Binance Hack: Exchange Says $6.3 Billion Impacted in What May Be the Largest Crypto Theft Ever

Binance, the world’s largest cryptocurrency exchange, says a security incident has impacted an estimated $6.3 billion in digital assets, which would make it the biggest crypto theft on record if the figures hold.

The exchange said about $3 billion of the affected assets had been frozen on-chain so far with help from other companies, and it pledged to cover all losses from its emergency fund and company money. Deposits and withdrawals were temporarily suspended while security checks continue, according to the company’s statement reported by CNBC and CoinDesk.

This article is for information only and is not financial or investment advice.

What happened at Binance?

The first signs came Thursday afternoon ET, when Binance said it was investigating reports of a potential security issue. AP reported that the exchange’s founder said the incident “does look like a hack on Binance.” Later Thursday, Binance put the estimated total impact at more than $6 billion.

In an update, Binance said its initial investigation suggests “the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” It added: “We have found no evidence of any wallet private key leak,” and promised a detailed technical post-mortem once the investigation is complete.

Early AP reporting noted that the full extent of the damage was not immediately clear. The figures so far come from Binance and blockchain analytics firms and could change.

Is my money safe on Binance?

Binance says user funds are safe and that it “will cover all losses” through its Secure Asset Fund for Users (SAFU) and company funds. Co-founder and co-CEO Yi He said on X that the platform would cover all hacking losses, CoinDesk reported.

As immediate steps, Binance said it has:

• Temporarily suspended deposits and withdrawals while security checks are completed
• Revoked the affected address authorization
• Brought in law enforcement and blockchain intelligence partners to trace and recover funds

Reports differ slightly on deposits. Binance’s statement said deposits and withdrawals were suspended, while CNBC reported that Yi He said deposits were unaffected and operating normally. CNBC also said Binance expects to begin resuming withdrawals within the next 48 hours. The company has said it will publish an updated proof of reserves after remediation.

Who is behind the Binance hack?

No government has publicly confirmed who did it. The BBC reported that two analytics firms attributed the attack to TraderTraitor, a North Korean hacking unit. TRM Labs said it had “high confidence” in that assessment, according to CoinDesk, and said elements of the attack resemble earlier North Korea-linked incidents, including the 2025 Bybit hack. Binance said it is working with law enforcement to identify those responsible.

How much has been frozen or moved?

Stablecoin issuers moved quickly. Tether and Circle together froze about $2.4 billion of assets, the BBC said, and Circle CEO Jeremy Allaire said his company had frozen more than $800 million. CoinDesk reported that $2.3 billion of the $3 billion frozen was in USDT and USDC stablecoins.

Blockchain data cited by CoinDesk showed the attacker’s wallets at one point held more than $5.7 billion in crypto, including nearly $1.5 billion in bitcoin, and that funds were moving through decentralized platforms such as Uniswap and Aave.

What did it do to bitcoin’s price?

Bitcoin fell more than 4% to about $77,995 on Friday as concerns over the incident weighed on crypto markets, CNBC reported. Shares of Circle fell about 5% in after-hours trading Thursday. Crypto prices are volatile and may have moved since.

Why it matters

The BBC noted that the incident would eclipse the record $1.5 billion Bybit hack in 2025. TRM Labs’ Ari Redbord told the BBC it was a “watershed moment” and that efforts to trace and recover the funds are “far from over.”

FAQ