Binance Says $3 Billion of $6.3 Billion in Stolen Crypto Is Frozen—But Its Latest Update Changes the Timeline
Binance says about $3 billion has been frozen and promises to cover the loss. Its latest statement says withdrawals may resume in phases within about 34 hours, revising earlier 45-hour reports.
Binance says it has frozen about $3 billion connected to the security breach that affected roughly $6.3 billion in token assets, and that it will cover the losses from company funds and its Secure Asset Fund for Users (SAFU). The exchange's latest official update also says investigators found additional breach points beyond an initially suspected compromised laptop. Withdrawals are expected to return in phases, but Binance's newer timeline differs from earlier reports: the company said it was targeting a resumption within about 34 hours, while Reuters had reported an earlier estimate of 45 hours.
What Binance says it has done
In its October 30 update, Binance said it had contained compromised infrastructure, revoked affected authorizations and strengthened controls. It said around $3 billion had been frozen on-chain with help from law enforcement, blockchain analytics firms, token issuers and other exchanges. The company said it set aside more than $6.34 billion in funds, including $5 billion in the same token assets that were stolen, and was buying the remaining tokens.
The exchange also said it had found no evidence that wallet private keys were leaked. That is an important claim, but it is not a final forensic finding. Binance said the investigation was ongoing and promised a technical report after its details could be verified and disclosed without compromising the inquiry. The public still does not know the full sequence of access points or how multiple wallets were affected.
The customer protection promise
Binance says users will not bear the financial impact. That commitment may reassure customers, but it must be assessed alongside the company's ability to provide transparent evidence of the reserve and the liabilities it covers. A proof-of-reserves snapshot can show holdings at a specific moment; it does not, by itself, prove that every internal control is secure or that all obligations are fully represented. Binance says it plans new verification updates as it buys replacement assets.
The amount frozen is also different from the amount recovered. Frozen tokens may be inaccessible to the attacker but not yet returned to Binance or users. Some assets can move across chains or be swapped through services that complicate tracking. Issuers' ability to freeze stablecoins has helped limit losses, while raising questions about centralized control over assets advertised as transferable.
What happens when withdrawals resume?
A phased restart can reduce operational risk, but users will watch whether processing is smooth and whether limits are imposed. Binance says deposits and unaffected services remain operational. A withdrawal delay does not automatically mean customer balances are lost, but the speed and clarity of restoration will shape confidence.
Will independent investigators confirm Binance's account of the incident? Can the exchange demonstrate that its backstop fully covers customer claims? And will the review lead to stronger controls across the industry—or another cycle of assurances after a breach? The freeze is a significant containment step, not the end of the investigation.
A reserve is reassuring only if the details are verifiable
Binance says it has set aside enough assets to cover the loss and plans a proof-of-reserves update. Users should know whether that snapshot includes customer liabilities across all services and whether the assets are free of claims or encumbrances. A company promise can protect customers, but it is different from an independent audit and does not explain how a breach of this size became possible.
The return of withdrawals will be a practical stress test. If customers rush to move assets, the exchange must process requests safely while preventing another exploit. If it limits withdrawals, it should explain the criteria and expected duration. The company says no further funds left after it paused withdrawals, but a final technical postmortem is still pending. Will the report identify control failures in enough detail for other exchanges to learn from them? That transparency may matter as much as whether the company can replace the stolen tokens.