Binance sets aside more than $6.34 billion to cover record hack losses as FBI joins recovery effort
Binance said on Friday it has reserved more than $6.34 billion in company funds to cover losses from the record $6.3 billion hack, with about $3 billion already frozen, as US law enforcement joined the effort to trace the stolen crypto. Figures checked at about 9:50 pm PKT on Friday, 30 October 2026.
Binance, the world's largest cryptocurrency exchange, said on Friday it has reserved more than $6.34 billion in company funds to deal with the fallout from a record $6.3 billion theft, moving to reassure customers a day after hackers drained wallets across ten blockchains in about twenty minutes. Figures in this post were checked at about 9:50 pm Pakistan time on Friday, 30 October 2026.
According to the exchange, about $5 billion of the reserved amount is already held in the exact token assets that were taken, with the remainder to be bought through market and over-the-counter channels. Binance said the process of acquiring the remaining tokens could take longer where liquidity is thin or settlement is slow, and that the reserve figures do not include roughly $3 billion in assets that industry partners have already frozen.
The scale of the response underlines how large the breach was. The theft, which began shortly after 2000 GMT on Thursday, is now described by analysts as the biggest cryptocurrency heist on record, dwarfing the $1.5 billion taken from Bybit in February 2025. Binance's co-chief executive, Richard Teng, said losses would be covered by the company's secure asset fund and company resources, while co-founder Yi He said the exchange would cover all hacking losses and that user funds would be verified publicly through its proof of reserves.
How the attackers got in is becoming clearer, though the investigation is far from complete. Binance's initial assessment pointed to a compromised laptop belonging to a DevOps engineer, which gave an attacker access to a service container used to submit unauthorised withdrawal transactions. The exchange said it had found no evidence that the private keys used to access its wallets had leaked, a distinction that matters because it suggests the breach exploited a workflow and signing process rather than simply copying keys.
Blockchain analytics firm TRM Labs, which has examined the on-chain trail, said the attackers compromised Binance's signing infrastructure, the system that authorises transactions, allowing them to issue instructions that emptied the affected wallets. TRM went further on Friday, attributing the raid with high confidence to TraderTraitor, North Korea's elite hacking unit, citing what it called robust on- and off-chain intelligence and similarities with last year's Bybit attack, which the FBI attributed to North Korean hackers. Binance itself said its investigation had not yet identified the attackers, and North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts.
Law enforcement is now formally involved. A person familiar with the matter told Reuters that Binance is working with agencies around the world, including the US Federal Bureau of Investigation and the US Secret Service, after the hack. The exchange said in a public post that it was cooperating with law enforcement, without naming the agencies, and that it is working with issuers and blockchain intelligence firms to trace, freeze and recover funds.
Freezing the money has proved easier than recovering it. About half the stolen assets were stablecoins, and issuers including Tether, Circle, Ripple and World Liberty Financial have frozen portions of them. Tether's chief executive said more than $1.57 billion in USDT had been frozen, while Circle confirmed more than $800 million in USDC. TRM estimated, however, that about $2.4 billion worth of bitcoin and ether is already beyond reach, with some funds posted as collateral to borrow ether, a step that complicates any recovery.
Questions remain about whether the reserve fully closes the gap. Security firm CertiK noted that it needed more information to verify the claimed $5 billion in matching tokens on-chain, and its chief executive had earlier estimated that about $3 billion in frozen assets plus Binance's roughly $1.17 billion emergency fund would cover about two-thirds of the reported losses. Binance's own arithmetic is different: it counts the $6.34 billion reserve separately from the frozen $3 billion, and its founders have pointed to other holdings, including a SpaceX stake worth more than $1 billion, as evidence of its financial strength. Yi He said the company did not need to sell that stake because its annual revenue was enough to cover the losses.
Markets reacted sharply to the news of the breach before steadying. Bitcoin fell to a six-week low and was last down about 3 percent at $76,469.82 in one snapshot, while ether fell more than 3 percent to $2,185.83, before both pared losses during Friday's Asia session. The episode has renewed debate about how exchanges insure customer funds: Binance's Secure Asset Fund for Users, set up in 2018, holds roughly $1 billion in bitcoin, but most standard crime insurance policies were not designed for digital assets, leaving company capital as the main backstop in practice.
For customers, the immediate practical question is access. Binance said withdrawals were suspended during a security overhaul but that deposits were unaffected, and it expected to resume withdrawals within 48 hours. The company also said it provides weekly reports on its company funds to Abu Dhabi's Financial Services Regulatory Authority, which said on Friday it was aware of and monitoring the situation. What happens next will depend on three open items: how much of the frozen $3 billion can actually be returned, whether the remaining tokens can be bought without moving markets against the exchange, and whether investigators can tie the on-chain trail to the people behind it. A reserved fund, as analysts caution, is not yet a completed repayment.
This post is market news information only, not financial advice.
