Binance Hack of $6.3B: Record Loss Highlights Exchange Risk

Binance has pegged the estimated impact of its reported security breach at around $6.3 billion, while saying $3 billion in crypto has been verified as frozen. As investigators trace how the attack unfolded, the exchange says it has begun coordinating recovery efforts with law enforcement and is preparing a refreshed proof-of-reserves update.

The latest updates in Cointelegraph’s live coverage center on how Binance plans to restore normal operations, what was frozen, and why analysts believe the hack likely involved compromised systems rather than a simple “one-click” incident. Several DeFi protocols and stablecoin issuers have also taken precautionary measures or issued statements tied to the frozen assets.

Key takeaways

• Binance estimates the breach at ~$6.3B, with $3B verified frozen; the total could rise as tracing continues.
• Withdrawals are being targeted for resumption within a tight window, alongside a commitment to publish a full proof-of-reserves report by Monday.
• Binance says company funds are covering losses, setting aside more than $6.34B and already holding $5B in matching tokens.
• Several major tokens are frozen or restricted, including USDT, USDC, RLUSD, USD1, XUSD, and selected wrapped or gold/pax products.
• DeFi collateral protections are rolling back: Aave reopened deposits and borrowing across all V3 and V4 markets after a precautionary freeze.

Binance outlines the operational path back to normal

Following the hack disclosure, Binance moved to contain the situation by pausing certain outflows and conducting security checks. In updates shared by co-CEO Richard Teng, the exchange said it is aiming to resume withdrawals within about 40 hours and publish a full proof-of-reserves report by Monday.

Teng also described the breach as more complex than a single unauthorized action. He said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, adding that the delegation “did not pass through our normal approval controls.” Binance further stated that it discovered additional breach points during the investigation, after initially pointing to a potentially compromised engineer’s laptop.

Binance’s communications also indicated an attacker attempt to reduce evidence: Teng said the intruder used a “self-destruct mechanism” to destroy tools and traces during the incident, complicating attribution and recovery efforts.

How much is frozen—and which assets are involved

Binance’s figures provide the clearest snapshot yet of the scale and containment of the hack. The exchange said the estimated total impact is around $6.3 billion, while the verified total value of crypto it has frozen is $3 billion. Binance noted that the frozen amount could increase as tracing continues.

In its list of frozen assets, Binance named a range of stablecoins and tokenized products, including Tether (USDT), USDC, RLUSD, World Liberty Financial USD (USD1), StraitsX USD (XUSD), and wrapped or related assets such as WBETH. It also referenced Tether Gold (XAUT), Pax Gold (PAXG), and Pax Dollar (USDP), along with Arbitrum (ARB) among other items.

Separately, Binance said it has set aside more than $6.34 billion in company funds to cover losses, including $5 billion already held in the same tokens stolen. The exchange clarified that some of those funds were already held in custody in matching assets, while additional purchases would be made through market and OTC transactions to address token shortfalls where needed. Binance also said certain frozen or protected assets were not part of that allocation and that recovery efforts for the remaining frozen value were continuing alongside law enforcement and industry partners.

Law enforcement coordination and broader industry response

As the investigation progressed, Binance said it is working with the FBI to help recover some of the stolen funds, according to a source familiar with the matter cited by Cointelegraph earlier in the coverage. At the same time, stablecoin and ecosystem actors moved to restrict suspected exposure.

Ripple said it was freezing RLUSD linked to the Binance hack and coordinating with relevant parties to support the investigation, though it did not disclose the amount. Tether and Circle also reported freezes tied to the suspected incident earlier in the reporting cycle; Cointelegraph noted that Circle CEO Jeremy Allaire said it froze more than $800 million in USDC, and Tether CEO Paolo Ardoino said it froze more than $1.567 billion in USDT linked to the potential exploit.

In the DeFi layer, these measures mattered because many protocols depend on stablecoin and collateral movements to stay solvent. When Binance paused activity, lending markets needed time to confirm that exploiter funds could not be used to impair borrowers or suppliers.

Aave ends its precautionary freeze as DeFi activity resumes

One of the most consequential downstream impacts of the Binance breach was on DeFi collateral systems that track risk and liquidity in real time. After a precautionary freeze following the hack, Aave said it lifted the restriction across all V3 and V4 markets.

According to Aave, new deposits and borrowing resumed, while withdrawals and repayments remained available even during the freeze. Aave also stated its contracts were unaffected by the incident. Founder Stani Kulechov later confirmed lending and borrowing had been re-enabled and said positions remained overcollateralized.

This rollback is important for traders and DeFi users because it restores normal borrowing capacity and reduces the risk that temporary liquidity constraints could exacerbate rate volatility or force unnecessary repayments. It also signals that, at least for Aave’s deployments, the most immediate threats appeared contained after investigators clarified the nature of the exploit and how it interacted with on-chain borrowing.

What analysts think happened — and what to watch next

Cybersecurity and blockchain analytics reporting in the coverage points to a breach involving compromised systems and automation, with some analysts tying the activity to the DPRK-linked hacking group TraderTraitor. Blockaid co-founder Ido Ben-Natan said the suspected mechanism could involve private key “misuse”—the kind of attack where authorization is manipulated or a signing system is compromised—rather than a simple leak of a private key. Chainalysis also said investigators were seeing laundering patterns consistent with automation, describing thousands of transactions in a short period used to obscure the trail.

For market participants, the next decisive indicators are whether Binance’s reserved and replacement assets fully cover token shortfalls, how quickly the exchange can re-enable withdrawals without further security incidents, and what its final proof-of-reserves report shows relative to verified frozen values. Readers should also watch for additional issuer or ecosystem updates as tracing efforts continue to refine the real extent of what was stolen versus what is merely restricted or in custody for recovery.