Binance is working with U.S. law enforcement, including the FBI and the U.S. Secret Service, to respond to a security breach that drained approximately $6.3 billion from the exchange's hot wallets — internet-connected wallets used to process customer withdrawals — on Oct. 29. Roughly $3 billion of the stolen assets has already been frozen on-chain, and Binance has committed more than $6.34 billion of its own reserves to cover user losses. The incident has drawn involvement from multiple U.S. agencies, which are working with the exchange and industry partners to track the sources of the stolen funds.

FBI and Secret Service Join the Investigation

According to Binance, the hack resulted in approximately $6.3 billion worth of withdrawals from the company's hot wallets on Oct. 29. The FBI told Reuters that it is collaborating with both public and private partners to determine the extent of the situation and carry out investigative measures. In a separate report on Thursday, Bloomberg said U.S. Secret Service investigators are also assisting in the recovery effort. The agency, originally created to combat counterfeiting, has in recent years taken on a prominent role in cryptocurrency-related financial investigations.

Binance initially attributed the attack to a hacked DevOps engineer's laptop, but the company later said it had identified additional points of attack. According to Binance, there is no evidence that the private keys to the affected wallets were leaked.

Nearly Half of the Stolen Assets Are Frozen

Binance said approximately $3 billion of the affected assets has been frozen on-chain through cooperation with token issuers, exchanges, blockchain intelligence firms, and law enforcement. That still leaves a substantial share of the stolen funds unrecovered, with some affected holders not yet identified.

According to Reuters, stablecoin issuers were able to freeze some of the stolen money, while assets such as Bitcoin and Ether are less easily held due to the absence of centralized issuers capable of freezing them.

Binance Commits $6.34 Billion to Protect Users

The incident is covered by more than $6.34 billion of Binance's company funds. Of that total, roughly $5 billion is already earmarked for the stolen tokens, which include BTC, ETH, BNB, USD, and USDT. The exchange said it is buying up the remaining balance through market and over-the-counter (OTC) channels to make affected users whole.

According to Binance, around 80% of the impacted value is already covered by the $5 billion in standing reserves.

— Binance (@binance) October 30, 2026

The company stressed that these figures do not include assets that have already been frozen or otherwise protected, which remain subject to recovery and verification. Binance said users will not absorb the losses and that it has committed company resources and its Secure Asset Fund for Users (SAFU), an emergency insurance reserve the exchange established in 2018, to making affected balances whole.

Withdrawals Paused and Proof of Reserves Revamp Planned

Withdrawals were temporarily paused while Binance carries out additional security testing and remediation measures. The exchange said it will reopen withdrawals in stages as those checks are completed. It also plans to release a revamped proof of reserves (PoR) that will allow users to check platform balances against customer balances — a form of disclosure that became an industry expectation after the 2022 collapse of FTX left customers of that exchange unable to access their funds.

An in-depth technical forensic analysis will also be undertaken after investigators determine the full sequence of the attack.

The attack is now the biggest crypto theft by value that has ever occurred on an exchange, surpassing the roughly $1.5 billion drained from Bybit in February 2025. It has also called attention to the need for centralized exchanges to reinforce their transaction-signing infrastructure — the systems that authorize and broadcast outbound transfers — hot wallet controls, and real-time monitoring. The staged restoration of withdrawals, the publication of the revamped proof of reserves, and the findings of the forensic analysis are the milestones to watch as the response unfolds.