Binance hit by $6.3B breach, nearly $3B frozen on-chain

Binance said a security incident affected roughly $6.3 billion in assets, with nearly $3 billion frozen on-chain as the response unfolded. The exchange suspended deposits and withdrawals, revoked the affected address authorization, and said it will cover all losses from its Secure Asset Fund for Users (SAFU) and its own funds. The exchange has not posted a formal post-mortem; this account is built from Binance's statements to press, stablecoin issuers' freeze confirmations, and on-chain tracing.

What Binance says happened

Binance's initial investigation points to a compromised DevOps engineer's laptop, used to reach a service container and submit unauthorized withdrawal transactions. Binance said there is no evidence of a wallet private-key leak — the entry was operational access, not cryptographic compromise. No CVE or product vulnerability is involved. Founder Changpeng Zhao (CZ) wrote on X that the event appeared to be a hack, that he no longer runs the exchange, and that he expects all user funds to be covered.

Scale and what's frozen

The dollar figures diverge by who is counting:

• Binance: ~$6.3 billion in affected assets.
• Chainalysis: ~$5.912 billion stolen at the time of theft — which it put at nearly four times the next-largest crypto heist.
• Arkham Intelligence is tracking 55 addresses under the entity binance-hacker-1029, holding ~$5.78 billion combined (≈$1.77B USDT, $1.44B BTC, $876M ETH, $823M USDC). Etherscan tagged the initial receiving address "Binance Hot Wallet Exploiter 2."

Freezes reported so far: Tether froze more than 1.567 billion USDT, Circle froze over 800 million USDC, and the Arbitrum Security Council froze about $30.5 million.

Action checklist

1. Watch for phishing. Binance warned customers to avoid unofficial links, messages, and account-information requests. A breach of this profile draws impersonation within hours — treat any "verify your account" contact as hostile until confirmed through the app.
2. Don't act on withdrawal-status rumors. Deposits and withdrawals were paused during security checks; confirm the current state in the official app, not via third-party posts.
3. If you run an exchange or custody platform, the stated vector is the lesson: an engineer endpoint with a path to a withdrawal-signing service. Audit who can reach signing infrastructure from a workstation, enforce hardware-backed MFA on those paths, and require out-of-band approval for large or novel withdrawal batches.

Context

Attribution is open. No actor has claimed responsibility, and the North Korea framing attached to crypto heists belongs to the prior record-holder — the ~$1.5 billion Bybit theft of February 2025 — not to this incident. The "exploiter" and "hacker" labels on-chain come from explorers and analytics firms, not investigators. Two things make this one notable beyond its size: the attack bypassed the private-key threat model entirely by abusing operational access, and the stablecoin freeze response — over $2.3 billion clawed back by Tether and Circle alone — is now a larger lever in incident response than any single exchange's cold-storage posture. Reported figures will move; the frozen total and the final attribution are the open questions.