Binance faces major test of customer confidence after record $6.3 billion cryptocurrency theft
By Mashood Siddiqi — SCN NEWS
BOSTON/SINGAPORE — Binance, the world's largest cryptocurrency exchange, pledged to cover approximately $6.3 billion in losses from company funds on Friday after a cyberattack exposed major weaknesses in its transaction security systems, triggering a decline in cryptocurrency prices and raising concerns about the safety of digital assets held by centralized trading platforms.
The exchange said it had internally allocated approximately $6.34 billion to compensate for the stolen assets and was working with industry partners to identify and freeze funds linked to the attack. About $3 billion in affected assets had been located, although the company had not established how much of the remaining $3.3 billion could be recovered.
The breach, described by blockchain investigators as potentially the largest financial theft ever recorded, has placed Binance under pressure to demonstrate that its financial reserves can withstand an unprecedented security failure without exposing customers to losses.
Binance co-chief executive Yi He said the approximately $3 billion figure represented about 2% of the exchange's total user assets and publicly disclosed reserves. The company maintained that customer funds remained safe and said it was preparing to restore withdrawal services while conducting a comprehensive review of its security infrastructure.
The exchange's technical team was targeting the resumption of withdrawals within approximately 34 hours of its Friday afternoon update. Binance also announced plans to produce an initial proof-of-reserves snapshot, with results expected to become available by Monday, as it sought to provide customers with additional information about its financial position.
The scale of the attack has intensified scrutiny of how major cryptocurrency exchanges safeguard digital assets and authorize transactions involving billions of dollars. Unlike conventional banking transactions, cryptocurrency transfers can be difficult to reverse once funds have moved into wallets controlled by attackers.
According to Binance co-chief executive Richard Teng, the breach involved a compromised laptop and malicious software designed to erase evidence of the intrusion. The attackers manipulated a transaction approval system to transfer assets from an internet-connected wallet controlled by Binance without passing through normal authorization procedures.
The circumstances have raised questions about the effectiveness of internal security controls at an exchange responsible for safeguarding substantial cryptocurrency holdings. Investigators are examining how the attackers gained sufficient access to bypass approval safeguards and transfer assets before the breach could be contained.
Blockchain analysis firms TRM Labs and Chainalysis identified similarities between the Binance attack and previous cryptocurrency thefts attributed to North Korean hackers. The bulk of the stolen assets was transferred during an approximately 20-minute period beginning late Thursday, according to the investigators.
The suspected connection to North Korea remains an assessment by cybersecurity researchers rather than a publicly established finding. North Korea has previously denied allegations that it operates state-backed cryptocurrency theft networks.
The attack has also drawn the attention of American law enforcement agencies. The FBI said it was coordinating with public and private partners to determine the scope of the incident, while the U.S. Secret Service reported working with cryptocurrency companies to trace, freeze and recover stolen assets.
Stablecoin issuers Tether and Circle moved to restrict access to funds associated with the breach. Tether reported freezing nearly $1.57 billion in affected assets, while Circle froze more than $800 million, demonstrating the role that centralized stablecoin operators can play in disrupting attempts to move stolen cryptocurrency.
However, locating or freezing assets does not necessarily mean they have been returned to their rightful owners. The eventual financial impact will depend partly on the success of recovery efforts and Binance's ability to meet its commitment to absorb losses.
The security incident has also unsettled cryptocurrency markets, with investors reassessing their exposure to digital assets and trading platforms.
Bitcoin fell to a six-week low of approximately $76,368 on Friday, while ether declined more than 3% to a two-month low near $2,178 before prices stabilized. Binance's BNB token lost approximately 6.4% over 24 hours, reflecting pressure on the exchange's associated digital asset.
Shares of publicly traded cryptocurrency businesses, including Coinbase, Strategy and Robinhood, also declined as concerns about the breach spread beyond Binance.
The market reaction comes at a time when the cryptocurrency industry is already facing pressure from higher U.S. interest rates and weaker demand from some institutional investors. The attack has introduced another source of uncertainty by exposing the operational risks associated with platforms that hold digital assets on behalf of customers.
Binance reported approximately 335 million registered users worldwide and assets under custody of about $162.8 billion in its 2025 annual report. Its size makes the security incident particularly significant for an industry in which a relatively small number of large exchanges handle substantial trading activity and customer deposits.
The company maintains a separate bitcoin-denominated protection fund valued at approximately $1 billion, intended to provide additional safeguards against certain security-related losses. Its latest commitment to cover the breach from company resources goes substantially beyond that fund's reported value.
The incident follows a series of major cryptocurrency thefts that have exposed vulnerabilities in digital asset infrastructure. Researchers at TRM Labs estimated that approximately $2.9 billion was stolen across nearly 150 cryptocurrency attacks in 2025, highlighting the scale of the industry's continuing security challenges.
The latest theft exceeds that annual figure in a single incident, increasing pressure on exchanges to demonstrate stronger transaction authorization systems, independent security reviews and transparent financial reporting.
Financial regulators are also monitoring developments. Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating license, said it was engaging closely with the company and following the incident.
The immediate challenge for Binance is to restore normal operations while demonstrating that its financial commitments are supported by accessible reserves. The promised proof-of-reserves disclosure and the outcome of the security investigation are likely to provide important information about the company's ability to recover from the attack.
Although Binance has promised that customers will not bear the financial losses, the full extent of the breach, the identity of those responsible and the amount ultimately recoverable remain unresolved.