Binance Sets $6.34 Billion Reserve After $6.3 Billion Hack

By Elena Vasquez

Binance said in a Friday statement that it had allocated $6.34 billion in company funds and reserves to cover losses from a security breach it pegged at $6.3 billion. The disclosure followed the exchange’s Thursday attack, while investigations and recovery efforts continued alongside law enforcement.

Binance Co-CEO Richard Teng wrote: “Your money is safe, and we're covering every loss.” The exchange has suspended withdrawals, although users can still deposit assets, according to Teng.

What triggered the breach?

Teng said the initial investigation pointed to a compromised DevOps engineer’s laptop. An attacker used access to a service container that submitted unauthorized withdrawal transactions, moving beyond the engineer’s individual permissions.

Teng said the incident involved a more complex process than simply exploiting one employee’s permissions. Binance has found no evidence of a wallet private-key leak, a distinction that separates infrastructure compromise from a demonstrated key leak.

The initial findings may change as the investigation proceeds. The practical takeaway is that the reported entry point does not yet constitute a full account of the attack.

How is Binance building the reserve?

About $5 billion of the $6.34 billion reserve consists of digital assets already held by Binance in the same tokens affected by the breach. That is roughly four-fifths of the announced support, held in the assets themselves.

The statement did not reconcile the difference between the $6.3 billion estimated loss and the larger reserve. Binance also did not identify the affected tokens or provide a detailed breakdown of its holdings.

It is buying the remaining roughly $1.3 billion through market and over-the-counter channels. Binance warned that thin liquidity and settlement delays could extend that process.

The reserve excludes approximately $3 billion in assets that industry partners say they have frozen. Committed capital still depends partly on purchases in assets already under scrutiny.

Who has frozen the assets?

Tether Chief Executive Officer Paolo Ardoino said the stablecoin issuer froze more than $1.57 billion in USDT. Circle confirmed that it froze more than $800 million in USDC.

Ripple promptly froze roughly $200 million in associated funds, according to Co-CEO Yi He. World Liberty Financial also worked with BitGo and other partners to freeze approximately $27 million in stablecoins and $2 million in its own tokens, the company said in an X post.

Those disclosed freezes total less than the approximately $3 billion Binance cited, and Binance did not reconcile the difference. It also has not said how much of the frozen assets it can access and return to customers.

The practical takeaway is that a freeze announcement does not yet equal a customer reimbursement.

What remains unresolved?

Blockaid said it was investigating billions of dollars in outflows from Binance hot wallets across Ethereum, Arbitrum and Avalanche. Binance did not identify the affected tokens.

TRM Labs said several elements of the attack resembled previous incidents linked to North Korean hackers, including last year’s $1.5 billion Bybit breach. Binance has not attributed the incident to any particular group.

TD Cowen said the breach exposed risks in exchange custody and cybersecurity but did not undermine the underlying utility of digital assets or blockchain networks. That assessment separates an operational-security failure from a failure of the underlying networks, but it does not identify the attacker.

Responsibility remains unresolved, despite similarities to a known attack pattern.

Binance has not set a deadline for completing the $1.3 billion purchase program. Nor has it announced when it will lift the withdrawal suspension, so that resumption date is the next operational checkpoint for users.