Binance arranges $6.34 billion to cover losses from record crypto hack

Binance said it reserved its own funds to cover the $6.3 billion hack, including freezes of roughly $3 billion in stolen assets.

Binance moved aggressively to reassure users after the largest crypto exchange suffered the largest cryptocurrency theft in history.

In an update shared with CoinDesk, the exchange said it set aside over $6.34 billion for the incident, with $5 billion already held in the exact token assets that were affected.

In other words, Binance is using its own corporate money to secure matching cryptocurrencies so that affected user balances can be restored one-for-one without altering or taking customer funds.

It is completing the purchase of the remaining amount by buying the tokens through public markets and over the counter so the reserves match exactly what users lost.

“These figures do not include frozen or protected assets. Currently, $3 billion has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets. We will continue to use company resources to cover confirmed shortfall… Ultimately, all user funds will be verified publicly through our Proof of Reserves. We will weather this storm,” a company spokesperson said in an email.

The company is also banking on its Secure Asset Fund for Users (SAFU) facility, an emergency reserve that has typically held around $1 billion in bitcoin BTC$76,789.53 for exactly this kind of event.

What happened

Late Thursday, attackers drained an estimated $6.3 billion from Binance’s hot wallets across multiple blockchains. Most of the coins, which included bitcoin, ether ETH$2,239.52 and stablecoins USDT and USDC among smaller tokens, left in a burst that lasted only about 20 minutes.

Binance initially pointed to a compromised DevOps engineer’s laptop that let the attackers submit unauthorized withdrawal requests through internal systems. The company later said it found additional exploit points, while maintaining that it has not seen any evidence that any wallet private keys were stolen. It didn’t give details about the additional attack vectors.

Blockchain analysis firms, including Chainalysis and TRM Labs, linked the exploit with high confidence to North Korea’s hacker group responsible for previous large-scale thefts given the sophistication and speed of the attack.

Chainalysis said it is seeing money-laundering techniques it has never observed before. Thousands of transactions are taking place in a very short time, which suggests the attackers are using automated scripts rather than moving money by hand.

Instead of sending funds directly to a final destination, they are repeatedly circulating the coins among many addresses, often sending them back to wallets that appeared earlier in the chain.

One recurring pattern involves many addresses receiving exactly 1 TRX before receiving and immediately transferring larger amounts, which Chainalysis describes as a programmatic process designed to scramble the trail at scale.

Aidan Larkin, co-founder and CEO of Asset Reality, a seized-asset company, called the approach “agentic money laundering.”

What next?

Binance has kept deposits open and paused withdrawals while it finishes security checks. It previously said withdrawals could resume roughly 45-48 hours.

The combination of rapid freezes and the large cash and token reserves is meant to assure users that losses will be covered. However, recovering the frozen assets and topping up any remaining shortfalls could take some time, especially for smaller tokens that have thin markets, such as the FUN token, which crashed 90% early today.

The company said it will publish updates as the recovery work continues.

In the meantime, the string of hacks has triggered broader discussion about what the industry can do. DefiLlama has recorded 322 confirmed incidents in 2026 so far, with more than $8.7 billion in losses.

OKX founder Star Xu said executives should come together the way they did during the 2017 Bitcoin fork crisis to set stronger security standards and shared response systems.

He recommended that transfers between verified exchanges could settle instantly, while large withdrawals to unknown addresses or smart-contract approvals would face extra checks and short delays.

In other words, he favors creating friction when moving money to unrecognized addresses in an attempt to identify and stop hacks in the early stages. Those rules should sit at the cryptographic signing layer so an attacker who breaks into a wallet system still cannot bypass them, he added.

Xu also called for real-time incident alerts, joint monitoring of suspicious funds, and faster, lawful freezes of stolen assets involving exchanges and stablecoin issuers.

“Even if an attacker compromises an exchange’s wallet management system, they should not be able to bypass these fundamental security restrictions,” he wrote.

By Omkar Godbole, AI Boost|Edited by Sheldon Reback

AI Disclaimer: Parts of this article were generated with the assistance from AI tools and reviewed by our editorial team to ensure accuracy and adherence to our standards. For more information, see CoinDesk’s full AI Policy.