Binance pledges $6.34B of its own funds after record $6.3B hot-wallet theft

Binance, the world's largest crypto exchange, says it will cover the largest crypto theft ever recorded out of its own pocket. According to an update the exchange gave CoinDesk, attackers drained an estimated $6.3 billion from Binance hot wallets late Thursday, and the company has set aside more than $6.34 billion in corporate resources to restore affected balances one-for-one. Nearly every hard number in the story so far traces back to Binance itself or to the blockchain analysts tracking the stolen coins; there is no independent audit of the hole yet, and that distinction matters for how much weight to put on the reassurances.

What happened

The money left fast. CoinDesk reports that the outflows spanned multiple blockchains and lasted roughly 20 minutes, carrying off bitcoin, ether, the stablecoins USDT and USDC, and a tail of smaller tokens. Binance initially attributed the breach to a compromised DevOps engineer's laptop, which it said let attackers push unauthorized withdrawal requests through internal systems. It later told CoinDesk it had found additional exploit points but did not describe them, while maintaining it has seen no evidence that any wallet private keys were stolen.

Blockchain analytics firms Chainalysis and TRM Labs have, per CoinDesk, linked the attack "with high confidence" to the North Korean hacking operation blamed for previous large-scale thefts, citing the sophistication and speed. Chainalysis said it is observing laundering techniques it has never seen before: thousands of transactions in a very short window, coins circulated repeatedly among many addresses and looped back to wallets seen earlier in the chain. One recurring tell is addresses receiving exactly 1 TRX before passing along larger sums — what Chainalysis calls a programmatic attempt to scramble the trail at scale. Aidan Larkin, co-founder and CEO of seized-asset firm Asset Reality, called it "agentic money laundering."

Not all of the loot is moving. A CoinDesk blockchain trace found $1.4 billion of the stolen bitcoin — 18,270 coins — sitting in 19 wallets, 17 of them holding exactly 1,000 BTC each, none of which had moved since Thursday night. Because those are self-custodied bitcoin addresses, no exchange or issuer can freeze them.

How Binance says the backstop works

The exchange's spokesperson told CoinDesk that $5 billion of the $6.34 billion is already held in the exact token assets that were affected, so balances can be restored without altering or touching customer funds. It said it is completing the rest by buying the missing tokens through public markets and over the counter so reserves match what users lost. Those figures, the spokesperson stressed, exclude frozen assets. Binance put the frozen total at $3 billion "with thanks to our industry partners"; CoinDesk's newsletter adds that $2.3 billion of that is USDT and USDC — stablecoins whose issuers can freeze addresses, which is why so much of the recoverable sum is in stablecoins rather than bitcoin. The company is also leaning on its Secure Asset Fund for Users (SAFU), an emergency reserve that has typically held around $1 billion in bitcoin. "Ultimately, all user funds will be verified publicly through our Proof of Reserves," the spokesperson said.

Deposits remain open; withdrawals are paused pending security checks. Binance had previously said withdrawals could resume in roughly 45–48 hours.

Key facts

• ~$6.3 billion stolen from Binance hot wallets late Thursday, across multiple chains, in a ~20-minute burst (Binance via CoinDesk).
• $6.34 billion set aside by Binance, $5 billion already in matching token assets; remainder being bought on public markets and OTC (Binance via CoinDesk).
• $3 billion frozen with partners, including $2.3 billion in USDT/USDC; separate from Binance's reserves (Binance via CoinDesk).
• SAFU fund, typically ~$1 billion in BTC, also in play (CoinDesk).
• Attack linked "with high confidence" to North Korean hackers (Chainalysis, TRM Labs via CoinDesk).
• $1.4 billion (18,270 BTC) parked unmoved in 19 unfreezable wallets (CoinDesk blockchain trace).
• Crypto liquidations of ~$1.5–1.57 billion; BTC around $77,368 (CoinDesk).
• FUN token crashed 90% after the hacker dumped it (CoinDesk).
• 322 hack incidents in 2026, >$8.7 billion in losses (DefiLlama via CoinDesk).

The derivatives footprint

The hedging started before the public did. Nicolas Quatravaux, head of EMEA at institutional liquidity network Paradigm, told CoinDesk the first big block trade hit at 20:38 UTC — about 15 minutes after the first Binance outflows and before any news broke: 250 one-BTC lots of $78,000 puts expiring Oct. 31, roughly $20 million notional. Three minutes later another 250-lot clip of the same put traded, with the buyer paying about 35% more. Over the following eight hours Paradigm traded around $590 million in notional BTC options blocks — about half of all BTC options block volume on Deribit over the same stretch, per Quatravaux. The flow was lopsidedly bearish, concentrated in puts near spot (strikes of $74,000–$78,000), which Paradigm reads as conviction hedging against a near-term drop rather than crash-lottery bets. One-week put skew spiked as high as 18% during Asian hours Friday, CoinDesk reported. It wasn't unanimous: Deribit saw a ~$190 million multi-leg put strategy and 500-BTC blocks of November $64,000 puts, but also "some flow in March calls," Quatravaux noted — "so not everyone was playing defense."

The real-world read

Treat the comforting numbers as the exchange's own, because that's what they are. The $6.34 billion pledge, the $5 billion in matching tokens, the SAFU fund — all come from Binance, delivered to CoinDesk by a spokesperson, with no third-party verification yet. The promised check on that is Binance's own Proof of Reserves, which is an attestation the exchange controls, not an independent audit.

Two things sit in tension with the reassurance. First, Binance's own account of the breach has already shifted: it started with a single compromised laptop and later conceded "additional exploit points" it won't describe — a moving story while it insists no private keys were taken. Second, the freeze math cuts against the headline. Of the $3 billion frozen, $2.3 billion is centrally freezable stablecoins; meanwhile $1.4 billion in bitcoin sits in self-custodied wallets no one can touch. "Frozen" and "recovered" are not the same word — recovering frozen assets runs through law enforcement and can take time, and thinly traded tokens are worse. The FUN token's 90% crash when the hacker dumped it shows how little market there is to buy back some of what was lost; a one-for-one restoration is hardest exactly where liquidity is thinnest.

Also worth naming: the first put trades landing 15 minutes after outflows began and before the news was public is, at minimum, a reminder that on-chain outflows are visible to whoever is watching, and someone was.

Opinion, and whose

• OKX founder Star Xu called for executives to coordinate as they did in the 2017 fork crisis — instant settlement between verified exchanges, extra checks and short delays on large withdrawals to unknown addresses, rules enforced at the cryptographic signing layer, real-time incident alerts, and faster lawful freezes. "Even if an attacker compromises an exchange's wallet management system, they should not be able to bypass these fundamental security restrictions," he wrote.
• Standard Chartered warned the market weakness may persist, with a new base forming only once hack details emerge and frozen coins are unfrozen.
• Binance says it will "weather this storm" and cover any confirmed shortfall — the exchange's own characterization.

Sources

• CoinDesk, "Binance arranges $6.34 billion to cover losses from record crypto hack" (Oct. 30, 2026) — Tier 2 secondary; the hack scale, Binance's reserve pledge and spokesperson quotes (Binance is an interested party speaking to its own solvency), SAFU, attribution to North Korea via Chainalysis and TRM Labs, laundering mechanics, Star Xu's proposals, DefiLlama figures.
• CoinDesk "Daybook" newsletter, "Here's how big bitcoin traders responded after the Binance hack hit" (Oct. 30, 2026) — Tier 2 secondary; Paradigm and Deribit options flows via Paradigm's Nicolas Quatravaux, put-skew data, the $2.3 billion stablecoin breakdown of frozen funds, the 19-wallet bitcoin trace, Standard Chartered's note.

No primary filing or independent audit of the loss was available at publication; the loss and reserve figures are Binance's own, and the attribution and on-chain figures come from the cited analytics firms.

This is news reporting, not financial advice; it is not a recommendation to buy or sell anything.