Binance pauses withdrawals as hackers suspected of stealing billions in crypto

Binance reported a potential security issue after users said funds were leaving the exchange’s wallets. The exchange said it was investigating and insisted that user funds were safe. The incident mattered because the reported losses could reach billions of dollars, making it one of the largest crypto breaches if confirmed.

Binance spokesperson Ross O’Leary said the exchange temporarily suspended withdrawals on multiple networks. This pause was a precautionary measure. It limits movement of assets while security teams review what happened. Changpeng Zhao also said Binance was likely hacked and expected users’ funds to be fully covered, without explaining why.

The attacker’s identity remains unknown. Binance has not said whether hackers contacted it. Withdrawals were still suspended when the report was published, and the company promised updates through official channels. Users were warned not to trust unofficial links, messages, or requests for account information.

A hot wallet stores cryptocurrency in a wallet connected to the internet. This connection is useful because an exchange can move assets quickly when users deposit, trade, or withdraw funds. Hot wallets support the fast activity expected from a large cryptocurrency exchange. The trade-off is direct exposure to online systems.

In the Binance incident, crypto watchers said at least $2 billion had been drained from hot wallets. Those wallets were connected to the internet, so they could be reached through whatever security weakness enabled the suspected theft. The article does not identify the precise technical flaw or explain exactly how the funds were removed.

Keeping assets online can therefore improve speed but increase security risk. Binance temporarily suspended withdrawals while its teams investigated. The exchange also warned users about scams and unofficial requests. The incident shows why exchanges must closely monitor internet-connected wallets and restrict transfers when unusual activity appears.

The article gives no single confirmed loss figure. Crypto watchers said at least $2 billion had been drained from Binance’s hot wallets. Other estimates put Binance’s possible losses above $5.7 billion. The difference matters because the incident was still being investigated and the theft might have been continuing.

The lower figure describes funds reportedly drained from hot wallets. The higher estimate describes broader possible losses across crypto connected to the suspected hack. The article does not provide the method behind either calculation. It also says the numbers had not been confirmed, so neither figure should be treated as final.

If losses in the billions are confirmed, the breach would likely rank among the largest crypto thefts. Binance said its security teams were reviewing relevant information and would issue verified updates. Until then, the range communicates the possible scale, not a settled accounting of stolen assets.

A withdrawal suspension stops or limits users from transferring cryptocurrency away from an exchange. After a breach, this can help the company investigate suspicious activity and reduce the chance of additional unauthorized movement. It also creates immediate uncertainty because customers cannot access assets through the normal withdrawal process.

Binance spokesperson Ross O’Leary said withdrawals were temporarily suspended on multiple networks as a precaution. Binance said its security teams were reviewing relevant information. Circle and Tether also froze cryptocurrency connected to the incident. These steps show that several companies may act together to restrict movement after suspicious transfers are identified.

For users, the direct consequence is delayed access to funds. For the exchange, the suspension can provide time to assess losses and protect systems, but it may increase concern about reliability. The article does not report a wider market-price reaction. Binance said it would provide updates through official channels and warned about scams.

Some cryptocurrency companies can freeze particular tokens or addresses when they identify activity connected to a suspected theft. This ability depends on the token and the company’s control over its transfer system. A freeze can prevent the assets from being moved, traded, or redeemed normally while an investigation continues.

The article reports that Circle froze about $800 million in Tether as it passed through Circle’s networks. Tether itself froze about $1.56 billion related to Binance’s hack. These actions targeted cryptocurrency associated with the suspected incident rather than describing a freeze of every Binance asset.

Freezing funds can slow an attacker’s ability to convert or move stolen tokens. It can also help investigators follow the money and preserve assets for possible recovery. The article does not say whether all frozen funds will be returned, who ordered the freezes, or exactly how the companies identified the transactions. Those outcomes remain unresolved.

The suspected Binance theft may be larger than several major cryptocurrency breaches. Crypto watchers reported at least $2 billion drained from Binance hot wallets, while some estimates exceeded $5.7 billion. These figures are unconfirmed, so the comparison remains provisional rather than a final ranking.

The article identifies a 2025 Bybit breach in which hackers stole a record $1.4 billion in one incident. That theft was blamed on North Korean hackers. By contrast, no person or group has been identified behind the Binance incident. Binance also did not say whether it had received correspondence from the hackers.

If Binance losses reach the higher estimates, the event would likely rank among the largest crypto breaches in history. The article says leaderboards track such thefts. The ultimate comparison depends on confirmed totals. Binance’s investigation was ongoing, and the article says the theft itself might also have been continuing.

A cryptocurrency exchange acts as a central place where users hold, trade, deposit, and withdraw digital assets. It stores assets in wallets and transfers them across blockchain networks when transactions are requested. Some wallets are connected to the internet, allowing fast access. Exchanges must protect wallet credentials, transaction systems, and connected services because these systems control asset movement.

The Binance report illustrates the concentration risk. Crypto watchers said at least $2 billion was drained from hot wallets, and Binance temporarily suspended withdrawals on multiple networks. Circle and Tether also froze assets related to the suspected theft. One weakness affecting connected systems can therefore disrupt many customers and require action by other companies.

The article does not describe Binance’s full security architecture or the exact flaw. It does show the response: investigate urgently, restrict withdrawals, freeze related assets, and warn users about scams. Because exchanges hold large amounts for many customers, a single confirmed weakness can have consequences far beyond one account.