Note that “crime” has a specific definition in law. You don’t have to be a criminal (commit a crime) to be rightfully sued, civil suits are a thing.
Anyway, your parent comment already answered the question, they would be sued by negligence.
Only the government (e.g., federal, state, local) may bring a criminal suit.[1] But in both civil / criminal cases they are still a suit under the law seeking some form of ordered relief from the Court.
Essentially, you can think of "criminal" as a category of law and relief (e.g., prison) that is only accessible to the government.
Both the government and citizens may bring "civil" suits. Very generally, the remedies in civil suits are a court order to 1) stop doing a thing; 2) to do a thing required by law / agreement; 3) to transfer property, usually but not always money, from one party to another; or 4) to define a set of rules governing the parties going forward.
[1] There may be some obscure exception to this, but it is true for everything I've ever seen / heard of.
> If they do not have the liquidity to let people withdraw money that is another issue, but it does not seem to be the case.
Again they cannot be charged for losing billions of their own money, and there is no way to somehow consider the lost funds as "customers' money". I am all for companies getting sued due to negligence when eg they fail to protect customer data, but this is just between binance and the hackers.
So this stolen crypto is off Binance own reserves. So it could be absorbed across current accounts as long as they aren’t drawn down to below $6B? And if crypto drops they can apply cash reserves to plug the hole more easily?