Binance said it would shore up confidence after a record $6.3 billion hack, according to the Reuters report, by reviewing how attackers bypassed transaction approvals and promising to cover losses from company funds. The exchange said customer funds were safe, while its co-CEO described a complex attack involving a compromised laptop and software designed to delete evidence.

The breach centered on a system used to approve transactions, Binance co-CEO Richard Teng said in a post on X. Attackers manipulated that system to move money from a Binance-controlled, internet-connected “hot” wallet without passing through normal approval controls, he said.

How Binance Plans to Shore Up Confidence

Teng said the attack was not carried out by one person. He described malicious software that deleted evidence of its activity, making it more difficult for Binance to trace and investigate what happened. The report did not identify the system or explain which approval checks were bypassed.

The operational detail gives the incident a distinct security dimension beyond the loss itself. Binance said it was conducting a full security review. It also said it was working with industry partners to freeze affected assets, with about $3 billion located so far. The company did not mention the status of the remaining $3.3 billion.

Binance co-CEO Yi He wrote on X that the $3 billion represented about 2% of the company’s total user assets and public reserves. Binance separately said it had set aside around $6.34 billion of company funds internally to cover the losses. The report also cited the company’s $1 billion bitcoin reserve fund, which its website describes as designed to protect customer assets during security breaches.

Tracing the Attack and Freezing Funds

Binance said it was working with the FBI and the US Secret Service. The FBI said it was engaged with public and private partners to understand the activity, assess potential impacts and coordinate investigative steps. The Secret Service said investigators were working with private-sector partners, including Circle, to identify, freeze, trace and recover the stolen funds.

Stablecoin issuers also reported freezes. Tether said it froze nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million. Those amounts describe the companies’ reported actions; the report did not say that frozen assets had been returned to Binance or its customers.

Binance said its technical team was targeting a resumption of withdrawal services within approximately 34 hours, as of Friday afternoon US eastern time. It planned an initial proof-of-reserves snapshot in 12 hours, with results expected by Monday. These were stated targets and plans, not reported completed steps.

The company’s response is unfolding alongside a broader debate about how exchanges protect customer assets and explain their safeguards. Blockchain.com’s US application offers a separate example of a crypto company seeking permission for additional exchange products. Readers can also review investors’ questions about crypto value and lawmakers’ examination of crypto regulation.

Investigation Remains a Key Next Step

The report said the bulk of the heist unfolded in around 20 minutes beginning late Thursday. US blockchain analysis firms TRM Labs and Chainalysis said the attack bore similarities to earlier large attacks blamed on North Korea. TRM said attackers ordered Binance wallets to empty into hacker-controlled wallets, resembling a 2025 heist at Bybit that the FBI attributed to North Korea. North Korea denies involvement in cyber thefts.

Binance’s technical review and the work to trace funds remain central to what happens next. The company said it would publish proof-of-reserves results by Monday, while investigators and private-sector partners continue assessing the incident. The Reuters report did not provide a completed review or a final recovery total.