Binance Sets Aside $6.34 Billion to Cover User Losses After Security Incident

Binance Commits $6.34 Billion

Binance said on October 30 it has committed more than $6.34 billion of its own corporate funds to restore the digital assets stolen in a security incident the exchange estimates at roughly $6.3 billion. Its official statement says about $5 billion of that amount is already held in the same tokens that were affected, and the exchange is buying the remainder through spot market transactions and over-the-counter (OTC) deals. The company's aim is to refill the exact asset types that left customer balances, rather than settle losses in dollars alone, so each affected token's holdings return to their pre-incident state. Not all of the committed money has been converted into tokens yet; Binance flagged two execution constraints, since some affected tokens trade with limited liquidity and OTC purchases need settlement time, which means completing every buy could take a while. The $6.34 billion figure describes the corporate resources prepared to bear the loss, not assets already back in user accounts, and the statements did not list the affected tokens by name. Alongside the buyback, the exchange is working with law enforcement agencies, token issuers and blockchain analytics firms to recover stolen funds, and it will publish an updated Proof of Reserves report once user balance verification is complete.

Update (30 Oct 12:11 UTC): Tether and Circle have jointly frozen more than $2.3 billion in stablecoins tied to the incident, a development the exchange's latest security update confirms as part of the roughly $3 billion now frozen on-chain.

$3 Billion Frozen, Not Yet Recovered

The frozen funds sit in a separate bucket. With help from partners across the web3 industry and from asset issuers, roughly $3 billion of the stolen money has been frozen on-chain, with freezes typically enforced at the smart contract level. Freezing stops the funds from moving, but it does not hand them back: the amount actually recovered still depends on follow-up recovery and verification procedures with the relevant institutions and law enforcement. Binance stressed that the $6.34 billion it has set aside excludes the frozen or protected assets, so the compensation pool and the recovery track cannot be treated as the same money. The two efforts run in parallel: corporate funds fill the asset gap so users get balances back in the same tokens, while the exchange keeps chasing the stolen assets themselves. Binance also thanked the partners who assisted with the freezing work and said recovery procedures with the relevant institutions are advancing. Any amount later clawed back on-chain would reduce the company's final financial burden, though no guarantee exists that the full $3 billion will come back, and dollar values attached to frozen balances will move with token prices.

More Suspected Entry Points

The security investigation has widened beyond the first lead. Early findings pointed to a single compromised machine belonging to a DevOps engineer, whose computer may have given the attacker access to the systems used to authorize withdrawals. The exchange's latest update says the incident may involve additional suspected entry points, which makes the attack path more complex than initially assessed. Binance has not disclosed the affected systems beyond that and promised a detailed technical report once every stage of the attack is confirmed. So far the disclosed entry points concern internal infrastructure, and nothing in the company's statements indicates user-facing KYC data was involved. Service status remains mixed: deposits have kept running normally, meaning customers could still move assets onto the platform while the withdrawal path was being hardened. Withdrawals stay paused for a security upgrade and are expected to resume within roughly 45 hours of the update. Once remediation is complete, the exchange plans to publish an updated Proof of Reserves report so users can verify that customer assets are fully backed, and it committed to further progress updates on both the buyback and the recovery work.

The market-facing part of the plan is the roughly $1.34 billion of purchases still outstanding. Buying back the same tokens adds demand exactly where liquidity is thinnest, and the price impact of each purchase scales with a token's circulating supply and free float, so lower-cap assets face more pressure than large ones. Splitting the buys between spot and OTC desks is how the exchange mutes that effect. The milestones to watch are concrete: withdrawals resuming within about 45 hours, the updated Proof of Reserves report after balance verification, and the technical report on the wider entry points. The compensation pool's final size could also shrink if recoveries land before every purchase completes. Until the frozen $3 billion is actually returned, Binance's net cost on this incident stays open-ended.

Market reaction has added pressure on top of the operational fallout, with bitcoin briefly sliding to the $76,000 level after the incident, and on-chain data showing the exchange's bitcoin holdings slipping from above 700,000 to roughly 682,300 BTC, a movement consistent with assets leaving for external wallets. Several market analysts argue the shock should stay short-lived because the incident is an external theft rather than the misuse of customer funds that sank FTX in 2022. They point to Bybit's $1.5 billion hack in February 2025, which the exchange absorbed while keeping withdrawals running, as the closer precedent. One caution remains: the SAFU insurance fund is estimated at about $1 billion, well below the loss, so covering user balances will require further corporate outlays.

Tether and Circle have jointly frozen more than $2.3 billion in stablecoins tied to the incident, a development the exchange's latest security update confirms as part of the roughly $3 billion now frozen on-chain. The exchange's preliminary findings show no evidence that wallet private keys were leaked, with the attacker reportedly gaining access through a compromised service container after a DevOps laptop was breached, and submitting unauthorized withdrawal transactions. Binance co-CEO He Yi reiterated that the SAFU fund and the company's own capital will absorb all losses from the hack.