Binance says it will cover customer losses after a hack involving $6.3 billion in digital assets, but legal specialists are warning that recovering funds could be more complicated than the exchange’s public pledge suggests.

The breach, reported to be the largest crypto theft on record, affected Binance.com, the global platform of the world’s biggest cryptocurrency exchange, which signed a memorandum of understanding with Bermuda in 2018. The agreement was terminated in 2021. Binance said that about half of the affected assets had been frozen as it traces and recovers funds.

The company’s co-chief executive, Richard Teng, said the initial investigation suggested that a compromised laptop belonging to a DevOps engineer had given an attacker access to a service container and enabled unauthorised withdrawals.

He said the attack was more complex than a single misuse of one employee’s permissions. Binance later said that its investigation had found additional breaches.

Binance said it would cover all the losses from an emergency reserve created for such events, with company funds making up the rest. Deposits and withdrawals were temporarily suspended as a precaution.

However, Alexander Shirtcliff, head of commercial disputes and class actions at the London law firm Edwin Coe, said customers should not assume that the commitment was legally binding.

“Taking the current standard user terms at face value, they contain limits to Binance’s liability to customers and I see no commitment on using the Secure Asset Fund,” he said.

“How Binance decides to distribute the funds, to whom and when, the value of Bitcoin being volatile, will create a constellation of additional legal issues for the exchange which it will take time to work through.”

Mr Shirtcliff said that a freeze on assets was helpful but did not settle the question of who owned them.

“The freeze merely holds the ring on certain assets,” he said. “There is bound to be litigation concerning who owns the frozen assets.

“The real challenge here is recovering the loss represented by the stolen assets, meaning those not frozen.”

Daniel Tunkel, Edwin Coe’s head of financial regulation, said the outcome could depend on individual customer contracts and the jurisdiction of any claims.

“There is a difference here between blandishments from the board of Binance, which are largely for press consumption, and what the terms of individual Binance customers say,” he said.

Binance was once a prominent name in Bermuda’s effort to develop a fintech sector. In 2018, founder Changpeng Zhao signed a memorandum of understanding with the Government that envisaged up to 40 jobs, up to $10 million in blockchain training for Bermudians and up to $5 million for investments in local blockchain businesses.

The agreement was non-binding and was terminated on December 17, 2021, according to information disclosed to The Royal Gazette in 2024.

Mr Zhao later pleaded guilty in the United States to anti-money-laundering violations. Binance agreed to pay a $4.32 billion penalty, while Mr Zhao paid criminal and regulatory fines.

The BBC reported that Tether and Circle had frozen about $2.4 billion in assets in response to the incident. Bitcoin fell more than 4 per cent after the security alerts, while other major cryptocurrencies also declined.

Circle, the issuer of the US Dollar Coin, is among the digital-asset businesses licensed in Bermuda. There was no indication that its Bermuda operation was involved in the hack or the decision to freeze the assets.

Two blockchain analytics firms have linked the latest attack to TraderTraitor, a North Korean hacking unit also known as the Lazarus Group, although Binance has not confirmed responsibility.