• Binance is working to restore withdrawals within 48 hours after a $6.3 billion theft, the largest crypto heist on record.
  • The U.S. Secret Service says its investigation is in its early stages, while blockchain analysts point to North Korea.
  • Bitcoin fell to a six-week low of $76,368 as the breach rattled crypto markets; Binance says $3 billion in assets have been frozen.

Recovery Efforts and Customer Access

Binance, the world’s largest cryptocurrency exchange, is scrambling to resume customer withdrawals after disclosing a $6.3 billion theft that occurred over roughly 20 minutes late on October 29. The exchange said it is targeting restoration of withdrawals within 48 hours, though that remains a company forecast rather than a guaranteed outcome.

In a statement, the U.S. Secret Service said its investigation “remains in its early stages” and that it “will provide additional information as appropriate.” The agency’s involvement underscores the scale of the breach, which Reuters (TRI) reported has drawn in the FBI and international law-enforcement agencies. The Secret Service routinely investigates financial and payment-system crime, so its role does not imply a threat to protected officials.

Binance’s preliminary investigation pointed to a compromised engineer’s laptop that allowed unauthorized withdrawals. Blockchain analysts described a compromise of the infrastructure that authorizes transactions. These findings remain preliminary and have not been independently verified.

Frozen Assets and Compensation Pledge

Binance and its partners have frozen or located approximately $3 billion in affected assets, according to people familiar with the matter. Freezing assets, however, does not necessarily mean they have been recovered and returned. TRM Labs estimated that roughly $2.4 billion in bitcoin and ether was already beyond the reach of counterparties attempting freezes—a figure that is not a final accounting of permanently unrecoverable losses.

The company said customer funds were safe and that it had set aside approximately $6.34 billion of company funds to cover losses. Reuters reported that Binance did not explain where those funds came from. The assurances have not been independently verified, leaving questions about the exchange’s financial capacity to absorb the loss. Binance’s existing customer-protection reserve—a $1 billion bitcoin fund under its Secure Asset Fund for Users—is substantially smaller than the gross theft.

Attribution Contested as Markets Stabilize

The attack has been linked to North Korea by private-sector firms including TRM Labs, Chainalysis and Elliptic, which cited similarities with previous North Korea-linked thefts, particularly the 2025 Bybit hack. Binance CEO Richard Teng said its own investigation had not yet identified the attackers. North Korea routinely denies involvement in cryptocurrency theft and cyberattacks. Private-sector attribution should not be confused with a final U.S. government finding.

Markets reacted sharply before stabilizing somewhat. Bitcoin reached a six-week low of $76,368, ether fell more than 3% to $2,178, and BNB was down approximately 5% over 24 hours in one reported snapshot. The figures are event-period observations, not live quotes.

The episode has also highlighted a tension within cryptocurrency infrastructure: centralized controls can help freeze stolen assets, while customers still depend on the exchange’s security and financial capacity. Ripple and World Liberty Financial, working with BitGo (BTGO), helped immobilize suspected stolen funds, according to Reuters.

Binance co-founder Yi He has been communicating the response alongside Teng. The coming days will be decisive: whether withdrawals resume on schedule, whether Binance substantiates its loss-covering resources, and how much frozen cryptocurrency can actually be returned. Until then, the Secret Service’s wording signals limited disclosure at an early stage—not confirmation of a suspect, a completed forensic account or a recovery outcome.