Binance estimates security breach affected US$6.3 billion in crypto assets

Cryptocurrency exchange Binance has estimated that a major security breach had affected about US$6.3 billion in digital assets, as it temporarily suspended deposits and withdrawals and worked with law enforcement agencies and other industry participants to trace and freeze funds.

The world’s largest cryptocurrency exchange said on 30 October that its initial investigation suggested an attacker may have gained access through a compromised laptop belonging to a DevOps engineer.

The attacker allegedly used that access to enter a service container and submit unauthorised withdrawal transactions.

Binance said it had found no evidence that wallet private keys had been leaked.

It also said it would cover all losses using funds from its Secure Asset Fund for Users (SAFU) and the company’s own resources.

The latest estimate is higher than the approximately US$5.9 billion that blockchain analytics company Chainalysis initially estimated had been stolen at the time of the incident.

Binance said about US$3 billion in affected assets had been frozen on-chain by the time of its update.

Binance suspends deposits and withdrawals

Binance initially described the incident as a potential security issue when reports of unusual transactions began circulating on 29 October.

The exchange said its security teams were investigating and assured customers that their funds were safe.

It subsequently suspended withdrawals on multiple networks as a precaution.

At about 00:30 GMT on 30 October, it announced that all deposits and withdrawals had been temporarily suspended while its teams conducted security checks, froze affected assets and worked with law enforcement.

In its security incident update, published at 02:23 GMT on 30 October, Binance provided further details about its preliminary findings.

The exchange said the attacker might have gained access to a service container through a compromised laptop belonging to a DevOps engineer. This access allegedly enabled the submission of unauthorised withdrawal transactions.

Binance said it had revoked the affected address authorisation and was working with law enforcement agencies and blockchain intelligence partners to trace and recover the assets.

The company said it would publish a detailed technical post-mortem after completing its investigation and verifying the facts. It also promised to release an updated proof of reserves once remediation work had been completed.

The exchange did not provide a timetable for restoring deposits and withdrawals.

Tether and Circle freeze billions in assets

Several cryptocurrency companies have joined efforts to prevent the movement of funds associated with the incident.

Tether, the company behind the USDT stablecoin, said it had frozen nearly US$1.57 billion in assets linked to the incident. Circle, which issues the USDC stablecoin, froze more than US$800 million.

Ripple also froze approximately US$200 million in funds, according to Binance co-founder Yi He.

World Liberty Financial, a cryptocurrency company linked to US President Donald Trump and his family, said it had worked with crypto custodian BitGo to freeze funds.

Yi said the action involved about US$27 million in stablecoins and approximately US$2 million in World Liberty tokens.

These figures form part of the broader effort to restrict access to assets believed to be connected to the incident. Binance said approximately US$3 billion had been frozen on-chain by the time of its 30 October update.

USDT and USDC are stablecoins, digital tokens designed to maintain a value linked to a traditional currency. Both are pegged to the US dollar. Their issuers can freeze certain tokens by restricting transactions involving designated blockchain addresses.

Binance said the amount frozen could increase as it continued working with law enforcement agencies, token issuers, blockchain intelligence firms and other industry partners.

Chainalysis estimates US$5.9 billion stolen

The estimated scale of the incident remains subject to investigation.

Blockchain analytics company Chainalysis put the amount stolen at approximately US$5.912 billion at the time of the theft.

It said it was monitoring the movement of funds across several blockchain networks, including Bitcoin, Ethereum and Tron, as well as a number of layer-2 networks.

If Chainalysis's estimate is confirmed, the incident would be substantially larger than the February 2025 attack on cryptocurrency exchange Bybit, in which approximately US$1.5 billion was stolen.

The Bybit attack was attributed to hackers affiliated with North Korea.

Former Binance chief says users should be covered

Changpeng Zhao, Binance's co-founder and former chief executive, said the incident appeared to be a hack.

“It does look like a hack on Binance,” Zhao said in a post on X.

Although he no longer runs the exchange, Zhao remains a major shareholder.

He said he expected users to be fully covered and that the total losses could be higher than US$1 billion.

Binance co-founder Yi He also said the company would cover all losses arising from the incident.

The exchange operates SAFU, which is a reserve intended to protect customers' assets in the event of security breaches. Binance said it would use the fund and company resources to cover losses.

According to Reuters, Binance had 335 million registered users worldwide and held approximately US$162.8 billion in assets under custody, based on its 2025 annual report.

Cryptocurrency prices fall after reports of the breach

The incident triggered declines across major cryptocurrency markets.

Bitcoin fell to a six-week low of US$76,368 in early Asian trading on 30 October, down more than 3 per cent, according to Reuters.

Ether dropped more than 3 per cent to a two-month low of US$2,178.

BNB, the token associated with the Binance ecosystem and used to pay fees on the exchange, fell 5 per cent over the preceding 24 hours to US$709.70, according to CoinGecko data cited by Reuters.

Shares in US cryptocurrency exchange Coinbase Global fell 4.8 per cent, while those of Strategy, a major corporate holder of Bitcoin, declined by nearly 6 per cent in extended trading.

Market analysts said the incident could affect confidence in centralised cryptocurrency exchanges, where customers hold digital assets through a company rather than managing their own wallets.

Tim Sun, a senior researcher at Hong Kong-based HashKey Group, told Reuters that the breach could prompt investors to reconsider the risks associated with holding assets on centralised platforms, including counterparty, solvency and liquidity risks.

Binance's temporary suspension of deposits and withdrawals also means customers cannot move funds through the affected services while the security checks continue.

The exchange has urged users to rely on its official channels for updates and remain cautious of fraudulent messages, links and requests for account information.

Binance incident adds to a series of cryptocurrency thefts

The breach comes amid continuing security concerns across the cryptocurrency industry.

Researchers at TRM Labs reported that cybercriminals stole approximately US$2.9 billion in cryptocurrency through nearly 150 attacks in 2025.

Reuters also reported that cryptocurrency exchange Bitget disclosed in September that approximately US$350 million had been stolen from its platform.

Polymarket temporarily halted trading following an incident involving a third-party service provider. The company later resumed trading and said it would reimburse affected users.

Binance.US, the US-based exchange operating as a separate entity, said it was not affected by the incident. Coinbase also said its platform was unaffected and that it was monitoring developments.

Binance said its investigation was continuing and that it would release further information through its official channels once the details had been verified.