Binance has moved to reassure users and the wider cryptocurrency market that it has sufficient resources to absorb losses stemming from the massive security breach that affected the world’s largest cryptocurrency exchange.
The company has committed to covering losses from the incident through its Secure Asset Fund for Users (SAFU) and company funds, after blockchain investigators traced approximately $6.36 billion in cryptocurrency moved from Binance-controlled wallets.
The scale of the incident makes it one of the largest cryptocurrency thefts ever recorded. Blockchain intelligence firm TRM Labs said an attacker moved approximately $6.36 billion across 10 blockchains, with most of the transfers occurring within about 20 minutes.
Binance Says User Funds Are Safe
Binance said its investigation initially indicated that a compromised laptop belonging to a DevOps engineer may have allowed an attacker to access a service container and submit unauthorised withdrawal transactions.
The exchange stressed that it had found no evidence that wallet private keys were leaked. It also said the initial investigation was continuing and that a more detailed technical post-mortem would be released after the facts had been fully verified.
Binance temporarily suspended deposits and withdrawals as a precaution, revoked the affected address authorisation and began working with law-enforcement agencies and blockchain intelligence companies to trace the stolen assets.
The company estimated the overall financial impact at around $6.3 billion and said approximately $3 billion of affected assets had already been frozen on-chain.
Company Funds to Absorb the Loss
Binance's commitment to cover the losses is significant because it means the exchange is not asking customers to bear the financial consequences of the breach.
The company said losses would be covered through SAFU and its own corporate funds, while customer assets would remain protected. Binance also plans to publish an updated Proof of Reserves after its remediation work is complete.
Reuters reported that Binance co-founder Yi He separately said the exchange does not need to sell its SpaceX investment to finance the losses. She said Binance's annual revenue is sufficient to absorb the financial impact.
That statement followed a post by Binance founder Changpeng Zhao, who said the exchange held more than $1 billion worth of SpaceX shares. Zhao also said that, although he no longer manages Binance, he expected customer funds to be fully covered.
Investigators Point to North Korea
The identity of the attackers has not been officially established by Binance or law-enforcement authorities.
However, multiple blockchain intelligence firms have attributed the attack to a North Korean hacking operation.
TRM Labs said it had high confidence that the TraderTraitor group, which it describes as an elite North Korean hacking unit, was behind the attack. Chainalysis also said the breach was likely carried out by TraderTraitor.
Investigators pointed to similarities between the Binance incident and previous cryptocurrency thefts linked to North Korean hackers, including the $1.5 billion Bybit hack in 2025.
Binance itself has not publicly confirmed that North Korea was responsible. Instead, the exchange said it was working with law-enforcement partners to establish the identity of those responsible.
About $3bn in Assets Frozen
One of the most important developments following the breach has been the industry's coordinated effort to prevent the attackers from converting the stolen cryptocurrency into usable funds.
Binance said about $3 billion worth of affected assets had been frozen on-chain through cooperation with blockchain partners.
Reuters reported that the remaining roughly $3.3 billion had not yet been accounted for in Binance's initial update, although investigators continued tracking the movement of the assets across multiple blockchain networks.
The ability to freeze some of the assets demonstrates one of the unusual characteristics of cryptocurrency theft: although transactions can move rapidly across borders and networks, blockchain transactions remain publicly traceable.
Stablecoin issuers and other industry participants can also sometimes freeze assets when stolen funds enter wallets under their control.
Why the Incident Matters
The breach is significant beyond the immediate financial loss because Binance is the world's largest cryptocurrency exchange.
Analysts have warned that a security incident of this magnitude could affect confidence in centralised cryptocurrency exchanges, particularly if customers become concerned about the security of assets held on trading platforms.
Reuters reported that Bitcoin fell to a six-week low following the incident, while Ether also declined as investors reacted to the scale of the breach and uncertainty surrounding the movement of the remaining funds.
At the same time, the company’s commitment to absorb the losses is designed to separate the exchange's corporate financial exposure from customers' holdings.
Binance has repeatedly stated that user funds are safe, while its investigation continues.
Investigation Remains Ongoing
Despite the enormous value involved, several important details remain unresolved.
Binance has not completed its technical investigation and has not publicly established exactly how the attackers gained the level of access required to authorise the transactions.
The company's initial theory focused on a compromised DevOps engineer's laptop. However, Binance later indicated that investigators had identified additional potential breach points.
The exchange has also not independently confirmed the North Korean attribution made by blockchain intelligence firms.
For now, Binance is working with law enforcement and blockchain analytics companies to identify the attackers, freeze additional assets where possible and recover funds.
The company has said it will publish a detailed technical post-mortem after its investigation is complete.
The incident nevertheless represents a major test for the cryptocurrency industry's security infrastructure. With approximately $6.36 billion in assets moved in the attack and billions already frozen, attention is now focused on how much of the remaining cryptocurrency can be recovered and what security changes Binance will make once the investigation concludes.
