Binance, the world’s largest cryptocurrency exchange, has temporarily suspended deposits and withdrawals following a major security breach reportedly involving about $6.3 billion in digital assets.
The exchange said its preliminary investigation indicated that an attacker may have gained unauthorised access to its systems through a compromised laptop belonging to an engineer.
In a statement released on Thursday, Binance disclosed that it was working with blockchain intelligence firms, cryptocurrency issuers and law enforcement agencies to investigate the incident and recover the affected assets.
“The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with $3 billion frozen on-chain so far,” the company said.
Binance explained that its initial findings suggested the attacker had compromised a DevOps engineer’s laptop, potentially enabling access to a service container through which unauthorised withdrawal transactions were submitted.
However, the exchange said it had found no evidence that private keys, which provide access to cryptocurrency wallets, had been exposed.
The company subsequently suspended deposits and withdrawals while its security team conducted checks and worked to contain the incident.
“Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe,” Binance said in a post on X.
North Korean Hackers Suspected
Blockchain intelligence firm TRM Labs has linked the incident to TraderTraitor, a cybercrime operation associated with North Korean hackers.
If the reported losses are confirmed, the incident would rank as the largest cryptocurrency theft on record, surpassing the $1.5 billion cryptocurrency theft from the Bybit exchange in 2025, which was attributed to North Korean hackers.
However, investigations into the Binance incident are ongoing, and the full circumstances surrounding the attack have yet to be conclusively established.
The incident has renewed concerns about the vulnerability of cryptocurrency platforms to cyberattacks, particularly those involving compromised employee devices and unauthorised access to internal systems.
Tether, Circle Freeze Funds
Major cryptocurrency companies have moved to limit the potential losses by freezing digital assets believed to be connected to the incident.
Tether Chief Executive Officer Paolo Ardoino said the company had frozen approximately $1.5 billion in USDT, its dollar-linked stablecoin.
Circle, the issuer of another major stablecoin, also reportedly froze about $800 million in assets amid reports of a potential security breach at Binance.
Binance said the amount of frozen funds could increase as investigators and industry partners continue tracing transactions across different blockchain networks.
The exchange is working with relevant stakeholders to identify the movement of the affected assets and prevent further transfers where possible.
Bitcoin, BNB Prices Fall
The reported security breach triggered a negative reaction in the cryptocurrency market, with major digital assets recording significant declines.
Bitcoin fell by approximately four per cent to $77,229 in the hours following reports of the incident.
BNB, the native token of the blockchain ecosystem developed by Binance, also dropped by about 7.5 per cent.
The price movements reflect investor concerns about the potential consequences of a major security incident at a leading cryptocurrency exchange.
Binance, which was established in 2017, reportedly holds approximately $140 billion in digital assets, making its security arrangements and ability to protect customer funds significant to the wider cryptocurrency industry.
CZ Says Customer Funds Should Be Covered
Binance co-founder and former chief executive, Changpeng Zhao, popularly known as CZ, also commented on the incident.
Although he stepped down from management of the exchange in 2023 following a settlement with United States authorities over anti-money-laundering compliance failures, Zhao said he expected customer funds to be protected.
As a shareholder, he expressed confidence that users would not ultimately bear the financial losses associated with the incident.
Binance has also indicated that it would cover eligible customer losses using its own resources, including its Secure Asset Fund for Users (SAFU), an emergency fund established to provide an additional layer of protection for customers.
The company’s final assessment of the losses and the extent of customer exposure will depend on the outcome of the ongoing investigation.
Polymarket Reports Separate Security Incident
The Binance incident emerged just hours after Polymarket, a popular prediction market, reported a separate security issue involving one of its third-party service providers.
Polymarket temporarily suspended trading after discovering that the provider had been compromised, potentially exposing some users to unauthorised activity involving their accounts.
The platform said it had referred the matter to law enforcement and promised to compensate affected users.
The two incidents have raised fresh questions about the security of cryptocurrency trading platforms and the risks associated with third-party technology providers.
In recent years, cryptocurrency exchanges and decentralised finance platforms have repeatedly been targeted by hackers seeking to exploit vulnerabilities in software, digital wallets and internal security systems.
Crypto Industry Faces Growing Security Threats
The reported Binance breach comes amid continuing concerns over cryptocurrency theft and the growing sophistication of cybercriminal operations.
According to blockchain analytics firm Chainalysis, North Korean-linked hackers stole approximately $2 billion in cryptocurrency in 2025, representing a 50 per cent increase from the previous year.
In another major incident, hackers reportedly stole about $280 million from the Drift cryptocurrency exchange in April.
The latest developments have highlighted the importance of stronger cybersecurity controls, effective monitoring of employee devices, rapid detection of suspicious transactions and cooperation between cryptocurrency companies and law enforcement agencies.
For Binance, the immediate priority remains containing the incident, tracing the affected funds and establishing the full extent of the losses.
The company is expected to release a detailed technical report after completing its investigation and verifying the facts surrounding the breach.
