The hacking attack that resulted in the theft of approximately $6.3 billion from Binance on Thursday (29) has raised a concern among the platform's millions of users: what happens to customer funds, and who will bear the losses? The world's largest cryptocurrency exchange says investor funds are safe and that all losses will be covered, but withdrawals remained suspended on Friday (30).

The incident, considered the largest hacking attack in cryptocurrency history, hit wallets used by Binance to store digital assets. According to an investigation by TRM Labs, the attackers managed to move billions of dollars in Bitcoin, Ethereum, stablecoins and other cryptocurrencies across different networks, with most of the theft taking place in roughly 20 minutes.

Binance estimates the total impact at $6.3 billion, of which around $3 billion has already been frozen with the help of stablecoin issuers and other industry participants. However, freezing the funds does not mean they have actually been recovered and returned to the exchange.

In a statement, the company said it would fully cover the losses using its emergency fund, known as SAFU, and its own resources. More recently, Binance said it had set aside more than $6.34 billion in corporate funds to replenish the affected assets.

Binance suspends withdrawals, expects normalisation within 48 hours

One of the first measures Binance took after identifying the suspicious transactions was to halt cryptocurrency withdrawals, temporarily preventing customers from transferring their funds to other exchanges or external wallets.

The suspension was presented as a precautionary measure to prevent further outflows of assets while the company investigated the origin of the attack and checked the security of its systems.

Also read: How hackers stole $6 billion from Binance in just 20 minutes

Initially, the exchange said that both deposits and withdrawals were suspended. However, on Friday morning it clarified that deposits remained operating normally, while withdrawals stayed blocked.

According to Binance, halting withdrawals also stopped the fraudulent transfers from continuing. The company is carrying out a security review of its withdrawal system and of the addresses used in the operations.

The company initially said it expected to resume withdrawals within 48 hours, a timeline later updated to approximately 45 hours. The estimate, however, depends on the completion of the security checks.

Richard Teng, co-CEO of Binance, reiterated that the exchange intends to cover all losses and that customers will not lose the funds held on the platform.

The suspension therefore represents a temporary restriction on access to funds, even for customers whose individual accounts were not compromised.

So far, the company has not given a specific timeline for the full restoration of all services or a detailed schedule for any individual compensation.

Hack hit wallets that backed customer funds

Although Binance says user funds are protected, an analysis published by CoinDesk found that some of the wallets hit by the attack were among the addresses the exchange uses to demonstrate its cryptocurrency reserves.

This means the attackers did not only withdraw funds belonging to the company itself, but also assets that formed part of the structure used to back the balances held by customers on the platform.

One of the compromised wallets, identified as Binance 14, appeared in the proof-of-reserves report published by the company on 1 October. At the time, the address held approximately 89,500 ETH and 1.26 billion USDT, along with other cryptocurrencies.

CoinDesk estimated that approximately 204,500 ETH were withdrawn from Binance wallets during the attack, an amount equivalent to about 5.6% of the Ethereum reserves the exchange had previously reported.

Since Binance showed exactly 100% coverage for customers' Ethereum balances on 1 October, the theft could have reduced that ratio to approximately 94%, had the assets not been replaced. The calculation, however, uses data from before the attack and does not represent an updated measurement of reserves.

In practice, this does not mean customers holding Ethereum on Binance lost 6% of their balances. What the analysis indicates is a possible temporary reduction in the assets backing those balances, until the exchange completes the replenishment.

This situation helps explain the significance of the company's pledge of full coverage. Binance said it has already begun replenishing the affected assets and has set aside more than $6.34 billion in its own funds, an amount exceeding the estimated value of the attack.

Of that total, approximately $5 billion is already said to be available in the same cryptocurrencies affected by the theft. The company says it is acquiring the remaining roughly $1.34 billion through market purchases and over-the-counter (OTC) deals, aiming to ensure the assets are replenished in matching amounts.

The exchange notes that this process may take longer for certain cryptocurrencies, particularly those with lower liquidity.

The approximately $3 billion frozen with the help of other companies is not included in the $6.34 billion reserve announced by Binance.

Binance's SAFU fund is smaller than the losses from the attack

Another notable point is the gap between the losses caused by the attack and the size of Binance's emergency fund.

Created in 2018, the Secure Asset Fund for Users (SAFU) acts as a reserve intended to protect customers in exceptional situations, including security incidents resulting in the loss of cryptocurrencies.

The fund was initially built up from a portion of the exchange's trading fees and has undergone changes to its composition over the years.

According to information made available by Binance itself, SAFU held approximately $1 billion in crypto assets in February 2026. Its value can fluctuate depending on market conditions. Reuters also described the fund as a reserve of roughly $1 billion in Bitcoin.

The total amount diverted in the attack is therefore more than six times the approximate size of the protection mechanism.

Even accounting for the $3 billion in frozen assets, the remaining shortfall of approximately $3.3 billion would still be significantly larger than SAFU.

This does not mean, however, that the fund has already been exhausted or that all the stolen funds will be permanently lost. Binance has not detailed how much will actually be drawn from SAFU, and part of the frozen assets may still be recovered.

The shortfall is expected to be covered with the exchange's own resources, in line with the commitment made by management and the announcement of the $6.34 billion corporate reserve.

This episode represents a significant test of the company's financial capacity, since the losses will not be limited to the emergency fund originally created to protect customers.

The exchange has also promised to publish a new proof of reserves once it completes the security procedures and asset replenishment.

The next monthly report is scheduled for 1 November, though publication of the results could come later. The document will make it possible to assess whether Binance has managed to restore coverage of customer balances, particularly for the cryptocurrencies most affected by the attack.

In the meantime, investors' main concern remains focused on the resumption of withdrawals and the company's ability to keep its promise to fully preserve user balances. Although Binance has announced sufficient resources to cover the estimated losses, the actual replenishment of reserves and the normalisation of services still need to be verified.

If you want to invest in cryptocurrencies securely, Mercado Bitcoin offers a special benefit for our readers: use the code PORTAL250 at sign-up and get €8 in Bitcoin bonus when you buy €41 worth of assets. Click here to open your account.