Binance says it has frozen around half of the $6.3bn (£4.7bn) that was accessed in what is believed to be a record heist. The company says $3bn of stolen digital assets has been secured, but a large share remains in the hands of unidentified hackers. That gap should worry every customer who keeps money on an exchange.
The company's account of the breach has shifted. It first suggested that a compromised DevOps engineer's laptop had allowed unauthorised withdrawals, then said the breach went wider and involved additional points of entry. Co-CEO Richard Teng also described a "self-destruct mechanism" that destroyed tooling and traces as the attackers moved. When the explanation keeps changing, users are right to ask how much of the picture is still unknown.
Binance's reassurances are doing a lot of work. The firm told users "your money is safe, and we're covering every loss", and says it has set aside more than $6.34B in company funds and is "actively buying" tokens. Those are strong words, but they are not contract terms. Daniel Tunkel of Edwin Coe said recovery would "come down to what [customers] have been promised in their contracts". A promise made in a blog update is a weaker thing than a legal right, and the report notes that crypto history includes the collapse of FTX, whose leaders offered similar assurances before its failure.
Several analytics firms, including TRM Labs and Chainalysis, have linked the attack to North Korean-associated hacking groups, and Chainalysis reports "high confidence" in that link. Attribution matters for recovery, because the US Secret Service and the FBI can only bring the cases so far without global law enforcement cooperation. Still, attribution does not replace a clear remedy for customers.
My view is simple. Binance should publish a full, dated account of the breach, state exactly which customer losses it will cover and in what legal form, and commit to independent verification of its reserves. Regulators in the places where it operates should require the same. Until those steps happen, customers should treat the company's promises as hopes rather than guarantees.