He Yi Clarifies Binance Can Match Most Stolen Assets With Its Own Holdings

Binance CEO He Yi has provided further details about the exchange’s response to a major cyberattack involving approximately $6.3 billion in digital assets. According to her latest remarks, around $3 billion worth of assets had already been frozen with help from industry partners, while Binance plans to use its own balance sheet to match the remaining affected user assets.

The clarification addresses one of the central concerns raised by the incident: whether Binance would need to purchase more than $6 billion in tokens from the open market to restore user balances.

Binance Says Most Recovery Can Come From Existing Crypto Holdings

He Yi explained that Binance’s daily revenue and corporate treasury are largely held in cryptocurrencies. As a result, the exchange already possesses many of the same assets involved in the attack.

This means Binance can use its existing holdings to match most of the stolen tokens without creating immediate, large-scale buying pressure across the market. Only a relatively small portion of the affected assets would need to be acquired through centralized exchanges or over-the-counter trading desks.

The distinction is important for both market participants and Binance users:

• Asset matching refers to restoring the quantity and type of tokens owed to users.
• Open-market purchases involve buying tokens from available liquidity on exchanges or through OTC counterparties.
• Binance’s plan reportedly relies primarily on its own cryptocurrency reserves rather than a full-scale market purchase.

In other words, the exchange is not expected to put the entire $6.3 billion back into the market to replace the stolen assets. The amount requiring external purchases should be limited to tokens that are not sufficiently represented in Binance’s existing holdings.

Approximately $3 Billion in Assets Has Been Frozen

Industry participants have assisted Binance in identifying and freezing approximately $3 billion in assets connected to the attack. Freezing stolen cryptocurrency is often possible because public blockchains provide transparent transaction histories, allowing exchanges, custodians, analytics companies, and law enforcement agencies to monitor the movement of funds.

However, freezing assets is not the same as recovering them. Funds may move through multiple chains, decentralized protocols, bridges, mixers, or wallets controlled by intermediaries. The recovery process can therefore involve technical tracing, legal coordination, and cooperation across different jurisdictions.

The incident highlights one of blockchain technology’s defining characteristics: transactions are publicly visible, but identifying the real-world individuals behind wallet addresses can still be highly complex.

Withdrawals Remain Suspended During a Security Review

Binance has temporarily paused withdrawals to protect assets that were not affected by the attack. At the time of He Yi’s remarks, the suspension had lasted close to one day, with a projected recovery window of approximately 42 hours.

The exchange said it would not restore withdrawals simply because the technical fix was ready. Instead, its team is rebuilding parts of the security environment, reviewing wallet configurations, and conducting a broader security assessment.

Withdrawals are expected to resume only after Binance confirms that:

1. The revised security environment is stable.
2. Wallet permissions and operational controls have been reviewed.
3. Remaining user assets are not exposed to additional risks.
4. The exchange can process withdrawals without compromising account balances or transaction integrity.

For users, an extended withdrawal pause can be unsettling. Nevertheless, reopening withdrawals before completing a security review could create a second wave of losses. In a large-scale exchange incident, operational speed must be balanced against the risk of allowing an attacker to exploit an unresolved vulnerability.

A Complex, Multi-Stage Attack

He Yi described the incident as a complex, composite attack based on the preliminary work of Binance’s security and technology teams. This wording suggests that the event may have involved multiple attack vectors rather than a single compromised wallet or isolated private-key leak.

Modern attacks against digital-asset platforms can combine several weaknesses, including:

• Compromised credentials or privileged accounts
• Inadequate separation between operational systems
• Manipulated transaction approvals
• Social engineering and phishing
• Vulnerabilities in wallet-management infrastructure
• Cross-chain fund transfers designed to complicate tracing
• Delayed detection caused by abnormal but seemingly valid transactions

The exact technical mechanism has not yet been publicly disclosed. Binance has indicated that it intends to publish a detailed technical security audit in the future. Until that report is released, users and observers should avoid treating early explanations as a definitive account of the attack.

Proof of Reserves Will Offer Additional Transparency

Binance also plans to update its Proof of Reserves (PoR) data in the coming days. The update is expected to allow users to verify whether the assets attributed to their accounts are included in the exchange’s reported reserves.

Proof of Reserves can improve transparency by showing whether an exchange controls sufficient on-chain assets to cover customer balances. Binance’s official Proof of Reserves portal provides background on its reserve-verification approach.

At the same time, PoR should not be viewed as a complete replacement for an independent financial and security audit. A reserve snapshot may demonstrate control over certain assets at a particular point in time, but it does not automatically reveal:

• Whether private keys are managed securely
• Whether withdrawal systems are resilient
• Whether liabilities are fully disclosed
• Whether internal access controls are properly enforced
• Whether assets are subject to restrictions or other claims

For this reason, a comprehensive response should combine reserve verification, technical audits, wallet-security reviews, and clear reporting about affected assets.

Binance Promises Continued Investigation

He Yi said Binance would continue tracking the attackers and work with law enforcement agencies around the world to follow both the attack team and the stolen funds.

International cooperation is particularly important in cryptocurrency investigations because blockchain transactions can cross multiple jurisdictions within minutes. Exchanges, blockchain analytics firms, cybersecurity teams, and government agencies may each control only part of the information needed to identify suspects or freeze assets.

Binance also intends to increase investment in security and contribute to the development of industry-wide security standards. This could include stronger wallet governance, more rigorous transaction simulation, improved anomaly detection, stricter access controls, and clearer incident-response procedures.

The effectiveness of these measures will depend not only on the exchange’s internal policies but also on whether they are independently tested and transparently reported.

What the Incident Means for Crypto Users

The event reinforces several practical lessons for anyone holding digital assets.

1. Exchange balances are not the same as self-custody

Assets held on an exchange depend on the exchange’s operational, technical, and legal infrastructure. Even when a platform maintains sufficient reserves, users may temporarily lose access to withdrawals during a security incident or emergency review.

Long-term holders should evaluate whether every asset needs to remain on a trading platform. Funds that do not require frequent trading may be better suited to a secure self-custody arrangement, provided the owner understands how to protect recovery credentials.

2. Proof of Reserves is useful but limited

Reserve data can help users assess whether an exchange holds enough on-chain assets to support reported balances. However, users should also consider withdrawal history, security disclosures, custody practices, and the platform’s incident-response capabilities.

3. Security is a process, not a single product

A secure wallet setup involves more than hardware. Users must protect recovery phrases, verify transaction details, avoid suspicious links, separate trading funds from long-term holdings, and maintain secure backups.

4. Transparency after an incident matters

The quality of a company’s response can be measured by the clarity of its updates, the scope of its investigation, and whether it publishes verifiable information rather than relying solely on assurances.

A Broader Test for Exchange Security

Binance’s response will be closely watched because the incident involves asset freezing, withdrawal controls, reserve verification, and a commitment to reimburse affected users through company resources.

The immediate priority is to secure the remaining environment and protect customer balances. The longer-term test will be whether Binance can publish a technically credible audit, explain how the attack occurred, demonstrate that its controls have been strengthened, and provide transparent evidence that user assets have been fully matched.

For cryptocurrency users, the episode is another reminder that liquidity, convenience, and security must be considered together. Centralized exchanges remain important gateways to the digital-asset ecosystem, but users should avoid treating them as the only layer of custody.

For users who prefer to hold part of their assets independently, OneKey hardware wallets provide offline private-key storage and support for multiple blockchain networks. Used with careful recovery-phrase management and transaction verification, a hardware wallet can help reduce reliance on exchange custody for long-term holdings. It does not eliminate all risks, but it gives users greater control over the keys that authorize their transactions.