The Binance crypto hack has prompted the world’s largest cryptocurrency exchange to suspend withdrawals after a security breach estimated to have affected $6.3 billion. Binance says it has frozen about $3 billion in affected assets as investigators work to trace the funds.
The company said its preliminary investigation points to a compromised DevOps engineer’s laptop. An attacker may have used that access to submit unauthorized withdrawal transactions. Binance found no evidence that wallet private keys were exposed.
Binance has pledged to cover customer losses through its Secure Asset Fund for Users (SAFU) and company funds. Withdrawals remain suspended while security checks continue.
Binance Crypto Hack Triggers Billions in Asset Freezes
Binance founder Changpeng Zhao, who no longer manages the exchange, acknowledged the suspected hack on X. He said he expected affected users to be fully covered but provided no technical details.
Stablecoin issuers moved quickly to restrict transactions associated with the incident. Circle CEO Jeremy Allaire confirmed the freezing of more than $800 million in USDC in coordination with law enforcement.
Tether CEO Paolo Ardoino also reported freezing approximately $1.57 billion in USDT. These amounts form part of the broader effort to prevent suspected stolen assets from moving.
Investigators Examine the Scale of Binance’s Losses
Early blockchain analysis suggested that billions of dollars were moving from Binance’s internet-connected hot wallets. Cryptocurrency researcher Molly White flagged suspicious transfers exceeding $2 billion before the exchange disclosed its larger estimate.
CoinDesk reported that investigators tracked billions in cryptocurrency moving through attacker-linked wallets. However, the final amount stolen or recoverable remains uncertain.
If the estimated impact is confirmed as stolen funds, the incident would rank among the largest cryptocurrency exchange breaches. The Rekt leaderboard records the February 2025 Bybit attack at approximately $1.4 billion.
Binance has not publicly identified the attackers. It is working with law enforcement and blockchain intelligence firms while preparing a detailed technical report.
Polymarket Suffers Separate Security Incident
The Binance breach coincided with an apparently unrelated attack on prediction market Polymarket. The platform temporarily halted trading Thursday after discovering that a third-party service provider had been compromised.
According to Polymarket’s incident report, trading resumed after approximately one hour. The company promised to reimburse affected users.
Security researchers at Hudson Rock identified malicious code in a third-party monitoring script associated with DebugBear. The code was designed to access trading sessions and redirect cryptocurrency assets. Researchers cautioned that the total amount stolen remained unverified.
DebugBear acknowledged its own security incident and advised customers to remove its embedded monitoring code while the investigation continued.
