A day after confirming the breach, Binance has put a figure on what it managed to stop: roughly half. Unidentified attackers still hold the remainder of the record $6.3bn haul, and the search for it has now drawn in American federal investigators.
Who is chasing it
The US Secret Service — America’s lead federal agency for financial crime — said it was “working around the clock” to “identify, freeze, trace, and recover” the stolen funds, and that it would “identify the cyber criminals responsible and bring them to justice”. Binance says it is also working with the FBI.
Binance’s US-facing exchange was not affected, but American jurisdiction still applies: the theft involved dollar-pegged stablecoins issued by Tether and Circle, both US-linked, and recovery of this kind is in practice a global law-enforcement effort rather than one country’s.
What the company has admitted about the breach
Co-chief executive Richard Teng has retreated from the first explanation in stages. “This was not carried out by one person,” he now says, and the single compromised machine first blamed has given way to an admission of several ways in.
He also described the attackers using a self-destruct mechanism that destroyed tooling and traces as they went, making the investigation harder. That detail is the one professionals will have noticed: cleaning up behind yourself as you move is tradecraft, not opportunism, and it is consistent with a team that expected to be investigated.
The market reaction is the part worth explaining
Customers were made whole, and the market fell anyway. Bitcoin dropped 5% to $76,800 in Friday afternoon trading in New York. Coinbase, a rival exchange with no involvement, fell 12% — partly on its own earnings, which came in slightly below expectations. Robinhood also fell.
That is not irrational. A theft on this scale does not price in the loss to Binance’s customers; it prices in the discovery that the largest, best-resourced exchange in the industry could be entered through more than one door at once. If that is true of Binance, the market has to ask what is true of everyone smaller — and the answer is unknown, which is exactly what a falling price expresses.
For readers here the practical reading has not changed since the hack was confirmed: there is no licensed exchange in Bangladesh, no deposit protection, and no authority that would accept the complaint.
What “covering every loss” actually commits Binance to
The phrase is doing more work than it looks. Binance is not insured against this in the way a bank is; it is paying out of retained earnings and token holdings it already owns. That is possible because it is the largest exchange in the world and extremely profitable, and it is the reason the promise is credible here and would not be from a smaller operator.
It is also a one-off. A promise made in the aftermath of one theft is not a standing guarantee, and nothing in it obliges the company to do the same again. Anyone treating “Binance covers losses” as a feature of the platform is reading a press statement as a policy.
