Binance Pledges to Cover All User Losses Following $6.3 Billion Security Incident

Binance has pledged to cover all financial losses resulting from a major security incident that has affected its cryptocurrency infrastructure. The exchange announced on October 30, 2026, that it would use its Secure Asset Fund for Users (SAFU) and company resources to protect customers from the financial consequences. The incident has an estimated impact of approximately $6.3 billion, according to Binance’s preliminary investigation. The company says its customers’ funds remain safe and that users will not bear the financial losses. The announcement comes as the exchange works with law enforcement agencies, blockchain intelligence firms and cryptocurrency partners to investigate the incident, trace the affected assets and strengthen its security systems.

According to Binance’s initial investigation, the incident may have started when an attacker compromised a laptop belonging to a DevOps engineer. This reportedly provided an opportunity to access a service container and submit unauthorised withdrawal transactions. Binance has stated that it has found no evidence that wallet private keys were leaked. However, the company has not yet published a complete technical explanation of how the attack occurred. Its security teams are continuing to investigate the compromised computer, affected addresses and possible entry points. Binance has also revoked authorisation for the affected address and is cooperating with relevant authorities to identify those responsible. The company says it will release a detailed technical report after the investigation has been completed and the findings verified.

One of the most significant developments is the recovery and freezing of affected cryptocurrency. Binance initially reported that approximately $3 billion had been frozen on-chain through cooperation with blockchain partners and other industry participants. Stablecoin issuers Tether and Circle have also taken action against assets connected to the incident. Tether reported freezing nearly $1.57 billion, while Circle froze more than $800 million. Ripple reportedly froze approximately $200 million, with additional assistance from other industry participants. These actions are intended to prevent the affected funds from being moved or converted into other assets. Nevertheless, the recovery process remains ongoing, and the status of the remaining affected funds has not been fully established.

The security incident also forced Binance to introduce temporary restrictions while it reviewed its systems. In its latest service update, the exchange said deposits were operating normally, but withdrawals remained suspended as engineers worked on security improvements to withdrawal services and related addresses. Binance initially indicated that withdrawals could resume within approximately 45 to 48 hours, depending on the completion of its security checks. The incident triggered concern across cryptocurrency markets, with Bitcoin falling to a six-week low of approximately $77,646, while Ethereum also recorded a decline. BNB, the token associated with the Binance ecosystem, experienced additional selling pressure. The market reaction demonstrates how a major security problem at a centralised exchange can affect confidence across the wider digital-asset industry.

The incident has renewed concerns about the security of centralised cryptocurrency exchanges and the growing sophistication of cyberattacks targeting digital assets. Blockchain analytics firms TRM Labs and Chainalysis have attributed the suspected attack to North Korea-linked hacking operations, although Binance has not independently confirmed responsibility. The incident could become one of the largest cryptocurrency thefts ever reported if the full estimated impact is confirmed. Binance says it will publish an updated Proof of Reserves after completing its security remediation, providing customers with additional information about the assets backing their balances. The exchange’s immediate priority is to secure its infrastructure, restore normal withdrawal services and recover as much of the affected cryptocurrency as possible. Its promise to cover all losses will be an important test of customer confidence as the investigation continues.