（Singapore, 30.10.2026）Binance has pledged to cover losses from an estimated US$6.3 billion cyberattack, the largest theft recorded in the cryptocurrency industry, as investigators trace stolen assets and customers await the reopening of withdrawals.
The world’s largest crypto exchange suspended withdrawals on Friday after the breach and said it had reserved more than US$6.34 billion of company funds to cover the incident. Co-founder Yi He said withdrawals were expected to resume on Sunday.
According to Bloomberg, Binance also said roughly US$3 billion in stolen assets had been frozen across blockchain networks. Those assets remain subject to recovery proceedings and are separate from the company funds allocated to reimburse losses.
The attack has renewed questions about the security of digital-asset platforms, although the market reaction has so far been relatively contained compared with previous industry crises.
Bitcoin fell as much as 3.1% on Friday to around US$76,300, dropping below US$77,000 for the first time in more than a month before recovering some losses. Binance’s BNB token declined about 5% over 24 hours to approximately US$700.
The breach comes as crypto businesses seek deeper links with traditional finance, making Binance’s response a test of both its financial strength and the industry’s ability to contain a major security failure.
Investigators Trace Funds Across Multiple Blockchains
Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have linked the attack to North Korea, although Binance’s investigation remains ongoing.
TRM attributed the operation with high confidence to TraderTraitor, a North Korean hacking unit, saying preparations began at least 36 hours before the theft.
According to its analysis, billions of dollars began leaving Binance wallets on the evening of October 29 across 10 blockchains, including Bitcoin, Ethereum, Solana and XRP, and moved into addresses controlled by a single attacker.
The stolen assets included Bitcoin, Ether and the dollar-linked stablecoins USDT and USDC.
Initial findings suggest the attackers may have compromised the exchange’s transaction-authorisation processes, with TRM saying internal software appeared to have been used to approve transfers across multiple networks.
Binance said a compromised software engineer’s laptop could have been involved, alongside other possible entry points, but added that it had found no evidence of leaked private keys.
The company described the incident as a complex attack and said it was working with law enforcement while reviewing its security arrangements.
Stablecoin issuers moved to restrict access to affected funds. Tether chief executive Paolo Ardoino said the company froze more than US$1.5 billion in USDT connected to the incident, while Circle chief executive Jeremy Allaire said US$800 million in USDC had been frozen.
The scale of the theft far exceeds the almost US$1.5 billion stolen from Bybit in February 2025, previously the largest publicly known crypto hack.
It also highlights how security risks extend beyond protecting private keys, as exchanges increasingly depend on interconnected software, automated approval systems, multiple signers and external service providers.
Repayment and Withdrawal Restart Become Crucial Tests
Binance’s size has helped support confidence that it can absorb the losses, although its reimbursement pledge has yet to be fully tested.
The exchange holds approximately US$135 billion in assets, compared with about US$28.6 billion at its nearest rival OKX, according to DefiLlama data cited by Bloomberg. Those platform assets, however, are distinct from the company funds Binance says it has reserved.
Market maker Wintermute said less than 20% of its net equity was on Binance, with chief executive Evgeny Gaevoy expressing confidence that the exchange could withstand a substantially larger loss.
Binance also maintains its Secure Asset Fund for Users, established in 2018 as an emergency backstop. The fund has generally been kept at around US$1 billion, although its value has fluctuated with markets.
Analysts caution that the outcome depends on whether customers are made whole and whether the breach remains isolated, rather than triggering wider financial difficulties among connected businesses.
Unlike the failures surrounding FTX in 2022, the information disclosed so far points to an external theft, with no established evidence of a comparable fraud or hidden lending problem.
Nevertheless, the attack follows several costly security incidents, including breaches involving Bitget, hardware-wallet users and third-party technology providers.
Prediction market Polymarket also temporarily halted international trading this week after a provider was compromised, while financial institutions in South Korea reported unauthorised access affecting customer information.
Concerns about increasingly capable AI-assisted attacks have intensified scrutiny of these vulnerabilities, although the supplied reports do not establish that AI was used in the Binance breach.
Crypto markets were already under pressure from weaker sentiment in technology stocks and US$11 billion in options expiring on Friday, complicating efforts to isolate the hack’s impact on prices.
For Binance, Sunday’s planned reopening of withdrawals will provide the next practical test, as customers assess whether they can access funds normally and whether the exchange can deliver on its promise to cover the losses.
