Binance pledges to cover hack losses; withdrawals paused

For someone in Israel holding assets on the platform, this raises two distinct questions: what resources the company has against its obligations, and when those assets can be accessed outside the account. A pledge to cover losses addresses the first question at the level of a company commitment. It does not remove the wait for withdrawal systems to be restored or provide a complete picture of the company's finances.

What Binance has confirmed, and what remains under investigation

In its official security incident update (Opens in a new tab), Binance said it had revoked affected authorizations, strengthened controls and continued reviewing its infrastructure. The incident concerns the international platform and wallets across multiple blockchains. It is not an announcement of a breach at an Israeli bank or a change to Israeli law.

The initial explanation focused on a compromised laptop. Binance subsequently reported additional points of breach and said it had found no evidence, at that stage, of leaked wallet private keys. That wording describes the investigation's current findings. It does not establish the complete sequence through which transaction controls were bypassed. The update did not contain a final technical incident report.

Chainalysis described signed authorizations that allowed an Ethereum wallet to execute code deployed by the attacker. EIP-7702 is Ethereum's account code-delegation mechanism, allowing an account to direct execution to other code. A signed authorization can therefore carry significant consequences. This does not mean that every Ethereum wallet was compromised or that the same mechanism explains transfers on the other affected networks.

Three figures that measure different things

Binance estimates the loss at approximately $6.3 billion. It said it had earmarked more than $6.34 billion of company funds, including roughly $5 billion already held in the types of tokens stolen. It said coverage would come from its SAFU fund and corporate treasury. These are the company's figures and commitment, rather than independent confirmation that replenishment was complete.

A separate figure, approximately $3 billion, concerns assets frozen with assistance from other organizations, according to Binance. Freezing can block movement from an address without returning the assets. That figure should not automatically be added to the coverage fund or deducted from the loss as though recovery were finished. Different theft estimates also need to be read with their measurement times and methods in mind.

Elliptic estimated the theft at $6.43 billion. It and Chainalysis linked the incident to North Korean actors through analysis of fund movements. This is an attribution by investigative companies, rather than a judicial finding. This article uses Binance's loss estimate and identifies Elliptic's separately, rather than presenting a single figure as universally agreed.

Cold storage does not remove dependence on the exchange

A hot wallet operates in an online environment and supports routine transactions. A cold wallet keeps private keys away from a persistent internet connection, reducing some forms of exposure. That distinction is separate from the difference between self-custody and custody by a company. An exchange can operate cold wallets while customers still depend on it to process withdrawals.

As the guide to crypto wallets and custody explains, the central question is who controls the keys and authorizes transactions. An account balance is not necessarily a separate wallet controlled by the customer. Self-custody, meanwhile, transfers responsibility for key security and backups to the user; it does not automatically eliminate every risk.

CoinDesk reported that affected wallets had previously appeared among assets listed as backing customer balances. This site has not independently audited that accounting. The report does, however, warrant care with any sweeping claim that the stolen assets were entirely unrelated to customer backing. A commitment to replenish assets does not settle how those assets were previously allocated.

What is expected next for withdrawals and reserves

The official update describes a phased withdrawal restart after security checks, alongside planned proof-of-reserves results by 2 November 2026. The research for this article did not locate a later official announcement confirming a full restart or publication of the promised report. Those dates therefore remain company targets, rather than confirmation that the services or results are already available.

Proof of reserves can provide information about assets and balances at a particular moment. As the US Securities and Exchange Commission explains in its investor education materials, it is not equivalent to a full financial statement audit. Readers need to know the assessment's scope, which liabilities it covers and who performed it. Publication of a report also does not establish that every withdrawal route is operating.

Do not let the waiting period become an opening for impersonators

A request to visit a compensation website, pay to release a withdrawal or disclose recovery words calls for a pause and a separate check. These are general warning signs, not a claim that a specific post-incident scam wave has been measured. A familiar logo and a supposed support agent's name do not establish who sent a message.

Users can open the app or familiar website themselves and contact support from there to check the message. Private keys and recovery words should never be handed to someone offering account assistance. Seed phrases and private keys provide control of a wallet, rather than simply identifying its owner. The warning signs of crypto scams are particularly relevant when a message demands urgent action. Checking service availability can wait while the official channel is opened; disclosing a wallet secret may have irreversible consequences.