Statements

frozen funds don’t necessarily equate to recovered funds. Immobilizing assets prevents the suspected attackers from spending them, but it doesn’t automatically return them to Binance or its users.

“USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol.”

Elliptic also cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible.

TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging and pre-signed authorizations.

Selig characterized the attack as a laptop-introduced vulnerability rather than a blockchain flaw—but Binance has since found “additional points of breach.”

America's lead federal agency for investigating financial crimes added that it would "identify the cyber criminals responsible and bring them to justice", while Binance also said it was working with the FBI.

The company said in 2024 that it had more than $160bn in assets under its custody.

This was not carried out by one person.

It had initially suspended all deposits and withdrawals - but then said in an update that "deposits remain unaffected".

Several experts have warned customers not to regard Binance's promise to cover losses as legally binding and said they may need to pursue litigation to recover them.

But crypto history watchers have been pointing out online that this is exactly the kind of message that FTX CEO Sam Bankman-Fried gave before his crypto exchange collapsed in 2022, leading to huge losses for customers and the industry.

Temporarily suspended withdrawals while conducting additional security reviews, implementing remediation measures and validating the integrity of affected systems.

We are buying the remaining 20% of the lost token assets. We plan to run an initial Proof Of Reserves snapshot in 12 hours and have the result ready by Monday 2026-11-02.

We have already set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets that were stolen, such as USDC, USDT, BTC, ETH, BNB, etc. This means that we have already covered approximately 80% of the impacted amount.

We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.

For verified updates, please follow Binance's official channels only, or contact us directly through the official Customer Support.

we will provide a detailed technical report outlining what happened, the lessons learned and the additional safeguards being implemented.

We expect to share further technical findings within about 48 hours once they have been verified and their disclosure will not compromise ongoing investigative efforts.

Binance will cover all stolen funds related to this incident through our Secure Asset Fund for Users (SAFU) and our corporate treasury.

The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach.

Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.

Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.

Blockchain security firm Blockaid said its team had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.

Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation.

In September the cryptocurrency exchange Bitget said roughly $350m in crypto had been stolen from its platform