Cryptocurrency exchange Binance is investigating a complex cyberattack that reportedly affected approximately $6.3 billion in funds, with about $3 billion in assets frozen as the company works with law enforcement and blockchain intelligence firms to trace the affected funds.
The company, which operates the world’s largest cryptocurrency exchange by daily trading volume, said investigators had uncovered additional points of breach, contradicting its initial assessment that the incident involved a single compromised laptop.
In a statement posted on X on Friday, Binance described the incident as a complex attack and said it was coordinating with law enforcement agencies to address the breach and prevent further losses.
The reported financial impact, if confirmed, would substantially exceed the $1.5 billion cryptocurrency theft attributed to the February 2025 Bybit hack, which was widely reported as one of the largest crypto-related cyberattacks on record.
Binance Reports $6.3 Billion in Potentially Affected Funds
Binance confirmed through its Latin American X account that the estimated impact of the incident was approximately $6.3 billion.
The company cautioned that the figure could increase as investigators continue working with law enforcement, cryptocurrency issuers, blockchain intelligence companies and other industry partners.
Their efforts are focused on tracing the movement of affected digital assets and freezing funds that may be connected to the attack.
Binance said approximately $3 billion in affected assets had been frozen, representing a significant portion of the reported total.
However, the company has not established the final financial impact, and the investigation remains ongoing.
Binance also issued assurances about the security of customer funds while pledging to cover losses. The precise scope of the affected assets and any potential customer losses will depend on the outcome of the investigation.
Investigation Uncovers Additional Security Breaches
Binance initially said its investigation pointed to a compromised laptop belonging to a DevOps engineer.
According to the company’s preliminary findings, the unauthorised party allegedly gained access to a service container and used that access to execute unauthorised withdrawal transactions.
A service container is an isolated software environment used to run applications and related services. If improperly accessed or compromised, it can potentially provide attackers with opportunities to exploit connected systems, depending on the permissions and security controls in place.
Binance subsequently said further investigation had uncovered additional points of breach, suggesting the incident could be more complicated than initially believed.
The exchange also stated that it had found no evidence of private key leaks from its wallets.
Private keys are cryptographic credentials that authorise access to cryptocurrency assets. Their compromise can allow an attacker to control or transfer funds associated with the affected wallets.
Binance said it would release a more detailed technical analysis after completing its investigation.
Binance Temporarily Suspends Withdrawals
The company temporarily suspended deposits and withdrawals while responding to the incident, although it said deposits remained unaffected.
At approximately 0900 GMT on Friday, Binance said it was on track to resume withdrawals within 45 hours.
The temporary suspension was part of the exchange’s response as it investigated the reported security breach and worked to protect affected assets.
The company has not yet provided a final account of the incident’s technical causes or the full extent of any losses.
The investigation will be important in determining how the attackers gained access, which systems were affected and whether additional security measures are necessary.
Tether and Circle Freeze Billions in Crypto Assets
Cryptocurrency issuers also took action in response to the reported incident.
Paolo Ardoino, chief executive of Tether, said the company had frozen approximately $1.6 billion connected to a potential Binance exchange hack.
Tether issues USDT, one of the world’s largest stablecoins.
Meanwhile, Jeremy Allaire, chief executive of Circle, said his company had frozen more than $800 million in USDC, another major stablecoin.
USDT and USDC are designed to maintain a relatively stable value by tracking the US dollar. Unlike Bitcoin and Ethereum, their prices generally fluctuate within narrow ranges under normal market conditions.
The freezes demonstrate how cryptocurrency issuers can sometimes intervene when digital assets linked to suspected criminal activity are identified.
However, freezing assets does not necessarily mean the funds have been recovered or returned to their rightful owners. The final outcome depends on the investigation, the nature of the assets and any applicable legal procedures.
The US Department of Justice and the Federal Bureau of Investigation had not immediately responded to requests for comment at the time of the original report.
North Korea-Linked Hackers Suspected
Blockchain intelligence firm TRM Labs said it had high confidence that the attack was connected to TraderTraitor, a hacking operation associated with North Korea.
The firm cited what it described as a combination of on-chain and off-chain intelligence, alongside similarities between the incident and previous attacks linked to North Korean hackers.
TraderTraitor has been associated with the broader North Korea-linked cybercrime ecosystem, including operations connected to the Lazarus Group.
The Lazarus Group gained international attention following the 2014 cyberattack on Sony Pictures Entertainment, which US authorities attributed to North Korean actors.
North Korea-linked hacking groups have also been accused of targeting cryptocurrency platforms and blockchain-related businesses to obtain digital assets.
Nevertheless, attribution in cybercrime investigations can be complex. The suspected involvement of TraderTraitor should not be treated as a final determination of responsibility unless confirmed by the relevant investigators or supported by further evidence.
Bitcoin, Ethereum and BNB Prices Fall
News of the reported cyberattack triggered a sell-off across several major cryptocurrencies.
Bitcoin fell by nearly 5%, while Ethereum declined by almost 6%. BNB, the native cryptocurrency associated with the Binance ecosystem, dropped by approximately 10%, according to the original report.
Stablecoins such as USDT and USDC were largely excluded from the broader decline because they are designed to track the value of traditional currencies, particularly the US dollar.
Cybersecurity incidents involving major cryptocurrency exchanges can affect market confidence, especially when investors fear that funds could be lost, withdrawals might be restricted or trading platforms could face prolonged operational disruptions.
However, cryptocurrency prices are influenced by several factors, and a decline during a security incident does not establish that the incident alone caused every market movement.
Investors will be watching for further information about the scale of the breach, the status of frozen assets and the exchange’s plans to restore normal withdrawal operations.
AI and Cryptocurrency Security Concerns Grow
The reported Binance incident comes amid wider debate about the security risks facing cryptocurrency platforms as artificial intelligence capabilities advance.
AI tools can potentially help security teams identify vulnerabilities, analyse suspicious transactions and respond to threats more quickly. The same capabilities may also assist malicious actors in automating reconnaissance, developing convincing social engineering attacks and identifying weaknesses in information technology systems.
Nevertheless, there is no established evidence in the reported information that artificial intelligence was responsible for the Binance incident.
The case highlights the importance of strong access controls, secure software development practices, continuous monitoring and rapid incident response across the cryptocurrency industry.
As digital asset platforms expand, protecting user funds requires security measures that extend beyond wallet infrastructure to include employee devices, software environments, privileged accounts and third-party services.
What Happens Next?
Binance’s investigation will focus on identifying the full scope of the reported breach, tracing affected digital assets and determining whether additional funds can be frozen.
The exchange has said it is cooperating with law enforcement, blockchain intelligence firms, cryptocurrency issuers and industry partners.
The reported $6.3 billion impact remains an estimate, and the amount of funds ultimately lost or recovered has not been conclusively established in the information provided.
The next major developments will include the resumption of withdrawals, the publication of a detailed technical investigation and further clarification about the affected assets.
For cryptocurrency users, the incident is another reminder to follow official security announcements, enable strong account protections and remain cautious about unverified claims circulating online.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are volatile, and reports of security incidents can change as investigations progress.