Binance reserves $6.34 billion to cover hack losses and freezes about $3 billion
Binance, the world’s largest crypto exchange, has begun recovering assets for users affected by a security incident and has reserved more than $6.34 billion of company funds to cover the losses.
The company announced this on its official X account.
According to the statement, $5 billion of the $6.34 billion is already held in the exact token assets that were impacted. Binance is buying the remainder through market and over-the-counter (OTC) channels, warning that this may take longer because some tokens have low liquidity and OTC settlement takes time.
The figure excludes frozen assets. Binance said about $3 billion has been frozen with the help of industry partners. “Ultimately, all user funds will be verified publicly through our Proof of Reserves. We will weather this storm,” the statement said.
Who froze the funds. Tether CEO Paolo Ardoino said on X that Tether froze more than 1.567 billion USDT. Binance co-founder and co-CEO Yi He thanked Ripple for freezing approximately $200 million. According to The Block, Circle confirmed freezing more than $800 million in USDC.
| Item | Amount | Source |
|---|---|---|
| Loss | ~$6.3 billion | Binance |
| Company funds reserved | >$6.34bn | Binance |
| of which in impacted tokens | $5 billion | Binance |
| Total frozen | ~$3 billion | Binance |
| Tether (USDT) | >$1.567bn | P. Ardoino, Tether CEO |
| Circle (USDC) | >$800m | Circle (The Block) |
| Ripple | ~$200 million | Yi He, Binance co-CEO |
What happened. The incident took place on the evening of 29 October US time (overnight into 30 October in Yerevan). About $6.3 billion was drained from Binance hot wallets across several blockchains – the largest theft in crypto history, surpassing the $1.5 billion stolen from Bybit in 2025. Binance co-CEO Richard Teng said the initial investigation pointed to a compromised DevOps engineer’s laptop, but additional points of breach were later found: “This was a complex attack.” Teng said there was no evidence of a wallet private key leak.
Blockchain analytics firms Chainalysis and TRM Labs attribute the attack to the North Korea-linked TraderTraitor group (Lazarus). Binance has not officially attributed it to any group.
According to the official announcement on Binance’s website, losses will be covered from the SAFU (Secure Asset Fund for Users) emergency fund and company funds. As an immediate precaution, Binance revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover funds. The company has pledged a detailed technical post-mortem once the investigation is complete.
What’s next. Withdrawals from Binance remain suspended, while deposits, according to the company, continue to operate as normal. In a video update on X, Teng said withdrawals are expected to resume within about 40 hours, by Sunday, and a full Proof of Reserves report will be published on Monday. Bitcoin fell about 5% after the incident, dropping below $77,000.
Sources: Binance (Security Incident Update, 30.10.2026; X, 30.10.2026), Paolo Ardoino (X), Yi He (X), Richard Teng (X video update), Chainalysis, The Block, CoinDesk, Al Jazeera.
