Binance Says 90% of $6.3B Stolen Funds Restored as Record Hack Spurs Custody Questions

Binance, the world's largest cryptocurrency exchange, said it has restored 90% of the roughly $6.3 billion in client funds stolen in a record-breaking hack, with the company vowing to cover the remaining 10% as well.

The company said the remaining portion consists of "less liquid" tokens that may take longer to acquire. Withdrawals remain paused but are on track to resume Sunday, Nov. 1, according to a company post on X.

"Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the exchange said, adding that it would demonstrate this through "measurable progress, transparent reporting, and concrete actions."

The theft, which hit Binance's offshore platform on Thursday, is the largest crypto heist on record and "almost certainly the largest theft of any kind in history," according to analytics firm Elliptic.

The scope of the breach

Binance said it found no evidence that "private keys" — unique user codes — had been breached. In a separate post on X, the company said its investigation later uncovered additional points of breach, though it did not specify what they were. The hack may have involved a compromised DevOps engineer's laptop, Binance said.

Crypto companies moved quickly to freeze wallets linked to the stolen funds. Paolo Ardoino, chief executive of Tether, said his company had frozen about $1.5 billion of USDT, its dollar-linked stablecoin. Jeremy Allaire, head of Circle, the second-biggest stablecoin issuer, said $800 million of its USDC coin had been frozen amid "reports of a potential exploit" at Binance.

Elliptic said it had verified $2.8 billion of frozen crypto — mostly USDT and USDC — but that the hackers had moved the remainder into assets that could not be frozen, such as the ETH token.

Custody and governance concerns

The incident has sharpened questions about the safety of storing funds on centralized exchanges, which act as primary custodians in the digital asset ecosystem.

"I think it's extremely dangerous," Tyler Moore, a cybersecurity professor at the University of Tulsa, told CNBC. "I think you should be very wary of leaving any significant amount of funds in an exchange… there are no built-in protections for when these inevitable hacks take place."

Moore noted that banking customers can rely on the Federal Deposit Insurance Corporation to insure deposits up to $250,000 per depositor, per insured bank. There is no similar coverage for funds lost from a cryptocurrency exchange.

A separate analysis published on dev.to argued the crisis extends beyond the technical theft to a "governance deficit," pointing to a widening discrepancy between the exchange's official disclosures and on-chain data. The analysis said the incident signals a "critical failure in corporate governance and information transparency, posing a systemic risk to the credibility of Centralized Exchanges acting as digital asset custodians."

The analysis also flagged the hacker's use of "chain-hopping" — targeting a diverse basket of altcoins with lower liquidity to fragment the trail of funds and make tracking and recovery more difficult.

Regulatory and market fallout

The breach comes amid a turbulent period for Binance. The exchange was ordered to wind down its EU operations in July after failing to secure a license under the bloc's new regulatory framework. It became regulated in Abu Dhabi in December 2025, and had already agreed to block UK customers after being barred by Britain's financial watchdog in 2021. In the US, Binance operates under a separate entity registered with the Financial Crimes Enforcement Network and authorized to operate as a money transmitter in 32 states.

The offshore nature of the incidents drew attention from regulators. In a Friday appearance on CNBC's "Squawk on the Street," Commodity Futures Trading Commission Chairman Michael Selig said offshore platforms "don't have the same sorts of safeguards that we have in our financial markets." He said the CFTC wants to "offer a federal option to these exchanges to come and register with the CFTC, and they would be subject to the same sorts of cybersecurity safeguards that we have in our markets today."

Brett Falk, a professor and director of the Crypto and Society Lab at the University of Pennsylvania, told CNBC that US regulations likely wouldn't have stopped the Binance incident, since "most of the regulation doesn't touch the specific software stack you have to use to authenticate people."

US-regulated platforms Coinbase and Robinhood were unaffected by the breach, though shares of both fell on Friday in the aftermath.

A wider pattern

The Binance hack followed another incident the same day: prediction market platform Polymarket temporarily halted trading on its international exchange after a third-party data provider was hacked, resulting in at least $2.7 million being drained from users' wallets.

Last month, nearly $390 million was stolen from crypto exchange Bitget, which reimbursed customers from its so-called User Protection Fund. North Korean hackers stole about $2 billion in cryptocurrency in 2025, a 50% increase from the year before, according to data from Chainalysis.

Experts told CNBC that more security incidents are likely, particularly as artificial intelligence changes the cybersecurity landscape. Ido Ben-Natan, CEO of blockchain security company Blockaid, said he thinks "no users will lose any money" given Binance's commitment to cover everything, but acknowledged more hacks are probable.

Ryan Kirkley, CEO of blockchain infrastructure company Global Settlement Network, urged caution. "I do not think there's anything right now that is a common solution in the marketplace where your assets are truly safe," he told CNBC. "Unless you are dealing with a reputable and firm broker-dealer that provides an asset insurance, you are risking your assets putting them into any ecosystem today just simply because there's so much unknown."