Binance said Friday that a security incident had an estimated impact of $6.3 billion, with roughly $3 billion in cryptocurrency assets frozen so far, and pledged to cover all losses.
The world's largest crypto exchange said an initial investigation suggests "the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."
Binance co-founder Yi He said deposits remained unaffected and continued to operate normally while the exchange worked on enhancements to its withdrawal service and related address controls. She said Binance expects to begin resuming withdrawal services within 48 hours.
The exchange said it would cover all losses using its Secure Asset Fund for Users and company funds, adding that customer funds remained safe.
Binance temporarily suspended deposits and withdrawals, revoked the affected address authorization and enlisted law enforcement and blockchain intelligence firms to trace and recover funds. The company said it would publish a technical report and an updated Proof of Reserves after remediation efforts.
"We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified," Binance said.
The announcement followed moves by several crypto firms, including Circle Internet Group, Tether and Ripple, to freeze funds tied to the hack.
Bitcoin fell more than 4% to $77,994.96 on Friday as the hack weighed on crypto markets. Shares of Circle tumbled about 5% in after-hours trading Thursday.
"Our teams are aware of reports of a potential security issue and are actively investigating," a Binance spokesperson said. "Rest assured that user funds are completely safe." Binance also said on X that Binance Alpha trading had been temporarily suspended and that "the current verified total frozen is $2.54 billion."
Circle CEO Jeremy Allaire said Thursday evening in a social media post that the company had frozen more than $800 million in USD Coin associated with the incident. Tether CEO Paolo Ardoino said on X that his firm had frozen more than $1.5 billion of its stablecoin that may have been related to a potential breach.
Jack McDonald, Ripple's senior vice president of stablecoins, said the company was actively freezing affected funds held in RLUSD, its U.S. dollar-backed stablecoin. Later, Yi He said in a statement that Ripple helped halt the movement of $200 million of funds linked to the possible attack.
But those frozen funds could represent only part of those affected. Crypto data provider Arkham Intelligence linked nearly $6 billion in digital assets, including bitcoin, ether, solana and various stablecoins, to 55 wallet addresses it has tied to the potential exploit.
Arkham identifies, tracks and flags crypto wallets by analyzing publicly available blockchain data. It also solicits tips from its community members.
Exploits are not uncommon in the crypto space. In 2025, Bybit suffered roughly $1.5 billion in losses due to a hack. More recently, Bitget lost more than $350 million worth of digital assets in a cyber theft incident. Over the past several years, bad actors have also drained billions of dollars in crypto from decentralized exchanges.
