Binance Crypto Freeze Leaves Recovery and Repayment Open

Binance suspended deposits and withdrawals after a security breach on Thursday and said it would cover customer losses. By Friday, roughly $3 billion in crypto assets linked to the incident had been frozen. For customers waiting to use their accounts, the pressing questions are how much can be returned, when withdrawals will resume and whether Binance can make good on its promise.

Those questions have different answers. A freeze prevents certain tokens from moving. Returning them can require investigators to establish who owns them, obtain legal authority and work with the companies that control the tokens. Binance’s promise to cover losses is a separate commitment by the exchange, even if some of the stolen assets never come back.

The size of the breach remains an estimate. Binance had not announced a definitive theft figure when Glassnode put the amount at $5.3 billion and Chainalysis put it above $5.9 billion. TRM Labs estimated that approximately $6.36 billion moved from Binance wallets across 10 blockchains in its analysis of the attack. The affected exchange is Binance.com; Binance.US said its platform was unaffected. A global customer should not have to infer which business is involved from a shared name.

Three Numbers, Three Stages

The estimated amount moved from Binance wallets describes the scale of the suspected theft. The roughly $3 billion frozen describes assets whose movement has been interrupted. The amount eventually returned will depend on what investigators and the relevant companies can recover. Treating the frozen figure as a customer payout skips the hardest stage of the process.

Tether said it had frozen nearly $1.57 billion linked to the incident, while Circle said it had frozen more than $800 million, Reuters reported in the Yahoo-hosted story. World Liberty Financial said it worked with custodian BitGo to freeze funds; Binance co-founder Yi He also described freezes involving other tokens. These figures come from different parties describing actions taken in a fast-moving incident. They should not simply be added to Binance’s roughly $3 billion as though each announcement identified a separate pool of money.

Ari Redbord of blockchain intelligence firm TRM Labs described the next step to CNBC: “A freeze stops the money from moving, and recovery follows through legal process.” Law enforcement typically obtains a court order or seizure warrant before working with a stablecoin issuer to release or reissue assets to their rightful owner, he said. Tether and Circle can freeze, burn and reissue their tokens because they control the token contracts. A freeze therefore offers a route toward recovery, subject to that legal process. It does not show that a transfer back to Binance or its customers has occurred.

That ability also puts an issuer inside a decision often described as belonging to a decentralized financial system. For someone whose funds were taken, an issuer’s power to stop a token can be protection. For someone holding a frozen token, it means access depends on decisions by a company and, eventually, legal authorities. The same control that can frustrate a thief requires a process for determining whose claim prevails.

Bitcoin and ether follow another route. Neither has an issuer able to freeze a token directly. Investigators can trace transfers on public blockchains and may be able to intercept funds when they reach a cooperating exchange or other centralized service, Chainalysis research head Eric Jardine told CNBC. Jardine said returning frozen assets can take months or years and requires coordination among law enforcement, exchanges and issuers.

The composition of the missing assets will affect the recovery options. An issuer-controlled stablecoin offers a point at which transfers can be stopped; bitcoin and ether require investigators to find a point of cooperation farther along the route. A frozen stablecoin still has to pass through a return process, while a traced bitcoin transfer may still be intercepted. Both paths lead to a question of control: who can act on the asset, and under what authority?

The Exchange Still Owes Customers an Answer

Binance temporarily halted deposits and withdrawals while conducting security checks. It said customer funds were safe and pledged to cover losses. Co-CEO Richard Teng said company funds would help meet that commitment, Reuters reported. Binance’s website describes its secure asset fund for users as a $1 billion bitcoin reserve. A reserve and a pledge are relevant to customers, but their existence does not settle the ultimate cost of the breach or the timing of restored access.

The company’s initial investigation suggested that a compromised engineer’s laptop may have been an entry point. Binance later said it had found additional points of breach, Reuters reported. That leaves the attack path open while the investigation continues. For a customer, the operational test is more immediate: whether withdrawals resume and whether Binance can meet requests as people regain access. Fundstrat’s Sean Farrell said orderly outflows and the speed of reopening would be indicators to watch; his assessment that the breach did not then appear to pose a significant solvency risk rested in part on frozen stablecoins eventually being returned.

Binance had 335 million registered users globally and about $162.8 billion in assets under custody, Reuters reported, citing its 2025 annual report. Those totals describe the reach of the exchange, not the number of customers who lost money in this breach. They do, however, explain why the promise to cover losses reaches beyond traders watching a price chart. An exchange holds assets on behalf of people who may need to move them, whatever happens to the market price of crypto that day.

February 2025 supplies a precedent, with limits. Hackers stole about $1.5 billion from exchange Bybit; the FBI attributed that attack to North Korea-linked actors. TRM Labs says the Binance attackers were able to direct exchange wallets into wallets they controlled, an apparent similarity to the Bybit theft. TRM and Chainalysis have also pointed to a North Korean state-sponsored group in their assessments of the Binance incident. Binance, though, said its own investigation had not attributed responsibility to any individual. The Bybit comparison helps explain why investigators are examining how exchange wallets were controlled; it cannot establish who carried out this attack or predict how much will be recovered.

The sums now sit at different points in a chain of obligations. Issuers have stopped some tokens moving. Investigators and courts may determine which can be returned. Binance has promised to cover losses regardless. Customers will learn what that promise means in practice when access is restored and claims on the missing assets are resolved.