Binance arranges $6.34 billion to cover losses from record crypto hack

The exchange said partners froze $3 billion in stolen assets, separate from its own reserves, while withdrawals remain paused pending security checks and deposits remain open. Blockchain analysts have linked the attack to North Korean hackers with high confidence, as the theft spurs calls for stronger withdrawal safeguards and coordinated industry responses.

Company Response

Binance moved aggressively to reassure users after the largest crypto exchange suffered the largest cryptocurrency theft in history. In an update shared with CoinDesk, the exchange said it set aside over $6.34 billion for the incident, with $5 billion already held in the exact token assets that were affected.

The company is using its own corporate money to secure matching cryptocurrencies so that affected user balances can be restored one-for-one without altering or taking customer funds. It is completing the purchase of the remaining amount by buying the tokens through public markets and over the counter.

Attack Details

Late Thursday, attackers drained an estimated $6.3 billion from Binance's hot wallets across multiple blockchains. Most of the coins, which included bitcoin, ether and stablecoins USDT and USDC among smaller tokens, left in a burst that lasted only about 20 minutes.

Binance initially pointed to a compromised DevOps engineer's laptop that let the attackers submit unauthorized withdrawal requests through internal systems. The company later said it found additional exploit points, while maintaining that it has not seen any evidence that any wallet private keys were stolen.

Blockchain analysis firms, including Chainalysis and TRM Labs, linked the exploit with high confidence to North Korea's hacker group responsible for previous large-scale thefts given the sophistication and speed of the attack.

Chainalysis said it is seeing money-laundering techniques it has never observed before. Thousands of transactions are taking place in a very short time, which suggests the attackers are using automated scripts rather than moving money by hand.

Aidan Larkin, co-founder and CEO of Asset Reality, called the approach "agentic money laundering." The attackers are repeatedly circulating coins among many addresses, often sending them back to wallets that appeared earlier in the chain.

Industry Response

Binance has kept deposits open and paused withdrawals while it finishes security checks. The combination of rapid freezes and the large cash and token reserves is meant to assure users that losses will be covered. However, recovering the frozen assets and topping up any remaining shortfalls could take some time, especially for smaller tokens that have thin markets.

OKX founder Star Xu called for executives to come together to set stronger security standards and shared response systems. He recommended that transfers between verified exchanges could settle instantly, while large withdrawals to unknown addresses or smart-contract approvals would face extra checks and short delays.

Xu also called for real-time incident alerts, joint monitoring of suspicious funds, and faster, lawful freezes of stolen assets involving exchanges and stablecoin issuers. "Even if an attacker compromises an exchange's wallet management system, they should not be able to bypass these fundamental security restrictions," he wrote.