Binance Commits $6.34 Billion to Cover User Losses After Major Hack

Highlights:

• Binance has reserved over $6.34 billion in company funds to cover user losses following the massive hack.
• Binance has frozen around $3 billion in affected crypto assets and started recovering funds for users.
• TRM Labs linked the attack to North Korea’s Lazarus Group as Binance uncovered additional security breaches.

Crypto exchange Binance has reserved more than $6.34 billion in company funds to cover losses from a major cryptocurrency hack that affected approximately $6.3 billion in assets. The exchange has also frozen around $3 billion in affected crypto funds and started recovering assets for users. Binance says it will cover any confirmed losses while investigators continue tracing the stolen funds.

In an October 30 update on X, Binance confirmed that $5 billion of its reserved funds already consists of the same cryptocurrencies affected by the attack. The company is now purchasing the remaining assets to cover potential shortfalls in customer balances.

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.

The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj

— Binance (@binance) October 30, 2026

Binance Sets Aside $6.34 Billion and Begins Recovering Stolen Crypto

Binance said it has allocated more than $6.34 billion from its own resources to cover the security incident. Of that amount, $5 billion is already held in the specific tokens affected by the breach. The exchange is purchasing the remaining approximately $1.34 billion in cryptocurrency through regular market transactions and over-the-counter (OTC) channels. OTC transactions allow large buyers and sellers to trade directly without placing their entire orders on public exchanges.

However, Binance warned that completing these purchases could take time because some affected tokens have limited trading liquidity. OTC transactions also require additional settlement time.

The company said:

“We will continue to use company resources to cover confirmed shortfall and will provide further verified updates as recovery efforts progress.”

Separately, Binance has frozen around $3 billion in affected assets with assistance from blockchain partners. These frozen funds are not included in the $6.34 billion the company has reserved. Binance is working with law enforcement agencies, token issuers and blockchain intelligence firms to recover the frozen assets and trace additional stolen funds.

The exchange also plans to publish updated Proof of Reserves data once the recovery process is complete. Proof of Reserves allows customers to check whether an exchange holds sufficient cryptocurrency to back reported customer balances.

Binance Finds Additional Breach Points as Withdrawal Services Remain Suspended

In an earlier October 30 statement, Binance said its investigation had uncovered additional breach points beyond the initially suspected compromised laptop. The exchange’s first investigation suggested that attackers may have compromised a DevOps engineer’s laptop. According to its official security notice, the attackers may have used that access to enter an internal service container and submit unauthorized withdrawal transactions.

However, subsequent findings suggest the attack involved more than one security weakness. Binance said investigators were still establishing how the breach occurred. The company has found no evidence that wallet private keys were leaked. Binance temporarily suspended withdrawals to prevent further losses. It confirmed that unauthorized outflows stopped after the suspension and said deposits remained unaffected.

The exchange said it was still working toward its estimated 45-hour timeline for restoring withdrawal services. It has not confirmed an exact reopening time. Binance also said its Secure Asset Fund for Users (SAFU), an emergency reserve established to protect customers, would help cover losses alongside company funds.

TRM Labs Links $6.3 Billion Binance Hack to North Korea’s Lazarus Group

Blockchain intelligence firm TRM Labs has linked the Binance attack to TraderTraitor, a North Korean hacking unit associated with the Lazarus Group. In an October 29 investigation report, TRM Labs said attackers moved approximately $6.36 billion from Binance wallets across ten blockchain networks. Most of the transfers occurred within about 20 minutes.

The firm attributed the attack to TraderTraitor with “high confidence,” citing blockchain transaction records and other intelligence. The FBI also said TraderTraitor was responsible for the $1.5 billion Bybit hack in February 2025. However, Binance has not officially identified the attackers. Its investigation remains ongoing, and law enforcement authorities have not publicly confirmed responsibility for the latest breach.

Meanwhile, Binance co-founder Changpeng Zhao said Gulf, the company’s partner in Thailand, had offered assistance if needed. He said the partner expressed confidence in Binance’s ability to cover the losses. Binance says it will continue publishing verified updates as investigators trace stolen assets and work toward restoring normal services.

In 2023, after news of the $4 billion fine, Gulf, our partner in Thailand, asked: “do you need help with cash liquidity?” We didn’t, but I appreciated the gesture.

Today: “know you can cover, but we are here if needed.”

Strong partners show in tough times. 🙏 https://t.co/0GzOIMBwyK

— CZ 🔶 BNB (@cz_binance) October 30, 2026