cryptocurrency rapidly to complicate recovery.

Correction: An earlier version of this article misstated the date of the Bybit theft. It occurred on February 21, 2025, not February 22.