A security incident at Binance has sent a fresh shock through the cryptocurrency market, with the exchange estimating that about $6.3 billion was affected and saying roughly $3 billion has already been frozen on-chain.
The company’s preliminary investigation points to a compromised laptop used by a DevOps engineer. Binance said the attacker may have used that access to reach a service container and submit unauthorized withdrawal transactions. The exchange also said it had found no evidence that wallet private keys were exposed.
What Binance says happened
In an official security update, Binance described the investigation as ongoing and emphasized that the $6.3 billion figure is an estimate of the total impact—not yet a final accounting of unrecovered customer losses.
That distinction matters. The Associated Press reported that Binance had not explicitly confirmed, at the early stage of the investigation, that the entire amount had been stolen. The exchange said it was working with law enforcement, token issuers, blockchain-intelligence companies and other industry partners to trace and freeze additional assets.
Binance temporarily suspended deposits and withdrawals while security checks continued. It said customer funds remain safe and promised to cover losses using its Secure Asset Fund for Users, known as SAFU, together with company funds. The company said it would publish more technical details after the evidence is verified.
Stablecoin issuers helped freeze billions
The rapid response extended beyond Binance. Tether said it froze more than $1.5 billion connected to the incident, while Circle said it froze more than $800 million in coordination with law enforcement. Those actions illustrate a defining tension in modern crypto: transactions can move across borders in minutes, but centralized issuers still have the ability to block some assets when investigators identify them quickly.
Reuters reported that blockchain-analysis firms TRM Labs and Chainalysis attributed the attack to North Korean hackers and said targeted assets moved across 10 blockchains, much of it within roughly 20 minutes. That attribution came from the analytics firms and had not been publicly confirmed by Binance or a government agency at the time of publication.
Crypto prices and stocks react
Bitcoin fell below $79,000 as news of the incident spread, according to the AP. Reuters later reported a six-week low near $76,368, while ether dropped to a two-month low around $2,178. Shares of Coinbase and Strategy also declined, underscoring how quickly a major exchange breach can spill into the broader digital-asset market.
Binance is the world’s largest cryptocurrency exchange by trading volume, so any interruption to withdrawals has consequences far beyond its own customers. Market participants will be watching whether withdrawals restart on the company’s expected timetable, how much of the affected value can ultimately be recovered and whether investigators validate the emerging attribution.
The unanswered questions
The most important number is no longer the headline estimate; it is the amount that remains unrecovered after all freezes, reversals and reimbursements are completed. Investigators also need to establish precisely how a single compromised endpoint could lead to such a large series of withdrawals, what internal controls failed and whether other systems were touched.
For customers, Binance’s promise to make users whole is reassuring, but the incident is still a major test of the exchange’s security architecture and emergency response. For the wider industry, it is another reminder that sophisticated attackers often target people and operational systems—not just cryptographic keys.
