On the face of it, maybe not so bad. Forty million is a plenty big number, but its only a small percentage of Binance funds, and users will apparently get their money back. At the very least, all Binance users need to update their API keys and two-factor authentication immediately.