Binance suspended deposits and withdrawals on Thursday after hackers removed more than $6 billion in cryptocurrency in about 20 minutes, exposing the limits of emergency reserves at the world’s largest crypto exchange.

Roughly half the stolen funds were stablecoins, which their issuers quickly froze. The rest involved tokens including bitcoin and ether, which have no central governing authority and are likely impossible to recover, according to crypto researchers.

Researchers estimate Binance’s losses could exceed $3 billion. That is a small fraction of its $155 billion in user assets, but more than three times its $1 billion emergency fund. Binance pledged to cover losses using those reserves and other assets, insisting that “user funds are safe.”

The distinction between reimbursing customers and preventing theft is central to the industry’s credibility as it markets itself as a safe alternative to conventional banking and investing.

“The fact that Binance may have the balance sheet to absorb the damage is encouraging, but I wouldn’t confuse financial strength with operational security,” said Ryan Kirkley, chief executive of crypto infrastructure firm Global Settlement Network.

He argued that reliance on emergency freezes and reimbursement promises posed a serious problem for an industry seeking substantially more institutional capital.

Hours before Binance halted transactions, a smaller breach disrupted Polymarket, the crypto-powered prediction market. Analytics firm Bubblemaps said about 700 users lost $2.7 million through unauthorised withdrawals. Polymarket promised full reimbursement. Its second apparent hack since June was likely unrelated to the Binance incident.

Any business can suffer a cyberattack. Centralised crypto exchanges, however, are high-value targets operating outside the strict regulatory framework applied to banks and other financial institutions. Cryptocurrency’s ability to move funds quickly and anonymously across borders has also attracted criminal enterprises.

Binance, founded in China and without a fixed headquarters, pleaded guilty in 2023 to US federal anti-money-laundering violations and other charges. Its Canadian founder, Changpeng Zhao, served four months in prison. President Donald Trump pardoned him last year, but he remains legally barred from running Binance.

Researchers at Chainalysis observed “laundering patterns we have not seen before” in Thursday’s theft. They said thousands of rapid transactions suggested attackers were using automation to obscure the money trail. Although artificial intelligence is intensifying internet security risks, those observations do not establish its use in this attack.

Despite the Trump administration’s favourable stance towards crypto, US regulation remains limited. Most American crypto investors use centralised exchanges without the federal deposit insurance offered by traditional banks. Binance’s reimbursement pledge addresses the immediate losses; the security weaknesses behind the theft remain unresolved.