Binance has estimated a $6.3 billion impact from a major security breach, saying approximately $3 billion in affected cryptocurrency assets have been frozen as investigators examine unauthorised withdrawals.The world's largest cryptocurrency exchange said on Friday that preliminary findings pointed to a compromised laptop belonging to a DevOps engineer. The intrusion may have allowed attackers to access a service container and submit withdrawal transactions without authorisation.
Binance said it had found no evidence that private keys controlling its cryptocurrency wallets were compromised. It cautioned that its investigation remained incomplete and promised a detailed technical account once the findings had been established.
The company initially suspended both deposits and withdrawals while undertaking security checks. A subsequent service update said deposits were operating normally again, although withdrawals remained paused pending changes to the withdrawal system and associated addresses. Binance expected the service to resume within 48 hours.
Binance pledged to reimburse all losses using its Secure Asset Fund for Users, known as SAFU, alongside company resources. It maintained that customers' funds were safe, although the scale of the breach raised questions about the exchange's operational safeguards and ability to prevent unauthorised transfers.
The company's revised $6.3 billion estimate exceeds early blockchain assessments that placed the suspected theft at up to $5.7 billion. The figures remain subject to reconciliation because the total value transferred, assets frozen and funds ultimately recoverable are different measures.
Blockchain intelligence companies TRM Labs and Chainalysis have identified similarities with attacks previously attributed to North Korea. Their assessments point towards the country's TraderTraitor hacking operation, but the identity of those responsible has not been conclusively established by law enforcement.
TRM Labs estimated that approximately $6.36 billion moved from Binance wallets across ten blockchain networks, with much of the activity concentrated within roughly 20 minutes. The rapid transfers complicated efforts to identify destinations and prevent further movement before issuers and blockchain operators intervened.
Stablecoin issuers Tether and Circle participated in freezing assets linked to the suspicious transactions. Tether blocked approximately $1.57 billion in USDT, while Circle froze more than $800 million in USDC. Other participants contributed to the total that Binance placed at around $3 billion.
Freezing tokens can prevent their transfer or redemption, depending on the relevant blockchain and issuer controls. It does not necessarily mean the money has been recovered or returned to Binance. Assets outside those controls may remain accessible to whoever holds them.
Binance said it had revoked the affected address authorisation and enlisted law enforcement agencies, blockchain intelligence specialists and industry partners to trace transactions. It has not disclosed the suspected method used to compromise the engineer's laptop or identified the software, credentials or permissions involved.
The initial account focuses attention on the exchange's internal operational infrastructure rather than a confirmed leak of wallet credentials. Security specialists have questioned how access originating from one employee's computer could enable withdrawals on such a scale, although the full sequence of events remains unknown.
The incident has unsettled cryptocurrency markets. Bitcoin fell below $79,000 during Thursday's trading, while shares linked to the digital asset sector also declined. Price movements reflected broader market conditions as well as concerns about the breach, making any precise attribution difficult.
The suspected losses would surpass the approximately $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, an attack attributed to North Korea-linked hackers. Investigators have not established that the same individuals or technical methods were involved in the Binance incident.
Binance said an updated proof-of-reserves statement would follow completion of remediation work. Such disclosures show specified assets held by an exchange at a particular point, although their usefulness depends on the accompanying information about liabilities and the scope of verification.
The financial implications also extend to Binance's emergency reserves. Its SAFU arrangement has historically been maintained to provide protection against exceptional losses, but the estimated impact of this incident substantially exceeds the fund's previously disclosed $1 billion target. Binance has not specified how much of the reimbursement will come directly from corporate resources, whether any insurance arrangements apply or how the recovery of frozen assets will affect the eventual financial burden on the company.
The exchange has urged customers to rely on its official communications for service updates and to avoid unsolicited messages seeking account information. It has not announced a definitive timetable for publication of its technical post-mortem.
Topics
Cryptocurrency