Binance halts trading after biggest-ever crypto hack

Halting deposits and withdrawals means Binance temporarily blocks users from adding cryptocurrency to the exchange or sending it elsewhere. The goal is to stop suspicious transactions from spreading and give security teams time to investigate. It also reduces the chance of additional funds leaving while the exchange assesses damage.

Binance co-founder Yi He said the exchange suspended both activities after a hack. She also said user funds were safe and promised Binance would cover hacking losses. The exchange’s security teams were reviewing relevant information urgently, but Binance had not confirmed the attacker or final stolen amount.

The halt is therefore a containment measure, not a complete explanation of the incident. Analysts estimated that between $1.7 billion and $5.7 billion may have been taken. Binance’s next steps include confirming the loss, investigating the breach, and deciding when normal deposits and withdrawals can safely resume.

Binance is a cryptocurrency exchange, meaning it provides a platform where people trade and hold digital assets. Its size matters because a very large exchange may have more financial resources, insurance, and market resilience when a major theft triggers fear. That can help it withstand losses and withdrawals.

Kevin March, co-founder of JPEG Trading, said Binance was more insulated because of its size. He said the exchange could cover potential losses through its insurance and balance sheet. Yi He also said Binance would cover all hacking losses, while describing user funds as safe.

That protection does not remove wider risks. A huge attack could still shake crypto markets and prices, and smaller exchanges may not survive similar pressure. March said an equivalent incident at almost any other crypto business would have been catastrophic. Binance’s size therefore affects both its ability to pay and the broader market’s confidence.

Analysts and crypto traders estimated that hackers may have taken between $1.7 billion and $5.7 billion from Binance wallets. The exact amount remained unknown because Binance had not confirmed the total value of the suspected theft. If the upper estimates hold, the incident would be the biggest crypto attack in history.

The comparison is stark. In 2025, North Korea-linked hackers stole about $1.5 billion worth of cryptocurrency from the Bybit exchange. Even the lowest Binance estimate, $1.7 billion, is higher than that reported Bybit loss. The highest estimate is several times larger.

These figures remain estimates, not a final confirmed tally. Binance was still reviewing the incident and had not identified who was behind it. Meanwhile, the possible size of the theft raised concerns about market-wide effects, although Binance’s insurance, balance sheet, and scale could help it handle customer losses.

Tether and Circle issue widely used cryptocurrencies whose software can include controls over particular addresses. In practice, those controls can let the companies block transfers involving assets they manage. This is different from physical cash, which cannot usually be remotely locked by its issuer.

According to Binance co-founder Changpeng "CZ" Zhao, the platforms froze more than $1 billion in cryptocurrencies. A freeze can stop identified assets from being transferred, traded, or redeemed through participating services. It can therefore reduce the amount attackers can move after stealing it.

The measure may limit customer losses, but it does not automatically recover every stolen asset. Its reach depends on which cryptocurrencies were frozen and whether the funds had already moved elsewhere. The article reports that Binance was still reviewing the incident, so the final effect of the freezes remained uncertain.

A major hack can damage trust beyond the targeted exchange. If users fear their assets are unsafe, they may rush to withdraw them. That creates pressure on an exchange to process many requests at once and maintain enough assets and liquidity to meet them. The danger is especially serious for smaller platforms.

The article warns that massive attacks can leave smaller exchanges vulnerable to collapse because of panicked withdrawals. Binance’s size makes it more insulated, according to Kevin March. He said a comparable incident at almost any other crypto business would have been catastrophic.

Even if Binance covers customer losses, fear can spread through crypto markets. Investors may sell assets, and broad reverberations in crypto prices remain possible. The article does not give a specific price forecast. It does indicate that Binance’s financial strength may contain direct losses, while confidence effects could still reach other exchanges and tokens.

The article describes North Korea-linked hackers as major participants because the country has turned hacking and scams into an industrial-scale scourge. Their activity focuses on cryptocurrency heists, making exchanges and digital assets repeated targets. The article presents this as an organized, widespread practice rather than an isolated attack.

It also connects the groups to a broader scheme: tricking Western companies into hiring North Korean workers. That detail shows the activity extends beyond direct theft and includes deceptive access to businesses. The article does not identify a specific North Korean group behind the suspected Binance incident.

In 2025, North Korea-linked hackers stole about $1.5 billion from the Bybit exchange. Binance had not confirmed who may be behind its suspected attack. Investigators therefore still needed to establish whether North Korea-linked actors were involved, while the Bybit example showed why they remain a major concern in crypto security.

A cryptocurrency wallet is software or hardware that holds the credentials needed to control digital assets. A blockchain is a shared digital record of transactions, maintained across a network. It records transfers so participants can verify which wallet or address controls particular assets. Neither requires coins or banknotes to exist physically.

When someone sends cryptocurrency, the wallet authorizes a transaction, and the blockchain records the change in control. The recipient’s wallet can then use the asset under the network’s rules. For some tokens, the issuing company also has administrative controls. Tether and Circle reportedly used such controls to freeze more than $1 billion after the suspected attack.

That means assets can move through digital records or become unusable through issuer controls, while no physical cash changes hands. Freezing is not universal across every cryptocurrency. It depends on the token’s design and the issuer’s authority, so the article’s example applies specifically to assets those companies could control.