According to Binance’s official announcement on October 30, the security incident is estimated to have affected approximately $6.3 billion, of which assets worth around $3 billion have already been frozen on-chain. Binance said it will cover all losses through the SAFU Fund and company funds, and publish an updated proof of reserves after the recovery is complete. This is a public commitment by the platform; whether it is fulfilled remains to be verified. [Official announcement](https://www.binance.com/pt-BR/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7)

According to a subsequent update from Binance News, deposits are operating normally, while withdrawals remain suspended during security remediation and are expected to resume within 48 hours. **An expected resumption does not mean withdrawals have already resumed. Check subsequent official announcements and actual service status for details on specific assets, networks, and arrival times.** [Official news update](https://www.binance.com/en-AE/square/news/all)

Regarding this incident, I think we need to distinguish between three things.

**First, freezing funds is not the same as recovering them, and the affected amount is not the same as the final net loss.** Freezing can prevent assets from being transferred further, but when funds will be returned and how much will ultimately be recovered remain uncertain. We cannot simply calculate “6.3 billion minus 3 billion” and treat the result as the final loss, nor can we consider frozen funds as already restored to reserves.

**Second, a security incident and solvency are two separate issues.** Being attacked is not, by itself, proof that the platform is insolvent. Likewise, a promise to “cover all losses” alone does not prove that the funding shortfall has been made up. More convincing evidence would include progress in covering the losses, updated disclosures of assets and liabilities, and whether withdrawals continue to arrive normally after they resume.

**Third, platform compensation and trading gains or losses should be treated separately.** Users should not interpret a promise to cover losses from a hacker attack as meaning that trading losses—such as losses caused by falling coin prices or liquidated futures positions—will also be compensated. Markets may fluctuate repeatedly in response to the news, and a price rebound is no substitute for evidence that security improvements have been completed.

At the technical level, Binance’s preliminary investigation points to an operations employee’s computer being compromised, and the company says it has found no evidence that wallet private keys were leaked. However, this is still a preliminary assessment; the full attack path will have to wait for the investigation report. Key questions to ask are: How did the attacker get from an employee’s device into the funds-handling process, and which access controls, approval procedures, or anomaly-blocking mechanisms failed to work? [Official preliminary investigation](https://www.binance.com/pt-BR/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7)

For ordinary users, the more practical steps to take at this stage are:

- **Check your account and keep records.** Review your balance, login devices, API permissions, and withdrawal history. If you notice anything unusual, contact customer support through the official app.

- **Prioritize access to your funds.** While withdrawals have not yet resumed, be cautious about making additional deposits, especially with funds you may need for living expenses or emergencies in the near future.

- **Avoid taking on extra leverage in response to the news.** Don’t treat the platform’s promise as a guarantee that buying the dip will pay off, or short the market out of panic. Reassess the margin requirements and potential losses for any existing positions.

- **Beware of “compensation registration” and “secure migration” offers.** Don’t give verification codes, private keys, or recovery phrases to strangers claiming to be customer support, and don’t transfer assets to an alleged secure address.

- **Once withdrawals resume, make any changes to your custody arrangements in an orderly way.** Diversify your exposure to any one platform according to your needs. Before using self-custody, learn how to back up your wallet and make transfers, and test with a small amount first.

I’ll be watching three key outcomes: **whether withdrawals resume reliably, whether the losses are actually covered, and whether verifiable evidence of security improvements is provided.** If these steps are completed, there will be a basis for rebuilding trust. If withdrawals are repeatedly delayed, disclosures remain inadequate, or deposits continue to arrive irregularly, users will need to reassess their exposure to the platform.

Make decisions about your funds based on your own needs and risk tolerance, and let verifiable progress determine how much you trust the platform.