Binance targeted in $6.3 billion crypto heist, the largest ever

Binance reported a massive crypto theft with an estimated impact of $6.3 billion. The company suspended deposits and withdrawals while it secured its infrastructure, worked with law enforcement, and traced the stolen assets. It said user funds would be covered.

The attack began with a compromised laptop. According to Binance, that access allowed the attacker to reach a service container, a controlled computing environment used by the exchange, and submit unauthorized withdrawal transactions. The article does not identify the attacker or explain how the laptop was compromised.

About $3 billion connected to the hackers had been identified and frozen when Binance made its statement. Tether and Circle also froze linked assets. Binance warned that the figures could change as investigators, issuers, blockchain intelligence firms, and industry partners trace more funds and try to recover them.

The reported $6.3 billion loss is extraordinary in cryptocurrency history. It is more than four times the previous record, the $1.5 billion stolen from Bybit by North Korean hackers in February 2025. Binance called its incident the largest crypto heist believed to have been recorded.

The comparison with Binance’s normal business is less exact because the article gives no single daily or annual trading figure. It does say Binance is the world’s largest cryptocurrency trading platform by volume. Hundreds of thousands of users buy, sell, and store billions of dollars’ worth of digital currencies there.

That scale explains why the breach matters beyond one company. A theft affecting billions can shake confidence across crypto markets. Bitcoin fell about 4.3% and Ethereum about 4.6% as news spread. Binance cautioned that the affected, recovered, and frozen totals could still change.

A cryptocurrency exchange is a digital marketplace that lets users buy, sell, and store cryptocurrencies. Binance is described as the world’s largest such platform by trading volume. Its users include hundreds of thousands of people who keep billions of dollars’ worth of digital currencies there.

In general, an exchange records customer balances in its own systems and controls the digital keys or withdrawal process for assets held on the platform. When a user deposits, the exchange credits an account. When the user withdraws, the exchange authorizes a blockchain transaction to an external wallet. The article specifically says the attacker submitted unauthorized withdrawal transactions.

This arrangement makes the exchange a major security point. A successful attack on its systems can move many users’ assets at once. Binance suspended deposits and withdrawals after the breach. It said user funds were safe and promised to cover all losses, but warned that recovery and freezing efforts were continuing.

When Binance suspends deposits and withdrawals, users temporarily cannot add assets to the platform or move them out through normal withdrawal requests. They may still see account information, but the article does not specify which other services remain available. The pause is intended to help secure systems and stop further unauthorized movement.

The protection gap is important. Traditional bank deposits may have automatic insurance under applicable systems. Funds held with companies such as Binance do not automatically receive the same protection, according to the article. If an exchange is hacked, reimbursement may depend on the exchange’s decision, resources, and recovery efforts.

Binance said it would cover all losses and that user funds were safe. It also said about $3 billion linked to the hackers had been identified and frozen. Until deposits and withdrawals resume, users face reduced access, while investigators and the company work to trace assets and secure the infrastructure.

Blockchain investigators trace stolen crypto by following transactions from wallets linked to the hackers. They can map where assets move, identify connected addresses, and share findings with exchanges, issuers, and law enforcement. The article says blockchain intelligence firms were helping trace and freeze additional assets.

Freezing is possible for some digital currencies because their issuers retain control over the tokens they issue. When Tether or Circle identifies linked assets, it can block those tokens from being transferred. Tether’s CEO said the company froze more than $1.567 billion of its digital currency. Circle said it froze hundreds of millions of dollars.

This method cannot necessarily recover every stolen asset. It depends on identifying the wallets and the type of asset involved. Binance said about $3 billion had been identified and frozen, but cautioned that totals could rise as partners continue investigating. Law enforcement is also working to identify the criminals.

Responsibility for users’ losses can differ from the work of recovering stolen assets. Binance explicitly said it would cover all losses and that user funds were safe. That is the company’s stated commitment in this incident, not automatic insurance applying to every crypto exchange.

Binance is securing its infrastructure, investigating the breach, and coordinating the response. Law enforcement partners are helping confirm the criminals’ identities and bring them to justice. Blockchain intelligence firms and industry partners are tracing transactions. Stablecoin issuers have a narrower but powerful role: Tether and Circle can freeze certain tokens they issued after linking them to the hackers.

The response is collaborative and still developing. Binance said about $3 billion had been identified and frozen, while Tether reported freezing more than $1.567 billion and Circle reported hundreds of millions. These figures may change as investigators locate more assets. Recovery does not by itself identify or prosecute the attackers.

Cryptocurrency is digital value represented on a blockchain, a shared record of transactions. A blockchain records transfers between addresses rather than relying on one central bank. The article describes digital currencies moving through wallets connected to the hackers, and says investigators could trace those movements.

Digital keys are cryptographic credentials. A public address can receive assets, while a private key or comparable signing credential authorizes spending. A valid signature tells the network that a transfer was approved by whoever controls the key. Exchanges often manage these credentials or the withdrawal systems for customers, which makes their security especially important.

The article does not describe the stolen assets’ individual blockchains or keys. It does show the practical consequence of compromised access: an attacker reached a service container and submitted unauthorized withdrawals. Investigators are now tracing the resulting wallet movements, while issuers freeze some tokens and Binance strengthens its infrastructure.