Binance, the world’s largest crypto exchange, said on Thursday that a security incident has hit about $6.3 billion in assets and that it has suspended all deposits and withdrawals while it investigates.
The Brief
- Binance says other platforms helped it freeze about half of the affected assets, and the frozen total may still rise.
- Tether and Circle froze about $2.4 billion in assets combined after the suspected hack, the two stablecoin issuers said.
- TRM Labs, an investigations firm, links the attack to TraderTraitor, a hacking unit it ties to North Korea.
- Bitcoin dropped more than 4% after the alerts, and Ethereum and Solana also fell sharply.
Early checks suggest an attacker compromised an engineer’s laptop and used it to make unauthorized withdrawals, Binance said in online updates. “Binance will cover all losses,” the company said on X. Its team is running security checks, freezing funds and working with law enforcement.
Co-founder Changpeng Zhao, known as CZ, wrote on X that the incident looks like a hack. He no longer runs Binance but remains its largest shareholder, and he said he expects user funds to be fully covered.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete. As an immediate precaution, Binance has: – temporarily suspended deposits and withdrawals while security checks are completed; – revoked the affected address authorisation; – engaged law enforcement and blockchain intelligence partners to trace and recover funds. Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. https://t.co/ywB2mKFy0p
— Binance (@binance) October 30, 2026
The breach involves Binance.com only. The separate Binance.US platform, which serves American residents, said it is unaffected. Coinbase said the same and added that it is monitoring the situation. Crypto prices slid as the alerts spread, with a broader stock selloff adding pressure.
Tether and Circle step in with freezes
Tether CEO Paolo Ardoino said his firm froze around $1.6 billion tied to the incident. Circle chief executive Jeremy Allaire said the USDC issuer froze more than $800 million. World Liberty Financial, the crypto company linked to President Donald Trump and his family, said it worked with partners to freeze stolen funds.
Binance estimates about half the affected assets are frozen, so those two issuers likely account for most of the locked funds. Both freezes hit USDT and USDC, dollar tokens whose issuers can blacklist an address. Bitcoin and ether have no issuer holding that switch, so any stolen native coins depend on exchanges and tracers spotting them later.
That gap matters. Ari Redbord, TRM’s chief policy officer, said the attacker still holds an enormous sum, which leaves tracing and recovery far from finished.
TRM ties the attack to North Korea
TRM attributed the attack to TraderTraitor and said several elements resemble earlier North Korea-linked incidents, including the 2025 Bybit theft. “We make this judgment with high confidence,” the firm wrote in its report. That Bybit hack, at $1.5 billion, set the previous record among the most expensive crypto exchange hacks.
Binance didn’t directly address the North Korea link. The exchange said it is working with law enforcement partners to identify the attackers and bring them to justice.
Why It Matters?
Two points remain unexplained: how one engineer’s laptop reached systems able to move withdrawals, and how high the final loss figure could climb. For account holders, Binance’s guidance is to trust only its official channels for updates while withdrawals stay suspended.
Binance has promised a full report once its investigation closes. Co-CEO Yi He said withdrawals stay disabled until the exchange confirms its environment is secure. None of Binance’s estimated 300 million-plus registered users can move funds off the exchange until that confirmation comes.
