The estimated $6.3 billion Binance breach has led the exchange to halt deposits and withdrawals. Binance is actively tracking unauthorized transactions stemming from the security breach and collaborating with blockchain partners to freeze the targeted funds. On Thursday, the exchange reported that approximately $3 billion had been successfully frozen on-chain, and assured users that they will not bear any losses.
That $6.3 billion figure represents an overall impact estimate rather than a final tally of losses. Preliminary reviews by Binance point toward a compromised DevOps engineer’s laptop, and the platform found no indications that a wallet private key was leaked. At this stage, no individuals have been publicly named as responsible.
What Happened: Inside the Binance $6.3 Billion Hack
The suspected attack vector centers around that compromised laptop, which an intruder reportedly used to access a service container and initiate unauthorized withdrawal transactions. Upon discovering this activity, Binance revoked the affected address authorization.
This particular path points to an internal development or operations setup rather than a verified compromise of private keys. Because Binance has not yet released the full technical sequence of events, the account involving the laptop and service-container account remains a preliminary explanation.
Binance emphasized that company reserves and the SAFU fund will cover all losses. Co-founder Yi He stated that user funds remain secure and that the exchange intends to absorb the entirety of the hacking losses. Former chief executive Changpeng Zhao, who remains a shareholder, noted that the incident appeared to be a hack and that user protections would cover user balances.
The breach came to light after a user flagged the movement of over $2.7 billion out of a Binance wallet to an external destination. The affected assets included ether along with stablecoins issued by Tether and Circle. Following this discovery, Binance verified the security breach and began halting deposits and withdrawals while initiating internal security checks.
The company is currently coordinating with blockchain partners and law enforcement to secure assets and identify the perpetrators. Because the investigation remains ongoing, Binance has advised users to seek updates exclusively through official company channels.
Bitcoin Magazine outlined the exchange’s version of events, mentioning the $6.3 billion estimate, the potential laptop compromise, and the suspension of deposit and withdrawal services.
Who Is Behind the Incident and the Attribution Claims
Binance is spearheading the probe. The platform has not publicly identified an attacker, assigned blame to a specific criminal organization, or linked the incident to Lazarus or North Korea. Current knowledge is limited to the suspected access route and the subsequent countermeasures taken by exchanges, stablecoin issuers, and blockchain protocols.
According to Tether Chief Executive Paolo Ardoino, the firm froze more than $1.567 billion in USDT associated with the suspected attacker. Circle Chief Executive Jeremy Allaire reported that Circle froze over $800 million in USDC in cooperation with law enforcement. Additionally, First Digital Chief Executive Vincent Chok confirmed that stolen FDUSD had been frozen.
Reports also indicate that Aave temporarily halted lending markets to prevent the suspected attacker from taking out loans against the stolen cryptocurrency. While these emergency freezes limit how specific assets can be moved or utilized, they do not automatically prove that every impacted coin has been fully recovered.
Background: How the Binance Incident Developed
Initial estimates placed the potential impact between $2.7 billion and $5.8 billion before Binance adjusted the figure upward to roughly $6.3 billion. This revised amount is still considered preliminary as the investigation moves forward.
This metric encompasses the total financial scale touched by the event, rather than confirmed permanent losses. Both Binance and multiple token issuers emphasize that substantial sums have successfully been frozen.
If finalized, this figure would surpass the $1.5 billion Bybit hack from 2025, which CoinDesk previously connected to North Korea. This comparison has transformed the Binance security breach into an industry-wide crisis rather than an isolated exchange outage.
CoinDesk characterized the Binance breach as larger than the Bybit theft and connected the concurrent market selloff to mounting anxieties regarding platform security. The publication also noted that the breach coincided with a separate attack targeting Polymarket.
Earlier on Thursday, Polymarket suspended international trading after hackers drained more than $2.6 million from user accounts. Although these two separate events struck different platforms and involved distinct financial sums, their simultaneous timing heightened unease across the broader crypto sector.
These back-to-back security breaches also highlighted the vulnerabilities existing between centralized exchanges, decentralized protocols, and the third-party service providers linking them together. Standard Chartered Global Head of Digital Assets Research Geoffrey Kendrick suggested that markets may remain under pressure until the frozen assets are released and additional details become public.
Why the Binance Breach Matters for Users, Markets and Exchanges
Binance maintains that user balances are safe and has committed to covering losses using SAFU and corporate funds. Once remediation efforts conclude, the exchange plans to release an updated Proof of Reserves to provide users with renewed visibility.
For the time being, the immediate operational impact involves restricted access to deposits and withdrawals. Although trading functionalities and account balances remain intact, users currently cannot transfer assets away from the platform. Clients are instructed to monitor official Binance notices for service restoration updates and to disregard communications from unverified sources.
Binance.US clarified that its platform was unaffected by the incident. While this distances the US service from the primary security event outlined by Binance.com, it does not alter the suspension status of deposits and withdrawals on the impacted platform.
In the wake of the news, bitcoin experienced a sharp drop to $76,301 after previously hitting a 24-hour peak of $81,890. Widespread liquidations swept through leveraged market positions, bringing total crypto liquidations to $1.5 billion, which included $468 million in bitcoin positions and $358 million in ether positions.
Ether, BNB, XRP, and Solana also experienced downward pressure during the selloff. Beyond the specific assets drained from the Binance wallet, the security breach triggered forced liquidations and dealt a severe blow to trader confidence across the market.
Kendrick noted that negative price momentum could persist and suggested that markets might struggle to find a stable floor until the frozen funds are addressed and further details emerge. He further argued that the breach might accelerate a structural migration from centralized exchanges toward decentralized alternatives.
However, such a transition is not guaranteed, as decentralized exchange tokens also declined alongside the broader market, signaling that traders did not view DeFi as entirely insulated from these security anxieties. Instead, the incident places pressure on every platform to demonstrate rigorous handling of user permissions, withdrawal controls, incident response plans, and user reimbursement guarantees.
The Numbers: What the Figures Show
Binance’s estimated impact sits at roughly 4.2 times the magnitude of the $1.5 billion Bybit theft, positioning the Binance incident among the largest recorded crypto heists in history. Binance continues to classify the figure as an ongoing estimate while investigations proceed.
With assistance from blockchain partners, Binance has successfully frozen roughly $3 billion on-chain, representing about 48% of the $6.3 billion estimated impact. It is important to note that frozen funds are not identical to assets that have already been returned to users.
Combined, Tether’s reported freeze of over $1.567 billion in USDT and Circle’s freeze of over $800 million in USDC account for more than $2.367 billion in restricted tokens. These figures reflect statements from issuers regarding accounts linked to the suspected attacker, contributing to the broader $3 billion total frozen on-chain reported by Binance.
This coordinated freeze response demonstrates how stablecoin issuers can intervene after compromised funds travel through their respective tokens. It also sparks a race against time between investigators and threat actors; the longer stolen capital remains in formats that allow issuers or protocols to intervene, the greater the likelihood of containment.
Bitcoin’s descent from an intraday high of $81,890 down to a low of $76,301 equates to roughly a 6.8% decline. The corresponding liquidation data highlights how the fallout expanded far beyond the initial exchange breach, with long-position traders absorbing the majority of the forced losses.
Risks-and-Open-Questions-After-the-Freeze
According to Arkham, the suspected exploiter converted $911 million into ether and TRX. Reporting from The Defiant indicated that these token conversions moved the stolen USDT beyond Tether’s native token-freezing mechanism, complicating recovery efforts once the capital changed forms.
Asset conversions can splinter the transaction path and increase the sheer number of protocols and platforms involved. This dynamic can leave investigators heavily reliant on various exchanges, token issuers, and lending protocols to spot and restrict the same capital as it hops across different assets.
Binance has not yet issued a comprehensive post-mortem report, a timeline for its release, or the identities of those behind the attack. The final technical accounting must clarify how the engineer’s laptop was compromised, what privileges the targeted service container held, and the mechanics that allowed unauthorized withdrawals to process unchecked.
Additionally, the aggregate total of frozen funds may fluctuate as industry partners identify and secure further assets.
Deposits and withdrawals remain halted while Binance audits its infrastructure, revokes compromised access points, and coordinates with law enforcement. In the absence of a firm reopening schedule, users must rely on the exchange’s ongoing internal security verifications.
What Happens Next for Binance
Binance continues to audit affected systems while partnering with blockchain entities to freeze additional assets wherever possible. The exchange is also working to establish the identities of those responsible and urges users to keep a close eye on official communication channels.
Meanwhile, Tether, Circle, and First Digital are monitoring tokens associated with the suspected attacker, and Aave’s lending-market freeze illustrates that defensive measures extend far beyond Binance’s direct control. The next phase will heavily involve tracking funds that have already been converted into ether and TRX.
Binance has stated that a thorough technical post-mortem will be published once the investigation concludes and facts are verified. The company also intends to release a refreshed Proof of Reserves report following the completion of remediation steps.
These upcoming disclosures will be critical for distinguishing between early impact estimates and final accounting figures. They should also shed light on whether the breach was confined to a single service environment, how authorization protocols have been adjusted, and when Binance anticipates safely resuming normal deposit and withdrawal operations.
Primary near-term indicators to watch include formal notices restoring deposit and withdrawals, updates to total frozen asset figures, and the eventual publication of Binance’s technical audit. Additionally, users are advised to differentiate between assets that have been frozen, assets successfully recovered, and losses explicitly reimbursed via company funds or the SAFU program.
FAQ
What amount does Binance estimate was affected by the security incident?
Binance estimates the total impact at about $6.3 billion. The amount is preliminary and covers the value affected by the incident rather than a confirmed final loss after freezes, tracing and reimbursement.
What did Binance say caused the unauthorized withdrawals?
A compromised DevOps engineer’s laptop is the early focus. The attacker allegedly used access to a service container to submit unauthorized withdrawal transactions, while Binance said it found no evidence of a wallet private-key leak.
Which companies froze assets connected to the suspected attacker?
Tether said it froze more than $1.567 billion in USDT, and Circle said it froze more than $800 million in USDC while working with law enforcement. First Digital also said stolen FDUSD had been frozen. Aave reportedly froze lending markets tied to the suspected attacker.
Are Binance.US users affected by the incident?
The US exchange said the incident did not affect its platform. The deposits and withdrawals suspension described in the incident concerns the Binance platform under investigation.
What happened to Binance deposits and withdrawals after the breach?
Deposits and withdrawals were suspended while Binance conducted security checks, revoked the affected authorization and worked with partners and law enforcement. The exchange has not provided a restoration date.
How did the incident compare to the Bybit hack?
At $6.3 billion, the estimated impact exceeds the $1.5 billion Bybit hack in 2025, which CoinDesk said was linked to North Korea. The comparison makes the Binance breach one of the largest reported crypto thefts on record.
What has Binance said about publishing a technical post-mortem?
A detailed technical post-mortem will come once the investigation is complete and the facts are verified, Binance said. It also said it would publish an updated Proof of Reserves after remediation, without giving a publication date.
