Binance’s $6.3 Billion Hack Puts Crypto’s Safety Net to the Test.

Billions of dollars can leave an exchange in minutes. Restoring trust takes longer.

Binance is working to rebuild its withdrawal systems after a breach it estimates at approximately $6.3 billion. An analysis from Sentora puts the value of the assets at roughly $6.36 billion when transferred, with most of the outflows occurring within about 20 minutes across ten blockchains.

That is more than four times the $1.5 billion Bybit theft in 2025.

Binance has promised to cover the losses. The immediate question for customers is when they will be able to withdraw—and what evidence will demonstrate that the exchange has replaced the missing assets and fixed the weaknesses.

Binance’s Latest Update: Funds Set Aside, Withdrawals Still Paused

In an October 30 update, Binance co-CEO Richard Teng said the company had reserved more than $6.34 billion of its own funds, including $5 billion already held in the affected tokens. Binance is purchasing the remaining assets through market and over-the-counter transactions.

Teng said the affected hot wallet belonged to Binance and maintained that customer holdings were protected. Those are the exchange’s statements; public verification remains an important next step.

The operational milestones are:

• Withdrawals: Binance is rebuilding and testing the service, targeting restoration before its Sunday, November 1 deadline.

• Deposits: The exchange says they are operating normally.

• Proof of reserves: Teng said a full report is planned for Monday, November 2, with an initial view potentially available sooner.

• Investigation: Binance now says it has identified multiple points of breach, expanding beyond its initial account of a compromised engineer’s laptop.

Binance says withdrawals will resume only after the rebuilt system passes testing.

Frozen Money Is Not the Same as Recovered Money

The scale of the incident becomes clearer when broken down by network.

Figures supplied by Sentora reflect estimated values when the assets moved.

Binance’s latest published freeze estimate is approximately $3 billion. Freezing restricts an attacker’s ability to move assets; it does not mean those assets have been returned or made available for withdrawals.

Stablecoin issuers including Tether, Circle and Ripple intervened to block stolen tokens. The attacker also raced to exchange assets that could be frozen for assets that could not.

Native Bitcoin and Ether have no token issuer able to impose an equivalent blacklist. That makes the distinction between tracing, freezing and recovering funds especially important.

Binance’s decision to replace assets with company funds is a separate process from recovering the stolen money.

Musk’s “Everyday Is Zeroday” Jab

The breach quickly became a public spectacle.

Elon Musk posted “Everyday is Zeroday,” quoting an early report of the Binance outflows. That report used a preliminary $5.7 billion estimate, which has since been overtaken by the larger figures above.

The remark played on “zero-day,” a term associated with security vulnerabilities exploited before a fix is available. It was commentary, not a technical finding about how Binance was compromised.

𝕏Post from @elonmuskView the original post on X↗

The underlying security question is more consequential than the joke: how did unauthorized instructions pass through the systems responsible for moving billions of dollars?

Binance initially said it found no evidence of a wallet private-key leak. That does not rule out misuse of the infrastructure that approves or executes transfers.

Teng’s subsequent account described attackers obtaining on-chain execution permission outside normal approval controls. The full technical explanation remains pending.

The AI Warning—and What Has Not Been Proven

The incident arrives as financial companies give increasingly capable AI agents more responsibility.

In commentary provided to Blockster, Chandler Fang, co-founder of t54 Labs, argued that agents operating continuously could identify and exploit weaknesses during even brief windows of exposure.

Binance has not established that AI agents caused this attack. Fang’s comments address the wider security challenge as those capabilities develop.

He called for stronger AI-assisted defenses, alongside more rigorous security audits and stress tests:

“We can no longer rely solely on traditional security and risk management frameworks. We must integrate more advanced AI to defend our systems and ensure their robustness.”

— Chandler Fang, Co-founder, t54 Labs

Fang said t54 had halted a planned agentic financial custodian launch following recent security concerns and was investing in internal testing and an external audit.

That adds another dimension to Blockster’s recent coverage of t54 and Hecto Financial: verifying that an agent has permission to pay is part of a broader problem—ensuring that permission cannot be abused.

Who Controls the Assets Matters

For Chris Mack, CTO of Quote.Trade, the breach highlights the limits of relying on an exchange’s size or reputation.

In comments provided to Blockster, Mack said his company separates trading from custody. He described arrangements involving separate smart contracts with risk limits or qualified custodians with insured vaults, subject to coverage limits.

Those arrangements still carry risks. Smart contracts can contain vulnerabilities, custody controls can fail, and insurance has conditions and limits.

Mack framed the practical questions this way:

“The key questions are who controls the assets, what limits apply to withdrawals, and how much damage a compromise can cause before it is contained.”

— Chris Mack, CTO, Quote.Trade

The Binance incident illustrates why protecting private keys alone is not enough. A system also needs to verify who can request a transfer, how it is approved and how quickly unusual activity can be stopped.

DeFi Felt the Shock Without a Matching Liquidation Wave

Sentora’s market figures supplied to Blockster show pressure across decentralized finance, but a comparatively limited wave of forced selling.

Its snapshot showed DeFi total value locked falling $8.48 billion to $115.37 billion, while stablecoin supply declined $3.52 billion. Liquidations totaled $11.8 million, and the value of high-risk loans fell $329 million.

Ethereum fees rose approximately 282% to $8.21 million as market participants repositioned. These figures describe the reporting window; they do not establish that every movement resulted from the breach.

There were also operational disruptions. Sentora’s incident report describes precautionary lending-market freezes and tighter liquidity. Sentora said its own affected vaults met redemptions without bad debt.

Michael Terpin, CEO of Transform Ventures and author of Bitcoin Supercycle, argued in commentary provided to Blockster that an exchange security failure should be distinguished from a failure of Bitcoin itself:

“Nothing fundamental happened to Bitcoin itself, so I don’t expect this to bring on a new bear market.”

— Michael Terpin, CEO, Transform Ventures

That is Terpin’s market outlook, rather than a guarantee. Selling by the attacker, delayed withdrawals and changing confidence can still affect prices even when Bitcoin’s underlying network continues operating.

CZ’s Security Advice Comes Back Into Focus

Musk also returned to an October 28 post by Binance founder Changpeng Zhao, which warned people against opening email links or downloading attachments—even from trusted contacts whose computers might be compromised.

After the breach, Musk replied with fire and laughing emojis.

The timing gave the exchange an uncomfortable public-relations moment. But the earlier warning does not establish the entry point of this attack, and Binance’s investigation has already expanded beyond its first laptop-related explanation.

𝕏Post from @elonmuskView the original post on X↗

For customers, the next meaningful developments will be concrete: working withdrawals, evidence that replacement assets are in place, and a credible account of the controls that failed.

Binance says it has the resources to absorb the loss. Now it needs to demonstrate that customers can access their assets—and that the rebuilt withdrawal system can withstand the next attempt.