Binance estimates $6.3 billion impact from security breach

Binance has estimated the impact of a security breach at $6.3 billion, potentially making it the largest cryptocurrency theft on record, while confirming that approximately $3 billion in affected assets has been frozen.

The world’s largest cryptocurrency exchange said on Friday that its preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer. The intrusion may have enabled an attacker to access a service container and submit unauthorised withdrawal transactions.

Binance said investigators had found no evidence that wallet private keys were leaked. It cautioned that its investigation was continuing and promised a detailed technical account once the circumstances had been verified.

The company has temporarily suspended deposits and withdrawals while conducting security checks, revoked the affected address authorisation and enlisted law enforcement agencies and blockchain intelligence specialists to trace the assets.

Binance pledged to compensate customers for hacking losses using its Secure Asset Fund for Users, known as SAFU, alongside company resources. It maintained that customer funds were safe, although the full extent of recoverable assets and the ultimate financial cost remain uncertain.

The approximately $3.3 billion difference between the estimated impact and assets frozen underscores the challenge facing investigators. Freezing tokens can prevent their transfer, but does not necessarily establish that the exchange has recovered control over them or that every affected asset can be retrieved.

Stablecoin issuers have participated in the containment effort. Tether said it had frozen more than $1.5 billion linked to the incident, while Circle reported blocking more than $800 million. Such interventions can restrict transfers of centrally issued tokens, although other cryptocurrencies may be harder to immobilise once moved beyond an exchange.

The incident rattled digital asset markets. Bitcoin fell to a six-week low, trading around $76,470 during the sell-off, while ether declined more than 3 per cent. Binance’s BNB token also weakened as investors assessed the potential consequences for the exchange and its customers.

Shares of Coinbase Global fell about 4.8 per cent in extended United States trading, while Strategy, a major corporate holder of bitcoin, declined nearly 6 per cent. The falls reflected broader unease over security and counterparty exposure rather than evidence that those companies had suffered comparable breaches.

The estimated impact exceeds the approximately $1.5 billion stolen from rival exchange Bybit in February 2025, previously regarded as the largest confirmed cryptocurrency heist. However, the Binance figure represents the company’s preliminary assessment of affected assets, not a final independently established measure of permanent losses.

Blockchain investigators have been examining transactions associated with the attack, including transfers across multiple digital asset networks. Attribution remains unresolved publicly, and Binance has not identified a perpetrator. Claims about responsibility therefore remain separate from the exchange’s confirmed account of its investigation.

The episode has revived scrutiny of centralised cryptocurrency platforms, which hold assets or manage transactions on behalf of customers. Even where underlying blockchain networks operate normally, weaknesses in internal access controls, operational systems or employee devices can create routes for unauthorised transfers.

For institutional investors, the immediate questions concern custody arrangements, the ability to withdraw assets and the financial capacity of an exchange to absorb losses. The distinction between a temporary asset freeze and an irreversible theft is particularly important when assessing potential exposure.

Binance has said it will publish updated proof-of-reserves information after remediation is completed. Such disclosures are intended to demonstrate holdings backing customer balances, although their usefulness depends on the scope of liabilities covered and the independent checks applied.

The exchange has also urged customers to rely on its official communications and avoid unsolicited messages or links purporting to offer assistance. Security incidents can generate phishing attempts aimed at users seeking information about withdrawals, compensation or account access.

Binance co-founder Changpeng Zhao, who no longer manages the exchange, described the episode as appearing to be a hack and welcomed the freezing of affected tokens. Co-founder Yi He separately assured customers that hacking losses would be covered.

Binance said its teams were continuing to work with law enforcement and industry partners to establish the attackers’ identities, trace transactions and determine which additional assets could be restricted. It has not announced a timetable for completing its technical investigation. The company said it would provide further updates through official channels as the security review proceeds, including information about operational restrictions and any additional measures needed before normal deposit and withdrawal services can resume.