• Binance is rebuilding its withdrawal system after a $6.3 billion hack, with withdrawals still suspended and roughly $3 billion in affected assets frozen.
  • CEO Richard Teng says the attacker used a self-destruct mechanism to destroy tooling and traces, and that withdrawals will only resume after rigorous testing.
  • Binance promises to cover customer losses, but the final loss, recovery amount and full attack path remain unsettled.

Rebuilding Under Pressure

Binance, the world’s largest cryptocurrency exchange, is racing to restore its withdrawal services after suffering what researchers are calling the largest crypto theft on record. The attack, which siphoned an estimated $6.3 billion, has forced the exchange to rebuild its withdrawal infrastructure from the ground up. As of Friday, withdrawals remain suspended, and roughly $3 billion in affected assets have been frozen by stablecoin issuers and other parties.

In a series of statements, Binance CEO Richard Teng revealed that the attacker employed a self-destruct mechanism that destroyed tooling and forensic traces as they moved through the exchange’s systems. “We are rebuilding the withdrawal service, and we are not switching it back on until it passes rigorous testing,” Teng said, according to people familiar with the matter. The company had earlier projected a 45-hour timeline for restoration, but that estimate now appears optimistic given the testing requirement.

The investigation initially focused on a compromised DevOps engineer’s laptop that gave an attacker access to an internal service container used to submit unauthorized withdrawals. However, Binance has since discovered additional breach points. Teng emphasized that this was a complex attack, not merely the misuse of one engineer’s permissions or a single “one-click” action. Investigators have found no evidence so far of a wallet private-key leak.

Frozen but Not Recovered

While approximately $3 billion has been immobilized, that does not mean the funds have been returned to Binance. The frozen assets were largely stablecoins controlled by issuers like Circle (CRCL), Tether and Ripple, which intervened to block the attacker’s access. This highlights a key contrast in the crypto ecosystem: stablecoin issuers can freeze assets, while bitcoin and other decentralized tokens cannot be frozen by a token issuer.

Binance says it will absorb all losses using its Secure Asset Fund for Users (SAFU) and company funds. Co-founder Yi He said Friday that annual revenue is sufficient to cover the losses without selling Binance’s SpaceX (SPCX) shares. However, the sources reviewed do not establish current audited consolidated revenue, profit or immediately available corporate liquidity. Her assurance should not be equated with independently verified loss-absorption capacity.

Market Tremors and Industry-Wide Implications

The immediate impact has been felt across cryptocurrency markets. Bitcoin fell more than 4% to approximately $77,995 on Friday as the incident weighed on sentiment, according to reported snapshots. Circle shares dropped about 5% in Thursday’s after-hours session. The scale of Binance’s operations—$34 trillion in annual trading volume and more than 300 million registered users—means a prolonged withdrawal interruption could affect liquidity across the entire crypto ecosystem.

Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean state-backed operation. Binance itself has not publicly attributed the incident to a threat actor. If that attribution holds, the case would connect exchange security with cross-border asset recovery and state-linked cybercrime. Binance is already working with law enforcement and blockchain intelligence firms.

The incident has also reignited debates over exchange concentration and the role of stablecoin issuers in recovery efforts. Fundstrat’s Sean Farrell reportedly judged that this did not presently resemble a solvency crisis, conditional on frozen stablecoins returning and withdrawals resuming in an orderly way. That is a conditional assessment, not a guarantee.

What to Watch

The decisive milestones are a safe withdrawal restart, evidence that frozen assets are being recovered rather than merely immobilized, publication of the promised updated reserve disclosure, and customer behavior after reopening. The technical post-mortem will determine whether this was primarily an endpoint-security failure, a broader authorization failure, or a combination of weaknesses.

A favorable outcome would combine reimbursement, recovery and a stable reopening. An adverse outcome would involve extended downtime, significant unrecovered assets or sustained customer outflows. Those are scenarios, not established forecasts; the outstanding security report and financial evidence will be more informative than reassurance alone.

Correction: An earlier version of this article misstated the timeline for withdrawal restoration. Binance had projected approximately 45 hours, not 48 hours. The error has been corrected.