Cryptocurrency prices fell on news of the hack, which analysts blamed on North Korea and said could be the largest financial heist of all time. The publicly traded stocks of crypto-related firms Coinbase, Strategy and Robinhood slid.
Binance said customer funds were safe and it was working with industry partners to freeze some of the affected assets, with about $US3 billion located so far.
It did not mention the status of the remaining $US3.3 billion, but Binance co-CEO Yi He said in a post on X that $US3 billion represented only about 2 per cent of the company's total user assets and public reserves.
The exchange also said on Friday its technical team was targeting a resumption of withdrawal services within approximately 34 hours.
Binance said it was conducting a full security review and plans an initial proof-of-reserves snapshot in 12 hours, with the results expected to be available by Monday.
It said it had set aside around $US6.34 billion of company funds internally to cover the losses.
The company has a $US1 billion Bitcoin reserve fund designed to protect customer assets in the event of security breaches, according to its website.
Binance founder Changpeng Zhao said on X the company owned SpaceX shares worth more than $US1 billion ($A1.4 billion).
Binance's other co-CEO, Richard Teng, said in a post on X that the breach was a "complex attack" that was not carried out by one person and included a compromised laptop as well as malicious software designed to delete evidence of its activity as it went along, "making it more difficult for us to trace and investigate".
The hackers were able to manipulate a system used to approve transactions to move money out of a Binance-controlled, internet-connected so-called "hot" wallet in a way that did not pass through normal approval controls, Teng said.
"Rest assured that we are working nonstop to resolve this, to make the users whole, and live up to your trust," Teng wrote.
Crypto prices fell broadly but losses were contained.
Bitcoin hit a six-week low of $US76,368 ($A108,594), and ether fell more than 3 per cent to a two-month low of $US2,178 before markets stabilised.
"This incident is almost certainly the single-largest-known theft of any kind," British blockchain analysts Elliptic said.
The bulk of the Binance heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.
TRM said the attackers were able to order Binance wallets to empty into hacker-controlled wallets, mirroring a 2025 heist at crypto exchange Bybit, which the FBI attributed to North Korea.
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to US and South Korean authorities as well as cybersecurity experts.
US President Donald Trump, asked on Friday whether North Korean hackers were behind the theft, said he did not know but his administration is looking into it.
"It was a hack. That's the problem. You know the old-fashioned way when you used to sign a cheque, take it out. These are different. People never see the money anymore. So I've always felt it was a little bit dangerous," Trump said.
"But no, they (Binance) say they have it pretty much under control."
Binance is working with the FBI and the US Secret Service, according to a person familiar with the situation.
Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $US162.8 billion in assets under custody as of its 2025 annual report.
