Binance says user funds are safe after thieves make off with billions in largest-ever crypto hack

The Binance breach was a rapid theft involving wallets connected to the exchange. More than $6 billion appeared to move through them in about 20 minutes. Binance said its investigation found multiple breach points, after initially blaming a compromised laptop. The attackers had not apparently accessed customer accounts or holdings.

The affected money belonged to Binance’s corporate holdings, according to co-CEO Richard Teng. Binance said it had reserved $5 billion to cover losses and was seeking another $1.34 billion in cryptocurrency. That response aimed to reassure users that their assets remained safe, even as the exchange investigated.

The attackers had not been identified by Friday morning. Several blockchain analysis firms said the operation resembled earlier activity linked to North Korean actors, but Binance had not confirmed that conclusion. The Secret Service and private-sector partners were tracing, freezing, and pursuing recovery of the funds.

A cryptocurrency exchange is a platform that lets people trade digital assets and often stores those assets for customers. It works somewhat like a financial marketplace, matching buyers and sellers and recording account balances. Binance is an example. Exchanges matter because they make crypto easier to buy and sell, but they also create large, attractive targets.

A personal crypto wallet is software or hardware that lets someone control access to crypto holdings. It does not function as an exchange. Instead, it helps authorize transactions on the blockchain. In a personal wallet, the user normally controls the credentials needed to move funds. On an exchange, the platform commonly manages custody and access on the customer’s behalf.

That distinction explains Binance’s reassurance. The company said hackers affected corporate holdings, not customer accounts or holdings. However, exchange users still depend on the platform’s security, internal controls, and ability to respond when assets are stolen.

The scale was enormous. Binance announced that more than $6 billion appeared to have moved through wallets connected to the security breach. The movement unfolded in roughly 20 minutes, beginning around 4 p.m. Eastern Time on Thursday. Those figures describe funds passing through linked wallets, not necessarily money permanently lost.

Around $3 billion had potentially been located and frozen across several exchanges. It was not immediately clear whether those assets could ultimately be recovered. Tether and Circle also acted quickly to freeze implicated assets, while the Secret Service worked with private-sector partners to trace and recover stolen funds.

The recovery outlook remained uncertain. Blockchain analysis firm TRM Labs estimated that $2.4 billion in Bitcoin and Ethereum would never be recovered. The figures could change as investigators continued tracing transactions, identifying breach points, and determining who controlled the wallets involved.

Companies such as Tether and Circle operate stablecoins, cryptocurrencies designed to maintain a stable value. Their systems can include controls that let the companies block or freeze specific tokens. That gives them a direct way to stop some stolen assets from moving, unlike cryptocurrencies over which no single company has the same control.

The article says Tether and Circle quickly froze assets implicated in the Binance hack. Circle also worked with the Secret Service. Investigators and blockchain analysis firms can examine the public trail of transfers, connect wallet activity, and flag destinations holding suspected proceeds. Exchanges can then restrict deposits or withdrawals involving those assets.

Freezing does not automatically mean the money is recovered. Binance said about $3 billion had potentially been located and frozen, but recovery was not certain. TRM Labs estimated that $2.4 billion in Bitcoin and Ethereum may never be recovered, showing the limits of tracing after funds move.

The breach threatens Binance’s reputation, finances, and standing in an already pressured industry. The exchange said it had set aside $5 billion to cover losses and planned to buy another $1.34 billion in cryptocurrencies. Even with that response, the size of the theft could make users, regulators, and investors question Binance’s safeguards.

Markets reacted immediately. Bitcoin fell more than 5% overnight to approximately $77,000, accelerating its month-long decline. Other affected cryptocurrencies fell as much as 9%. The hack followed the collapse of FTX and Congress’s failure to pass the Clarity Act, adding to a difficult period for digital assets.

The broader impact may be reputational. Experts said Binance would need to cover losses partly to protect its value and reputation. Other crypto firms cooperated by freezing assets. That solidarity may limit damage, but the attack could prolong doubts that crypto is too volatile and vulnerable to criminal activity for widespread use.

The central difference is the cause. Binance was hit by a cyberattack that moved cryptocurrency through wallets connected to a security breach. The attack unfolded in about 20 minutes, and Binance said corporate holdings were affected while customer funds remained safe. Investigators were still examining how the breach happened.

FTX’s failure followed a different path. The article describes the exchange’s collapse as not the result of a cyberattack, although it also caused billions in losses. FTX had initially told users their funds were safe amid a wave of losses, a response later referenced by an X user reacting to the Binance incident.

Both episodes damaged confidence in crypto exchanges and the wider industry. Binance’s hack highlights cybersecurity and recovery problems. FTX’s collapse represents a different kind of exchange failure. Together, they reinforce concerns that digital assets remain vulnerable to major losses, whether caused by hackers or other breakdowns.

A blockchain is a shared record of cryptocurrency transactions. A wallet is a software or hardware tool that holds the credentials used to authorize transfers. The wallet does not usually contain coins in a physical sense. It lets its controller approve movements recorded on the blockchain. This system allows transactions to be checked without a traditional central ledger.

When someone authorizes a transfer, the network verifies that the transaction meets its rules and records it. Investigators can then follow the movement between wallet addresses. That public trail helped blockchain analysis firms and law enforcement trace funds in the Binance case, while companies such as Tether and Circle froze some implicated assets.

Authorized transactions are usually difficult to reverse because the blockchain is designed to preserve its recorded history. A mistaken or fraudulent transfer generally cannot simply be canceled by a bank. Recovery may require the recipient’s cooperation, an asset issuer’s intervention, or law enforcement action, and success is not guaranteed.