Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen

Binance has estimated the financial impact of a security breach to be $6.3 billion, which could be the largest cryptocurrency theft ever recorded. The company has frozen approximately $3 billion in affected assets. Preliminary investigations suggest that a compromised laptop belonging to a DevOps engineer may have been responsible for the intrusion.

The attacker potentially accessed a service container and submitted unauthorized withdrawal transactions. Binance has not found evidence that wallet private keys were leaked. The company is temporarily suspending deposits and withdrawals while conducting security checks, revoking affected address authorizations, and working with law enforcement agencies and blockchain intelligence specialists to trace the assets.

Binance has pledged to compensate customers for hacking losses using its Secure Asset Fund for Users (SAFU) and company resources. The $3.3 billion difference between the estimated impact and frozen assets highlights the challenges investigators face. Despite freezing tokens, it does not guarantee control over the assets or the retrieval of every affected asset.

The incident has caused a decline in digital asset markets, with Bitcoin falling to a six-week low and Ethereum dropping over 3%. Other exchanges, such as Coinbase Global and Strategy, also experienced declines. This security breach surpasses the previous record of $1.5 billion stolen from Bybit in February 2025. However, Binance's estimate represents a preliminary assessment, not a final measurement of permanent losses.

Investigators are examining transactions across multiple digital asset networks, but attribution remains unresolved. Binance urges customers to rely on official communications and avoid unsolicited messages or links. Co-founder Changpeng Zhao and Yi He have assured customers that hacking losses will be covered. The exchange will continue to work with law enforcement and industry partners to establish the attacker's identity and trace transactions, while providing updates through official channels.