Binance Hit By Record $6.3 Bn Crypto Breach, Suspends Withdrawals

Binance reported unauthorised withdrawals involving an estimated $6.3 billion in assets. The exchange temporarily suspended withdrawals because it needed to complete security checks and contain further losses. It revoked authorisation for the affected address and contacted law enforcement and blockchain intelligence firms.

The initial investigation pointed to a compromised laptop belonging to a DevOps engineer. The attacker may have used it to access a service container and submit withdrawal transactions. Binance said it found no evidence that wallet private keys were leaked. Blockchain partners helped freeze around $3 billion on-chain.

Binance expected withdrawals to resume within 48 hours, subject to its checks. It said the Secure Asset Fund for Users and company funds would cover all losses. The exchange also planned an updated proof of reserves and a detailed technical post-mortem after remediation and verification.

The reported breach involved an estimated $6.3 billion in cryptocurrency assets. The figure made it appear to be the largest crypto heist on record. The scale matters because it affects users, exchanges, blockchain partners, and confidence in how digital assets are protected.

Binance said it worked with blockchain partners to freeze around $3 billion on-chain. Changpeng Zhao initially said Tether had frozen about $971 million and Circle about $823 million. Later reporting put Tether’s freeze above $1.5 billion. Watcher.Guru estimated Bitcoin outflows alone at around $1.45 billion.

The article does not state that the frozen assets were recovered or returned. It reports that experts believed the hacker deposited assets on Aave and borrowed Ether before some freezes occurred. Binance said it would cover losses through SAFU and company funds, while continuing recovery efforts.

A cryptocurrency exchange is a digital platform that lets users buy, sell, trade, and often store cryptocurrencies. Users typically rely on the exchange to process withdrawals to external blockchain addresses. This makes the exchange’s software, accounts, and approval systems central to access.

A security problem can therefore stop withdrawals even if the underlying blockchain continues operating. The exchange may pause transfers to check whether requests are legitimate, revoke compromised permissions, and prevent more assets leaving. In Binance’s case, an attacker allegedly submitted unauthorised withdrawal transactions after accessing a service container.

Binance suspended withdrawals while it completed security checks. It also revoked the affected address authorisation and worked with blockchain partners to freeze about $3 billion on-chain. The exchange said withdrawals were expected to return within 48 hours, but the article does not confirm the exact restoration time.

Private keys directly control blockchain wallets, but exchanges also use software services to manage withdrawals. Those services may have permissions to create or submit transactions without exposing the underlying wallet keys. Compromising that operational layer can therefore enable unauthorised transfers.

Binance said its initial investigation pointed to a DevOps engineer’s compromised laptop. The attacker may have used the laptop to access a service container and submit unauthorised withdrawal transactions. Binance also said it found no evidence that wallet private keys were leaked. The article does not provide the container’s exact permissions or technical configuration.

The incident shows why exchanges must protect employee devices, service credentials, containers, and transaction approval controls. Binance revoked the affected address authorisation, suspended withdrawals, and began security checks. It planned to publish a verified technical post-mortem after the investigation and remediation were complete.

USDT and USDC are stablecoins issued and managed by centralised organisations. Those issuers can identify specific tokens or addresses and prevent transfers involving them. This is why blockchain partners could freeze large amounts of the suspected stolen stablecoins.

Ether operates differently. It is more decentralised, so no single issuer can generally freeze Ether on-chain in the same way. The article says experts believed the hacker deposited stolen assets on Aave and borrowed Ether against them. The borrowed Ether could not be frozen through a central stablecoin issuer.

This distinction affects both recovery and risk management. Centralised control can help stop transfers, but it also means token holders depend on an issuer’s intervention. More decentralised assets may resist censorship, while making recovery harder. Binance and blockchain intelligence firms continued tracing funds, but the article does not state how much Ether was ultimately recovered.

A decentralised lending platform allows users to supply one cryptocurrency and borrow another against it. The deposited asset acts as collateral. If the borrower meets the platform’s rules, smart-contract systems can release the borrowed cryptocurrency without a traditional bank or central lender.

Experts cited in the article believed the hacker deposited stolen assets on Aave before they were frozen and borrowed Ether against them. Stablecoins such as USDT and USDC can be frozen by their issuers. Ether is more decentralised and cannot be frozen on-chain by a central authority, so borrowing it could complicate recovery.

Aave responded by suspending new deposits and borrowing across its V3 and V4 lending markets. This did not establish that Aave caused the breach. It was a precaution after experts raised concerns about how the platform may have been used. The article does not state whether Aave recovered any borrowed Ether.

For Binance users, the immediate consequence was a temporary inability to withdraw funds. Binance said it would cover all losses through its Secure Asset Fund for Users and company funds. It also engaged law enforcement and blockchain intelligence firms to trace and recover assets. The article does not report confirmed user losses after those measures.

The fallout already reached other platforms. Aave suspended new deposits and borrowing in its V3 and V4 markets. CoinDCX halted new futures trades as a precaution. The breach followed a separate $2.6 million incident at Polymarket, while India’s ED investigated alleged unauthorised crypto transfers worth more than ₹4,940 crore.

Confidence in proof of reserves may also face pressure. Binance plans to publish updated proof of reserves after remediation, but reserves reports do not by themselves explain every software or operational risk. Binance said it would release a technical post-mortem after its findings were verified.