Binance Co-CEO Yi He: About $3 billion in stolen assets have been frozen; withdrawals are expected to resume within 42 hours
Binance Co-CEO Yi He said the hack involved about $6.3 billion in assets, and with the help of industry partners, about $3 billion in assets have been frozen; she thanked all parties for their assistance and said the company will match the stolen assets with its own funds to ensure a full 1:1 match with user assets.
On withdrawal arrangements, Yi He said the suspension of withdrawals has been close to one day and is expected to be lifted within the next 42 hours; the suspension is to protect the remaining assets. The team is restructuring the security environment and wallet settings and conducting a security review, and withdrawals will only reopen after confirming that the environment is safe and will not affect user assets. She clarified that the company’s daily revenue and held assets are mostly crypto assets, and most of the coins involved in the stolen assets can be matched; only a small amount of assets need to be purchased through on-exchange or OTC channels, and it is not necessary to put all more than $6 billion into the market to buy back coins. On reserve verification, the company will update its proof of reserves (PoR) in the coming days for users to verify their own assets.
On the investigation, Yi He said that based on the current review by the security and technical teams, the incident is a complex, composite attack, and subsequent operations will be more cautious; the company will in the future release a detailed technical security audit report and invite industry participants to jointly build a secure environment and standards. She also said the company will not give up tracking down the attackers, will continue to pursue the attack team and the stolen funds in cooperation with global law enforcement agencies, and will take further action on security spending and fighting hackers.
Original source:
Title: Yi He video/text statement (including English translation)
Publisher: Yi He (@heyibinance)
Date of publication: 2026-10-30
URL: https://x.com/heyibinance/status/2116203146829852808 (and related translated posts)
Source type: original social media statement
Verification status: full English translation and related official updates read
Supporting content: $6.3 billion involved, $3 billion frozen, withdrawal resumption within 42 hours, matching with own funds, PoR update, composite attack, public technical audit, continued tracking and law enforcement cooperation
ABAB AI Insight
As Binance Co-CEO and Chief Customer Service Officer, Yi He spoke directly to users after the incident, continuing her long-standing public stance of emphasizing that “User funds are SAFU.” This statement explicitly links the coverage commitment with the timetable for withdrawal resumption, and it corresponds with the company’s prior announcement that it held more than $6.34 billion in company funds, of which about $5 billion already held the corresponding tokens, reflecting an operational order that places matching user assets first.
On the capital path, about $3 billion frozen, mainly from stablecoin issuers and on-chain partners, reduced the actual shortfall that needed to be newly purchased. Combined with the company’s own crypto assets and the SAFU fund, most of the matching can be completed with existing assets, and only a small amount of altcoins needs to be topped up through on-exchange or OTC channels. This reduces immediate selling pressure in the public market. The fund flow is reflected as: frozen recovery + existing-asset matching + small additional purchases → 1:1 user coverage, with the benefit going to the integrity of user assets and the cost borne by the company’s balance sheet.
Comparable cases include Bybit’s roughly $1.5 billion stolen-asset replenishment and public PoR update after its 2025 incident, as well as the industry’s common practice of strengthening hot wallet permissions and DevOps access control after multiple large-scale thefts. Yi He’s explicit invitation for the industry to co-develop security standards and the plan to publish a detailed technical audit report show that centralized exchanges are shifting from single-point protection to cross-institutional collaborative security governance.
Specific judgment: if the promise to resume withdrawals within 42 hours is delivered on schedule, it will help stabilize user confidence and limit further outflows; however, the characterization of the event as a composite attack means the forthcoming public audit report may reveal more permission or process vulnerabilities, industry scrutiny of hot wallets and internal access control will tighten further, and the company’s incremental security spending may become a future cost item.
ABAB News · Cognitive Law
Frozen funds and matching with existing assets reduce the pressure for market buybacks.
Platform-side coverage keeps the loss on the company’s balance sheet.
Public technical audits turn a single incident into pressure for industry standards.