Binance said Friday that a security incident had an estimated impact of $6.3 billion, with around $3 billion in cryptocurrency assets frozen so far, and pledged to cover all losses.
The company's co-chief executive officer Richard Teng said the exchange would cover all losses from the $6.3 billion hack using its SAFU fund and company funds, with about $3 billion in stolen assets frozen on-chain so far.
The world's largest crypto exchange said an initial investigation suggests "the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."
Later in the day, Teng said the attack involved a complex process rather than the misuse of a single engineer's permissions, underscoring that the investigation had not attributed responsibility to any individual.
He added that there was no evidence of any wallet private key leak.
Binance has temporarily suspended withdrawals while it overhauls its withdrawal security systems and has revoked the affected address authorizations, Teng said.
The exchange is also working with law enforcement and blockchain intelligence firms to trace and recover the stolen funds, while deposits remain unaffected.
Binance co-founder Yi He said deposits remained unaffected and continued to operate normally, while the exchange was working on enhancements to its withdrawal service and related address controls. It expects to begin resuming withdrawal services within the next 48 hours.
The exchange said it would cover all losses using its Secure Asset Fund for Users and company funds, adding that customer funds remained safe.
Binance also temporarily suspended deposits and withdrawals, revoked the affected address authorization and enlisted law enforcement and blockchain intelligence firms to trace and recover funds.
The company said it would publish a technical report, and an updated Proof of Reserves after remediation efforts.
"We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified," Binance said.
The announcement followed moves by several crypto firms, including Circle Internet Group, Tether and Ripple, to freeze funds tied to the hack.
Bitcoin fell more than 4% to $77,994.96 on Friday as the hack weighed on crypto markets. Shares of Circle tumbled about 5% in after-hours trading on Thursday.
"Our teams are aware of reports of a potential security issue and are actively investigating," a Binance spokesperson said. "Rest assured that user funds are completely safe." Binance also said on X that Binance Alpha trading had been temporarily suspended, and that "the current verified total frozen is $2.54 billion."
Circle CEO Jeremy Allaire said Thursday evening in a social media post that the company had frozen more than 800 million in USD Coin associated with the incident. USDT stablecoin issuer Tether CEO Paolo Ardoino also said in on X that his firm had frozen more than 1.5 billion of its stablecoin that may have been related to a potential breach.
Jack McDonald, Ripple's senior vice president of stablecoins, said it was actively freezing affected funds held in RLUSD, its U.S. dollar-backed stablecoin.
Later, Yi He said in a statement that the XRP and RLUSD-tied firm Ripple helped halt the movement of $200 million of funds linked to the possible attack.
But those frozen funds could represent only part of those impacted. Crypto data provider Arkham Intelligence linked nearly $6 billion in digital assets — including bitcoin, ether, solana and various stablecoins — to 55 wallet addresses it has linked to the potential exploit.
Arkham identifies, tracks and flags crypto wallets by analyzing publicly available blockchain data. It also solicits tips from its community members.
Exploits are not uncommon in the crypto space. In 2025, Bybit suffered roughly $1.5 billion in losses due to a hack. More recently, Bitget lost more than $350 million worth of digital assets in a cyber theft incident. Over the past several years, bad actors have also drained billions of dollars in crypto from decentralized exchanges.
