• Binance says the breach affected its own internet-connected hot wallets, not customers’ individual wallets, and that it will absorb the losses.
  • Withdrawals remain suspended while deposits are back to normal; the company is targeting restoration in roughly 45–48 hours.
  • The reported theft of about $6.3 billion would be the largest cryptocurrency theft on record, and Binance says it has earmarked over $6.34 billion in corporate resources to cover it.

Scope of the Incident

Binance moved to clarify the scope of a sweeping security breach, saying the attack compromised its own hot wallets—the internet-connected systems the exchange uses to process withdrawals—rather than customers’ individual wallets. The company said it will absorb the losses, but the distinction should not be read as meaning customers were unaffected: withdrawals remain suspended while Binance repairs its systems.

The reported theft is approximately $6.3 billion, according to reporting and blockchain analysts, which would make it the largest cryptocurrency theft on record. Binance has not publicly named a culprit; blockchain investigators at TRM Labs, Chainalysis and Elliptic have attributed the attack to North Korean hackers with high confidence. North Korea has historically denied such allegations and did not immediately respond to requests for comment.

Financial Capacity and Frozen Funds

Binance said it has earmarked more than $6.34 billion in company resources, including $5 billion already held in the affected cryptocurrencies, and is purchasing the remaining tokens. That is a company statement, not an independently verified assessment of its financial capacity. The disclosure is consequential: the company did not explain where the additional funds came from, and its roughly $1 billion emergency reserve alone would be insufficient to cover the reported theft.

Separately, about $3 billion has been frozen with the assistance of industry partners, Binance said. Those assets are separate from the corporate resources earmarked for coverage, though frozen funds are not necessarily recovered or immediately available for repayment.

Services and Investigation

After initially suspending deposits and withdrawals, Binance says deposits are operating normally. Withdrawals remain paused, with the company targeting restoration roughly 45–48 hours after its Friday updates—not a guaranteed reopening time. If the reopening slips, or if proof-of-reserves disclosures fail to substantiate the reimbursement pledge, customer confidence could erode further.

The precise failure remains unresolved. An initially suspected compromised engineer’s laptop is now only part of the explanation: Binance has identified additional breach points. It says it has found no evidence of leaked wallet private keys and will publish a technical post-mortem. Blockchain investigators describe attackers gaining the ability to make Binance’s systems approve transactions across multiple blockchains. On Ethereum, investigators identified misuse of EIP-7702, a feature allowing a wallet to delegate functionality to code—a preliminary technical finding, not evidence that Ethereum itself was breached or a complete explanation of the attack.

The company is working with the FBI and U.S. Secret Service, according to a person familiar with the situation. That cooperation should not be confused with a published official conclusion about responsibility. Abu Dhabi’s Financial Services Regulatory Authority, which issued Binance’s main operating licence, says it is engaging closely with the company and monitoring the incident.

Market Ripple Effects

The immediate effect has been a confidence shock across digital-asset markets. Bitcoin touched a six-week low of $76,368, ether fell more than 3% to a two-month low of $2,178, and BNB declined 5.3% over 24 hours to $699.54, according to reported market snapshots. Shares of listed crypto exchanges also came under pressure.

The incident hit a sector already facing higher U.S. interest rates and softer demand from exchange-traded-fund buyers. HashKey Group (3887.HK) researcher Tim Sun warned that it could further weaken risk appetite and encourage investors to reconsider the safety of assets held on centralized exchanges. Moody’s (MCO) analyst Cristiano Ventricelli said broader consequences would depend on final losses, affected counterparties, recoveries and whether confidence problems spread across the ecosystem.

The disruption has also extended into decentralized finance: investigators reported that attackers borrowed ether against stolen USDT on Aave, after which Aave froze the affected markets, showing how an exchange breach can create response obligations elsewhere in the crypto ecosystem.

Precedents and Outlook

Three precedents help explain the significance. In 2019, attackers stole 7,000 bitcoin from Binance, then worth approximately $40 million, and the exchange covered the losses through its Secure Asset Fund for Users. In February 2025, a $1.5 billion theft at Bybit set the previous cryptocurrency-theft record; the FBI attributed that attack to North Korea, and investigators see similarities with the Binance incident. In September 2026, Bitget reported approximately $350 million stolen, another recent example of large-scale exchange-wallet compromise.

In the short term, the critical milestones are a safe withdrawal restart, confirmation that Binance has acquired the replacement assets, and publication of updated reserve information. Recovery of frozen funds may take longer than restoration of normal exchange services. Over the longer term, analysts expect the consequences to depend less on the headline theft amount alone than on Binance’s actual net loss, customer retention and any wider counterparty disruption.

The central unresolved questions are the full attack path, the final recoverable amount, independent verification of Binance’s financial response, and whether its security overhaul prevents a repeat. The current reimbursement promise is substantial, but it remains a promise under implementation—not evidence that the incident has been resolved.