- Binance says it has set aside more than $6.34bn against a breach it estimates at around $6.3bn, a cushion of roughly $40m.
- About $5bn of that is held in the same that were taken. The remaining $1.3bn still has to be bought, and the company says thin liquidity could slow that down.
- A further $3bn of stolen assets has been frozen by Tether, Circle and others, which stops the attacker spending it but does not hand it back.
The arithmetic in Binance’s statement is almost too neat. A loss put at around $6.3bn, a reserve put at $6.34bn, a cushion of roughly $40m on the largest theft the industry has recorded. What has been announced is a pledge rather than a payment, and about a fifth of it has yet to be bought.
If you had coins on Binance when this happened, the number in the announcement is not the thing that affects you. What affects you is whether withdrawals come back when the company says they will, and what you can do if they don’t. A commitment to cover losses is a promise from one company’s balance sheet. There is no compensation scheme sitting behind crypto on an exchange, in the UK or anywhere else.
What has been committed, and what is held
Binance published the figure in a statement on its own X account on 30 October. “The estimated total impact sits at around $6.3B,” the company said. Co-CEO Richard Teng was blunter: “Your money is safe, and we’re covering every loss.” Both lines come from the company’s own announcement, so they are its position rather than anything established independently.
The breakdown underneath is more specific than the headline figure. Roughly $5bn of the commitment is already held in the same digital assets that were drained. The remaining $1.3bn or so is being acquired through exchange order books and over-the-counter desks, the private broker market large buyers use when they would rather not move the price against themselves. Binance said that part could take longer because of thin liquidity and settlement delays.
So “ready to cover” is doing some work. Four fifths of the money is sitting in the right tokens. The last fifth is a buy order in a market that knows exactly what Binance needs and roughly when. Reporting is also inconsistent on whether the roughly $1bn SAFU emergency fund sits inside the $6.34bn or alongside it, and Binance has not spelled that out.
Frozen is not recovered
The $3bn figure comes from stablecoin issuers and other firms blacklisting addresses holding the stolen funds. Tether’s Paolo Ardoino put its share at about $1.57bn of USDT, Circle at more than $800m of USDC, with roughly $200m cited by co-CEO Yi He via Ripple and about $29m through World Liberty Financial and BitGo. Centrally issued can be switched off at a specific address, which is the trade-off their holders accept.
Those balances are immobilised at the addresses they sit in, pending legal and forensic process that in comparable cases has run for years. Cointelegraph reported that the attackers moved quickly to swap stablecoins into assets nobody can freeze before the issuers acted. CoinDesk put the bitcoin portion of the haul at 18,270 BTC, around $1.4bn, which is beyond anyone’s power to claw back.
The cause is still preliminary
Teng said the initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container used to submit unauthorised withdrawal transactions. Binance said it found no evidence that a wallet leaked. A later update from the company referred to additional points of breach, so the single-laptop account is not the final one.
Attribution to North Korea has come from the intelligence firms TRM Labs, Chainalysis and Elliptic, which have pointed to overlaps with the 2025 Bybit theft and to the group tracked as TraderTraitor. Those are private companies selling analysis. No government body or law enforcement agency has confirmed it, and Binance itself has named nobody.
What a proof-of-reserves report settles
Binance has now put a firm date on that report. It is due on Monday 2 November, which turns what was a loose plan alongside the original statement into a deadline the company can be held to. These exercises publish the assets held in known exchange wallets against customer balances, usually with a cryptographic structure that lets an individual customer check their own balance was counted.
What that demonstrates is that at one moment in time the wallets held enough. It does not show where the assets came from, whether anything was borrowed for the day, or what obligations exist outside the list. It is considerably better than nothing and it is not an audit of the company.
What a UK customer can actually do
Withdrawals were suspended while deposits stayed open. Co-CEO Yi He has since said the exchange expects to start resuming withdrawals within 48 hours, and that deposits are operating normally in the meantime. That is a target rather than a completed restoration, and starting to resume is not the same as clearing the backlog, so the live status page is a better guide than the announcement.
Crypto held on an exchange is not covered by the Financial Services Compensation Scheme, so there is no £85,000 backstop of the kind that applies to a bank deposit. Binance is not FCA-authorised to carry out regulated activity in the UK, which narrows what the Financial Ombudsman Service can take on. In practice a customer’s claim is a contractual one against the company, on its own terms of service. Our guide to stuck withdrawals covers the steps that are actually available, and our self-custody guide covers the alternative, which carries its own risks rather than none.
We looked at what the drained wallets contained in earlier coverage of the breach, including the reserve data showing customer ether among them.
What to watch
Three things decide whether the reassurance holds. Whether the proof-of-reserves report actually lands on Monday as promised, and who signs it. Whether withdrawals restart inside the 48 hours Yi He has given and then keep running, because the test of an exchange is the second day rather than the first. And whether the outstanding $1.3bn is acquired, and what it costs Binance to buy it in a market that can see the demand coming. The $3bn frozen by issuers sits outside all of that, and no company statement can promise its return.