In a rapid response to the crisis, Binance stated that it has frozen approximately half of the compromised assets, securing around $3 billion. The remaining funds are still in the hands of unidentified actors. To protect the integrity of the exchange, the company initially suspended all deposits and withdrawals but later clarified that deposit functions remain unaffected. Binance has set aside more than $6.34 billion in company funds to cover the stolen assets and is “actively buying” various crypto tokens to offset the loss.
The nature of the attack has evolved in company communications. Initially, Binance suggested the breach may have originated from a compromised laptop belonging to a DevOps engineer, which allegedly allowed for unauthorized withdrawals. However, Co-CEO Richard Teng later indicated that the investigation uncovered “additional points of breach,” suggesting the attack was broader than a single device compromise. Teng noted that the attackers employed a “self-destruct mechanism” that destroyed tooling and digital traces as they moved through the system, a tactic designed to hinder forensic analysis and tracing efforts.
Several analytics firms have linked the hack to a North Korean hacking unit. The US Secret Service confirmed it is “working around the clock” to identify, freeze, trace, and recover the stolen funds. Although Binance stated its US-facing exchange was unaffected, the US Secret Service added that it would “identify the cyber criminals responsible and bring them to justice,” noting that the case involves US-linked assets, including stablecoins Tether and Circle, which are pegged to the US dollar. Binance confirmed it is cooperating with the FBI in these efforts.
Financial markets reacted sharply to the news. On Friday, Bitcoin prices dropped 5% to $76,800 during afternoon trading in New York. The stock of Coinbase, another major crypto exchange, fell 12%, a decline analysts attributed to a combination of the security fears and earnings results that showed revenue slightly below expectations. Robinhood, a financial services platform that facilitates crypto trading, saw its shares drop 7.8%.
The incident has raised significant concerns regarding the legal and financial resilience of major exchanges. Binance, which was founded in China in 2017 and claims more than 300 million registered users worldwide, reported holding over $160 billion in assets under custody in 2024. While the company has repeatedly assured users that “your money is safe, and we’re covering every loss,” legal experts urge caution. Daniel Tunkel of the London-based Edwin Coe law firm warned that such promises may not be legally binding. He noted that recovery would depend on the specific contracts customers signed and that users might need to pursue litigation for non-performance if the company fails to honor its commitments.
Industry observers have drawn parallels to the collapse of FTX in 2022, when CEO Sam Bankman-Fried made similar assurances before the exchange failed, leading to massive customer losses. The current situation highlights the ongoing tension between the decentralized nature of cryptocurrencies and the centralized custodial model used by major exchanges. As law enforcement agencies across the globe coordinate to trace the funds, the incident underscores the persistent threat posed by state-sponsored cyber actors to the financial infrastructure of the digital asset sector.
