Binance has halted deposits and withdrawals across its platform while it investigates a security incident that the exchange says affected roughly $6.3 billion in assets, a figure that would make it the largest cryptocurrency theft on record. The company said about half of that total — some $3 billion — has already been frozen with help from blockchain partners and other crypto firms. Binance has pledged to absorb every loss and insists customer balances remain intact.
- Key Point: Binance estimates the incident touched about $6.3 billion in assets and says roughly $3 billion has been frozen so far.
- Key Point: The exchange’s preliminary review points to a compromised laptop belonging to a DevOps engineer, which gave an attacker access to a service container and the ability to submit unauthorized withdrawals.
- Key Point: Tether froze about $1.6 billion in USDT and Circle froze more than $800 million in USDC, while Binance suspended deposits and withdrawals as a precaution.
- Key Point: Bitcoin fell sharply on the news, dropping below $79,000 at one stage, with Ethereum and Solana also losing ground.
How the suspected breach unfolded
The trouble surfaced publicly on Thursday, when users began reporting that funds were draining from the exchange’s wallets. Binance initially said it was aware of reports of a potential security issue and was investigating urgently, and a spokesperson later confirmed that withdrawals had been suspended on multiple networks as a precautionary measure. Deposits were also halted.
In its account of the incident, Binance said early checks suggest an attacker gained entry through a compromised laptop used by a DevOps engineer. From there, the intruder reached a service container and pushed through withdrawal transactions that had not been authorized. The company stressed that it has found no sign that any wallet private key was exposed, pushing back on the idea that customer wallets themselves were breached.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the company wrote. “We have found no evidence of any wallet private key leak.”
Roughly $3 billion has been located and frozen on-chain, and Binance cautioned that the tally of affected and recovered assets could keep shifting. “This figure may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets,” the exchange said. It has promised a detailed technical post-mortem and an updated proof of reserves once remedial work is finished.
Stablecoin issuers move to lock down funds
Much of the recovery effort came from the companies behind the dollar-pegged tokens that moved through the hackers’ wallets. Tether chief executive Paolo Ardoino said his firm froze around $1.6 billion in USDT tied to the suspected Binance hack. Circle boss Jeremy Allaire said his company, which issues USDC, had frozen more than $800 million and was coordinating with law enforcement.
“Protecting the industry and our partners is our main priority,” Ardoino said.
World Liberty Financial, a crypto venture connected to US President Donald Trump and his family, said it worked with partners to freeze stolen funds. Rival exchange Coinbase said it was unaffected and was monitoring developments, and the smaller Binance.US platform, which serves American residents, said the incident did not touch its systems.
Binance co-founder Yi He thanked the issuers that moved to block the assets and said the exchange would stand behind the losses.
“Binance will cover all hacking losses,” Yi He said. “Safety first: withdrawals are currently disabled until the environment is confirmed to be secure.”
The company said it is drawing on its Secure Asset Fund for Users, an emergency reserve set up in 2018 and generally kept at around $1 billion, alongside its own corporate funds. It is also working with law enforcement to identify those responsible. “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” Binance said, urging users to trust only official channels and to be wary of scams, fake links and requests for account details.
Market reaction and a record in the balance
Traders reacted quickly. Bitcoin slid more than 4% following the alerts, at one point trading below $79,000, while Ethereum dropped about 4.6% and Solana also fell. The incident lands in a year already marked by major crypto security failures; the previous benchmark was a $1.5 billion theft from the Bybit exchange in 2025 that researchers linked to North Korea.
Changpeng Zhao, who founded Binance in 2017 and remains its largest shareholder, weighed in on X before the company’s confirmation, telling followers the episode looked like a hack and that he expected customers to be made whole. Zhao stepped down as chief executive in 2023 after pleading guilty to US anti-money-laundering failures, and he received a presidential pardon in 2025. Binance and Zhao have been prominent backers of crypto projects tied to Trump and his family.
“As a shareholder, I expect all user funds will be fully covered,” Zhao said.
The exchange, which says it has more than 300 million registered users and reported over $160 billion in assets under custody in 2024, has drawn regulatory scrutiny in several jurisdictions over the years. Unlike bank deposits, crypto holdings on exchanges carry no automatic insurance, so refunds ultimately depend on the platform’s willingness and capacity to pay.
What comes next hinges on the investigation. Binance has not disclosed how many customers were affected, whether the attacker has made contact, or how much of the missing $3.3 billion can still be recovered. The promised post-mortem and refreshed proof of reserves will be the first real test of its claim that user balances are untouched, and the episode is likely to sharpen scrutiny of how much control a single compromised employee device can exert over a platform holding tens of billions in customer assets.