Binance says it has reserved more than $6.34 billion in company funds to cover losses from a major cryptocurrency hack, while investigators and blockchain firms continue tracing the stolen assets. The exchange estimates the incident’s total impact at about $6.3 billion, although Chainalysis has put the value of the stolen crypto at $5.912 billion at the time of theft.
Binance prepares to cover the shortfall
The exchange said $5 billion of the reserve was already held in tokens affected by the attack. Binance is buying the remaining assets through exchanges and over-the-counter transactions so it can address any token shortfalls and prepare an updated proof of reserves, according to co-CEO Yi He.
Yi He said Binance’s SAFU emergency fund and company holdings contain significant amounts of Bitcoin and Ether. The company plans to provide another update after the purchases are completed. Some transactions could take longer because of limited market liquidity and the time required to settle over-the-counter trades.
The $6.34 billion allocation does not include assets that have been frozen or otherwise protected. Binance said approximately $3 billion in crypto had been frozen, with efforts to recover additional funds continuing alongside law enforcement agencies and industry partners.
Deposits are operating normally, while withdrawals remain paused as Binance completes a security review of its withdrawal systems and related addresses. The exchange expects withdrawals to resume within 48 hours. Binance said the pause stopped outflows from the platform but did not affect deposits.
Investigation points to a complex attack
Binance’s preliminary investigation initially identified a potentially compromised laptop belonging to a DevOps engineer. The exchange said the device may have provided access to an internal service and enabled unauthorized withdrawal transactions. Co-CEO Richard Teng stressed that the breach was not a simple “one-click” operation and said the investigation had not assigned responsibility to any individual.
Binance has also said it found no evidence that a wallet private key was leaked. Blockaid CEO Ido Ben-Natan said the incident may instead have involved misuse of a signing system, allowing malicious transactions to be approved without the underlying private key being extracted. He said Ethereum’s EIP-7702 upgrade may have enabled attackers to bypass some security checks and execute the operation in a single sweep, although the funds could have been stolen through other methods.
Binance later reported finding additional breach points and said it was still assembling the full sequence of events. Chainalysis said it had observed unusual laundering patterns, including thousands of transactions in a short period and repeated movements between addresses. The activity may indicate that the attackers are using automation to make the money trail more difficult to follow.
Several cybersecurity and blockchain specialists have linked the attack to TraderTraitor, a North Korean group also known as DPRK-linked. Chainalysis, TRM Labs and Blockaid cited similarities with previous exploits and on-chain preparations. Chainalysis co-founder Jonathan Levin estimated the theft at $6.4 billion, while Binance’s public estimate remains about $6.3 billion.
Frozen assets and market impact
The frozen assets include several dollar-linked stablecoins, including USDT, USDC, RLUSD, USD1, XUSD, USDT0 and USDP. Other affected assets include Wrapped Beacon ETH, Tether Gold, Pax Gold and Arbitrum’s ARB token.
Stablecoin issuers and blockchain networks have taken steps to restrict the movement of some funds. World Liberty Financial confirmed that it froze $27 million in USD1 and $2 million worth of WLFI. Ripple said it was freezing RLUSD connected to the incident. The Arbitrum Security Council also froze $30.5 million, consisting of 74.6 million ARB and 8,425 Ether, by moving the funds to an intermediary frozen wallet.
The decentralized lending protocol Aave temporarily froze markets across its V3 and V4 deployments after the suspected exploiter deposited 60 million USDT and borrowed about $44.6 million in Wrapped Ether. The position remained subject to normal liquidation, while users could still withdraw funds and repay loans. The freeze prevented new deposits and borrowing until there was greater clarity over the movement of the funds.
According to Cointelegraph, market makers Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption to their businesses. GSR said its exposure was below 5% of net equity, while Wintermute reported exposure below 20%; neither disclosed a dollar amount or confirmed losses.
Moneyiar market picture
Moneyiar data at 2026-10-25 22:39 +03:30 showed BNB at $740.8618136891, up 0.81% over 24 hours and 3.32% over seven days. Horizen (ZEN) traded at $5.7259060904, up 0.09% in 24 hours but down 1.51% over seven days. FUNToken (FUN) was $0.0089182414, up 1.62% over 24 hours and 0.08% over seven days.
The supplied Moneyiar data also showed Billions Network (BILL) at $0.0139971939, down 0.59% over 24 hours and up 10.04% over seven days. These figures are market snapshots at the stated time and do not establish the cause of any price movement.
