The October 29 hack of Binance.com has raised urgent questions about access to customer assets and the recovery of stolen cryptocurrency. In its security incident update, Binance estimated the impact at approximately $6.3 billion, reported that about $3 billion had been frozen on-chain, and said it would cover losses using its Secure Asset Fund for Users, known as SAFU, and company funds.

For customers and businesses using the exchange, the immediate priorities are to preserve account records, understand any restrictions, and document actual losses. Reimbursement, access to funds, and recovery from the attackers are separate issues, each with its own practical and legal questions.

What is known about the Binance hack

TRM Labs estimates that approximately $6.36 billion left Binance wallets across ten blockchains, with most of the transfers occurring within about 20 minutes. TRM attributes the attack with high confidence to TraderTraitor, a North Korean hacking group. That is an attribution by a blockchain intelligence firm; it should be distinguished from a final determination by law enforcement.

Binance’s preliminary explanation points to a potentially compromised DevOps engineer’s laptop that may have enabled access to a service container and unauthorized withdrawal transactions. The company says it has found no evidence of a wallet private key leak and will publish a technical report after its investigation. Those statements describe an ongoing inquiry, rather than a settled account of the attack.

Service status has also changed. Although Binance initially announced a suspension of deposits and withdrawals, its subsequent official update says deposits are operating normally while withdrawals remain paused. Binance states that it expects withdrawals to resume within 48 hours. That is a target announced by the exchange, not confirmation that withdrawals have resumed.

The incident concerns Binance.com. Reuters reported that Binance.US, a separate exchange, said it was unaffected. Customers should identify the platform and legal entity servicing their account before assessing their position.

Frozen cryptocurrency still has to be recovered

The response illustrates how quickly cooperation among exchanges and token issuers can restrict the movement of stolen assets. Reuters reported that Tether froze nearly $1.57 billion and Circle froze more than $800 million linked to the incident.

A freeze can preserve assets while investigators trace transactions and establish who is entitled to them. It does not, by itself, show that those assets have been returned to Binance or credited to particular customers. The route to recovery may require cooperation from an issuer or intermediary, proof of ownership, and legal process in the relevant jurisdiction.

Businesses receiving payments connected to affected addresses may face a different problem: establishing that their own transactions were legitimate. Payment instructions, invoices, wallet records, and evidence of the commercial purpose of a transfer can become important if an intermediary questions or restricts funds.

What the reimbursement promise means for customers

Binance’s commitment to absorb losses is significant. Customers should nevertheless monitor how that commitment is implemented and whether their account balances and withdrawal access are restored. An assurance about customer funds does not answer every question about the timing or scope of compensation.

For example, a customer may have an intact account balance but be unable to complete a time-sensitive payment. A business may incur borrowing costs while waiting to access assets. Whether either loss is compensable requires a separate assessment of the agreement, applicable law, causation, and supporting evidence. The existence of a hack alone does not establish a customer’s entitlement to every resulting expense or market loss.

The legal analysis begins with the account relationship

Before pursuing a claim, counsel should identify the contracting entity and obtain the terms applicable to the account and relevant period. The review should address custody obligations, withdrawal restrictions, liability provisions, notice requirements, governing law, and any dispute resolution procedure. Different account relationships can produce different legal outcomes.

A potential breach of contract claim requires analysis of the obligation allegedly breached and the loss that followed. Any negligence, misrepresentation, or other theory needs its own factual and legal foundation. Binance’s preliminary technical explanation does not establish that the exchange breached a particular legal duty, nor does a reimbursement announcement resolve every possible dispute.

For now, customers can protect their position by preserving evidence and communicating clearly through verified support channels. Filing an unsupported claim before identifying an actual loss and the correct respondent can complicate an already difficult recovery process.

Steps customers can take now

Save account statements, transaction histories, balances, withdrawal attempts, error messages, and support correspondence. Record dates, times, and time zones.

Preserve the account agreement and relevant announcements. Keep copies of any instructions or compensation terms presented to you.

Document actual financial consequences, including additional fees, borrowing costs, or disrupted payments. Retain records showing how the restriction caused the expense.

Use verified exchange channels. Do not disclose passwords, seed phrases, private keys, or authentication codes to anyone offering assistance.

If your records indicate theft or unauthorized activity, seek appropriate legal assistance and consider a law enforcement report. A platform-wide withdrawal pause alone does not prove that your individual account was compromised.

The FBI’s guidance for cryptocurrency scam victims identifies wallet addresses, transaction hashes, asset amounts, and dates as important information for investigators. It also warns that purported recovery services may themselves be scams. Be particularly cautious of unsolicited contacts promising guaranteed recovery or demanding an additional payment to release funds.

Businesses should review exchange exposure and continuity plans

For businesses that rely on exchanges for treasury operations, trading, or customer payments, this incident is a reason to review how long operations could continue if withdrawals were unavailable. That review should consider payment deadlines, available liquidity elsewhere, and concentration of assets with one provider.

Businesses should also review relevant insurance policies and commercial agreements for notice requirements and potential coverage. A policy’s existence does not establish that a particular theft, interruption, or third-party loss is covered. The wording and circumstances matter.

Proof-of-reserves disclosures also deserve careful reading. The SEC’s investor bulletin on proof of reserves explains that these reports are not equivalent to financial statement audits and may omit a complete picture of liabilities. They can inform a review of an exchange, but should be assessed alongside contractual protections and the ability to access assets.

Legal assistance after a crypto exchange hack

Kelman PLLC advises clients on digital asset matters, including asset recovery and litigation and arbitration. If an exchange incident has left your business with inaccessible assets, a disputed balance, or a documented loss, we can help assess the relevant agreements and available legal options.

Information current as of October 30, 2026. This is a developing incident; estimates, service availability, and investigative findings may change.

Attorney Advertising. This article provides general information, not legal advice.