Biggest-ever crypto hack impacts $6.3 billion as Binance works to contain fallout

Binance reported a security incident with an estimated $6.3 billion impact, although investigations are still incomplete. The company said customer funds remained safe and promised to cover all losses.

Binance’s initial account points to a compromised DevOps engineer’s laptop. The attacker allegedly used it to enter a service container, then submit withdrawal transactions without authorization. Binance said it found no evidence that wallet private keys were leaked.

Binance temporarily halted deposits and withdrawals, revoked the affected address, and asked authorities and blockchain investigators to trace funds. About $3 billion was frozen, including more than $800 million in USDC and $1.5 billion in USDT. The exchange said it would publish a technical report and updated reserves after remediation. The incident shows how access to operational systems can enable large withdrawals, even without stealing private keys.

The reported scale was extraordinary: Binance estimated the incident’s impact at $6.3 billion. About $3 billion in cryptocurrency was frozen, while Arkham linked nearly $6 billion to 55 wallets. The figures differ because freezing confirms funds were stopped, while wallet links indicate suspected exposure, not necessarily final losses or recovery.

Binance said an attacker may have used a compromised DevOps engineer’s laptop to access a service container. That access allegedly enabled unauthorized withdrawals, while companies froze related tokens to limit movement. Ripple said it helped halt $200 million tied to the possible attack.

Binance later reported $2.54 billion as the verified total frozen, including more than $800 million in USDC and $1.5 billion in USDT. Binance pledged to cover losses, paused transfers, and said customer funds remained safe. Still, the gap between frozen and linked assets shows recovery could remain incomplete.

After the security incident, Binance temporarily suspended deposits and withdrawals while investigating and securing its systems. This mattered because users could not move funds normally. Binance said customer assets remained safe and it would cover losses.

The exchange revoked authorization for the affected address and paused Binance Alpha trading. It also involved law enforcement and blockchain investigators, while Circle, Tether, and Ripple froze related stablecoins. These actions aimed to stop affected assets moving further and help recover them.

The wider market reacted sharply: Bitcoin fell more than 4%, reaching $77,994.96 on Friday. Binance later reported $2.54 billion frozen, while Circle froze over $800 million and Tether over $1.5 billion. Users faced temporary access limits, while markets absorbed uncertainty about the hack’s scale.

A cryptocurrency wallet private key is a secret digital code that proves control over a wallet. Whoever possesses it can usually authorize transactions and move the wallet’s assets, much like someone holding the only signature authority. It must never be shared or exposed.

In Binance’s reported incident, investigators instead suspected a compromised DevOps engineer’s laptop, which gave an attacker access to a service container and unauthorized withdrawals. Binance said it found no evidence that any wallet private key leaked, an important distinction: stolen software access can be contained, but a stolen key may let attackers repeatedly transfer funds directly.

By Friday, Binance estimated the incident’s impact at $6.3 billion, while about $3 billion was frozen, including more than $800 million in USDC and $1.5 billion in USDT. Binance suspended deposits and withdrawals, revoked address authorization, and pledged to cover losses. The lesson is practical: users and exchanges need strong key protection, rapid monitoring, and controls that can halt suspicious transfers.

Decentralized blockchains let anyone verify transactions, but not every crypto asset is equally independent. Companies issuing stablecoins can often control the tokens they create, including freezing specific addresses. This matters because decentralization can describe the network, while asset-level rules remain controlled by an issuer.

During Binance’s reported incident, Circle froze more than $800 million in USDC tied to the event. Tether said it froze more than $1.5 billion in USDT, while Ripple helped halt $200 million in linked funds. These firms can identify suspect addresses, refuse transfers, or mark tokens unusable, while the blockchain remains open.

Binance said approximately $3 billion was frozen, while its verified total later stood at $2.54 billion. Arkham linked nearly $6 billion in assets to 55 wallets, showing freezes may cover only part of the exposure. Thus, crypto can resist one central controller while still giving issuers emergency powers over particular tokens.

Blockchain investigators trace transfers because most blockchain records are public and permanent. They connect wallet addresses by following transaction histories, amounts, timing, and links to known services. This matters because stolen assets can leave a visible trail, even when identities remain hidden.

In Binance’s case, Arkham Intelligence linked nearly $6 billion in assets to 55 wallets. It analyzed public blockchain data and community tips to identify addresses connected to the suspected exploit. Recovery becomes possible when companies can recognize and freeze assets before they move further.

Centralized issuers have that power over some stablecoins. Circle froze over $800 million, Tether froze over $1.5 billion, and Ripple helped halt $200 million in funds. Recovery remains difficult when assets move quickly, cross services, or reach wallets without a cooperative intermediary.

A crypto exchange is a company that lets people buy, sell, and store digital assets. It usually controls the systems that hold assets and approve transfers, making trading convenient but creating reliance on one organization.

Binance illustrates this difference: investigators suspected a compromised engineer’s laptop enabled unauthorized withdrawals. Binance paused deposits and withdrawals, revoked an affected address, and promised to cover losses. A decentralized exchange instead uses software that moves assets directly between users’ wallets. A personal wallet lets its owner control the private keys and approve transfers.

These arrangements create different risks, not perfect safety. Binance estimated the incident’s impact at $6.3 billion, with around $3 billion frozen so far, including assets frozen by other companies. The practical lesson is simple: exchange-held assets depend on a custodian, while wallet assets depend on the user’s keys and any trading software involved.