What Binance has said

Ripple "promptly" froze roughly $200 million in associated funds, co-CEO Yi He [said]

The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”

Binance is aiming to resume withdrawals within 40 hours and publish a full proof-of-reserves report by Monday, co-CEO Richard Teng [said]

Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.

Binance initially linked the breach to a compromised DevOps engineer's laptop, but now says it has uncovered additional points of breach in a complex attack that "was not carried out by one person".

Binance has said it will cover all losses using its SAFU fund and company funds, and that it has reserved more than $6.34 billion of company funds to do so. Around $5 billion of this is already held in the same tokens that were stolen, and Binance is buying the rest through the market and OTC trades. It plans to publish a full Proof of Reserves report by Monday.

Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets.

The cryptocurrency exchange said deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two.

It said it will cover all losses.

The company said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."

Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."

He added that while he doesn't manage Binance anymore, "as a shareholder, I expect all user funds will be fully covered."

Binance hasn't named a culprit. Teng said the investigation has not attributed responsibility to any individual, and Binance says it is working with law enforcement to confirm who is behind it.

Teng said the hack hit Binance's own hot wallet, not customer funds. "We never use any customer funds, so they are not impacted," he said, adding that most user assets are held in cold wallets and only moved into a hot wallet when a user withdraws.

Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.

Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.

The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach.

Binance will cover all stolen funds related to this incident through our Secure Asset Fund for Users (SAFU) and our corporate treasury.

We expect to share further technical findings within about 48 hours once they have been verified and their disclosure will not compromise ongoing investigative efforts.

we will provide a detailed technical report outlining what happened, the lessons learned and the additional safeguards being implemented.

For verified updates, please follow Binance's official channels only, or contact us directly through the official Customer Support.

We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.

We have already set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets that were stolen, such as USDC, USDT, BTC, ETH, BNB, etc. This means that we have already covered approximately 80% of the impacted amount.

We are buying the remaining 20% of the lost token assets. We plan to run an initial Proof Of Reserves snapshot in 12 hours and have the result ready by Monday 2026-11-02.

Temporarily suspended withdrawals while conducting additional security reviews, implementing remediation measures and validating the integrity of affected systems.