Binance says it will cover losses with its SAFU fund and company resources after unauthorized withdrawals. Its security team is updating the withdrawal system while investigators work to establish how the attack happened.
Crypto exchange Binance estimated the total impact of unauthorized withdrawals at about $6.3 billion in its October 30 security statement. It said it would cover all user losses with the SAFU emergency fund and company resources. Withdrawals remain suspended during security work as the investigation continues.
Deposits open, withdrawals expected within 48 hours
In its October 30 service update at 04:36 UTC, Binance said deposits were unaffected and operating normally. The exchange is keeping withdrawals closed while its team updates security for the withdrawal service and its related addresses. The company said it expected to reopen withdrawals within 48 hours and would provide further details.
Binance initially said it had paused both deposits and withdrawals as a precaution. In the later update, it said deposits were operating normally while withdrawals remained closed.
| Service | Status reported by Binance | Reopening information |
|---|---|---|
| Deposits | Operating normally | No new waiting period stated |
| Withdrawals | Paused during security work | Expected to resume within 48 hours |
Binance gave a 48-hour estimate, without guaranteeing an exact reopening time. It has not specified the order for processing pending withdrawals, whether all networks will reopen together or when individual transfers will finish. Customers can deposit money, but cannot send their balance to an external wallet until withdrawals reopen.
Initial findings point to an employee’s computer
Binance’s initial investigation suggested that an attacker may have compromised the laptop of a DevOps engineer, who helps deploy and run software. According to Binance, the attacker may have used the computer to access a service container and carry out unauthorized withdrawals. A container is an isolated environment in which a software service runs; Binance has not identified the service or credentials involved.
Binance said it had found no evidence of a wallet private-key leak. Investigators have yet to establish every step the attacker took to access the systems. Binance said multiple factors contributed to the incident and that its security team was tracing the attack from the computer, a possible entry point.
The exchange said it had revoked authorizations for affected addresses and was working with law enforcement and blockchain intelligence firms. The teams are trying to identify the criminals and trace the assets. It has not disclosed a named vulnerability, a confirmed initial access method, the number of affected customers or a comprehensive technical incident report.
$3 billion frozen as Binance pledges to cover losses
In a separate October 30 update, Binance said it had confirmed freezes on about $3 billion in assets. It said it was working with asset issuers, law enforcement and blockchain intelligence partners to trace more funds. Freezing prevents the attacker from moving the affected assets. Returning the money to Binance or its customers requires a separate step.
The roughly $3 billion frozen is part of the estimated $6.3 billion attack, rather than an additional loss. How much of the remaining $3.3 billion can be recovered is still unknown. Binance has not announced a final loss figure.
Binance says user assets are safe and it will cover all losses. It plans to use both SAFU and company resources for the payments. The exchange’s official website describes SAFU as an emergency fund established in 2018 to protect users in exceptional circumstances. The company has not said how much it will pay each customer, whether a separate application is required or which payouts it has completed.
Binance to publish new proof of reserves after fixes
Binance said it would publish updated proof of reserves once the security fixes were complete. On its proof-of-reserves page, Binance says it records user balances at a specific date and time and verifies control of its wallets. It combines balance records in a data structure called a Merkle tree and uses zero-knowledge proofs to check the totals. An account holder can check whether their own balance record is included in a selected report.
The new report Binance announced is still pending. Earlier reports show balances at their own snapshot dates; they do not provide a current update on withdrawals or payments for this attack. SAFU’s previously reported size is not a measure of completed payouts.
The section beginning at 01:52 in Binance’s June 24, 2026, video discusses transparency and users checking their own proof-of-reserves records. The company’s earlier explainer is not a finding from the October 30 investigation or an independent audit of current reserves.
Binance asks customers to follow updates through official channels. Its Binance Verify tool checks whether a website, email address, telephone number, Telegram account or social media account belongs to the exchange. Binance says the tool only verifies who owns an account or address; it does not authorize transactions or listings. The company also says it will never request money or tokens through private messages. A message offering to unlock withdrawals or recover losses should not be treated as an official payment instruction.
Binance’s October 30 service statement at 04:36 UTC:
