Binance allocates $6.34B to cover hack losses.
Crypto exchange Binance has begun reimbursing users affected by a hack, reserving over $6.34 billion from its own capital to cover the losses.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.
The company has already publicly committed to cover losses through company funds in the prior announcement.
Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls. This step can take longer because some tokens may have low liquidity and OTC settlement also takes time. We will share more progress as soon as we can.
These figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification. Currently, $3bn has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets.We will continue to use company resources to cover confirmed shortfall and will provide further verified updates as recovery efforts progress. Ultimately, all user funds will be verified publicly through our Proof of Reserves.
We will weather this storm. Thank you for the support.
According to the company, $5 billion of this amount was already held in the same tokens that the hacker withdrew. Binance has started purchasing the remaining assets on the market and through OTC channels to fully cover any potential shortfall for each asset.
The platform’s team warned that the process might take time: some tokens have limited liquidity, and OTC settlements require time.
With the support of partners, Binance managed to freeze about $3 billion. These assets are not included in the $6.34 billion sum; they still need to be recovered and further verified.
If the shortfall turns out to be larger, the exchange will cover it from its own funds, representatives stated. Binance promised to publicly confirm the safety of all user funds through Proof-of-Reserves.
Statement from Richard Teng
Binance Co-CEO Richard Teng reiterated the preliminary version that the attack began with the hacking of a DevOps engineer’s laptop but added a caveat.
I want to speak to you directly about what happened.
Bottom line — your money is safe, and we’re covering every loss.
Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.
To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.
So far, we have found no evidence of any wallet private key leak.
We’ll share a detailed technical post-mortem once the investigation is complete and every fact is verified — and publish an updated Proof of Reserves once remediation is complete.
• Your funds are safe
• Binance will cover all losses from the SAFU fund and company funds
• Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners
• No evidence of any wallet private key leak
• Deposits are unaffected and operating as normal
• Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses
• Revoked the affected address authorizations
• Engaged law enforcement and blockchain intelligence partners to trace and recover fundsOur team hasn’t stopped. We’re working closely with law enforcement to ensure the matter is handled appropriately — and I’ll share what I can, as soon as I can.
— Richard Teng (@_RichardTeng) October 30, 2026
“To clarify: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. The attack was more complex. The investigation has not attributed responsibility to any specific employee,” he wrote.
Teng also listed measures previously reported by the exchange: suspension of withdrawals, revocation of access rights for compromised addresses, and contacting law enforcement. Binance did not publicly name specific agencies.
The co-CEO promised to publish a detailed technical analysis of the incident after the investigation and verification of all facts are complete.
Later, Binance clarified that the investigation revealed additional points of entry beyond the employee’s laptop. The company did not disclose details. In the same update, the exchange promised to resume withdrawals within 45 hours. Deposits are operating normally.
In February 2025, hackers stole $1.46 billion from Bybit. Before the Binance incident, this attack was considered the largest in the history of CEX.