Binance Says $6.3 Billion Is Gone. Then It Stops the Doors.

Binance suspended withdrawals after reporting that a security incident affected about $6.3 billion in client assets. The company calls it the largest crypto theft on record. That number is not a rounding error. It is the kind of number that makes you ask who is holding the keys, and why.

Richard Teng, Binance’s co-CEO, said on X: “[Y]our money is safe, and we’re covering every loss.” Binance says it will cover the losses with company funds and has reserved more than $6.34 billion for that purpose. It also says roughly $3 billion of the affected assets had been frozen on-chain.

Those are reassuring statements. They are also statements made by the party that was robbed.

What is known

The documented facts are straightforward. Binance halted deposits and withdrawals while it checked its systems, froze assets, and worked with law enforcement and blockchain-intelligence firms. The company estimated the total impact at about $6.3 billion. It said about $3 billion in affected assets had been frozen.

Binance’s initial account pointed to a compromised DevOps engineer’s laptop. The company later said its investigation had found additional points of breach. That is an important change in language. A single stolen laptop is a bad story. Multiple breach points is a systems story.

The prior record was the Bybit hack in 2025, in which attackers took nearly $1.5 billion in tokens. Binance’s reported loss is more than four times that amount. The scale alone changes the conversation.

What the company claims

Binance says customer funds are safe. It says it can make users whole. It says withdrawals should resume within about 48 hours, with a target of Sunday morning.

I have heard versions of this before. “Funds are safe” can mean the customer ledger is intact. It can also mean the exchange intends to backstop the hole with its own capital. Those are not the same thing, though they are often presented as if they are.

The promise to cover losses matters. So does the source of the money. Binance says it has reserved more than $6.34 billion, including $5 billion already held in the affected tokens. It says it is buying more tokens to cover the rest. That is a large, immediate balance-sheet claim, and it deserves scrutiny once the panic fades.

What remains unknown

We do not yet know the final accounting. Reports differ on how much was frozen, where the assets moved, and whether the theft is fully contained. Binance has not attributed responsibility to any individual, even though some outside analysts have linked the attack to North Korea.

We also do not know how a platform of Binance’s size allowed unauthorized withdrawals at this scale. The company says it is reviewing cloud systems, employee devices, private-key management, and transaction-signing procedures. Those are the right places to look. The fact that they need reviewing is the problem.

The timing is uncomfortable. Polymarket reported a separate security incident that wiped out around $2.7 million in user funds. The two events are distinct. But they arrived together, and together they make the same point: digital finance is still learning what operational security costs.

The old pattern

I remember 2000. I remember 2008. In both cases, people were told the system was sound until the moment it was not. The details were different. The confidence was not.

Crypto has always sold itself on self-custody, transparency, and code instead of trust. Yet most users do not hold their own keys. They hold an account at an exchange. They rely on Binance’s controls, Binance’s staff, Binance’s vendors, and Binance’s promise to make them whole.

That is not decentralization. That is a custody business with better marketing.

The industry will say this was an exceptional attack. Perhaps it was. But exceptional events test ordinary assumptions. If $6.3 billion can leave a major exchange, users are entitled to ask what “safe” means before the next announcement.

Binance may restore withdrawals on schedule. It may recover more assets. It may honor every loss. I hope it does. But trust is not restored by a pledge issued during an outage. It is restored by a clear post-mortem, independent verification, and a system that does not require a $6.3 billion rescue to prove it works.