Binance, the world's largest cryptocurrency exchange, said Thursday it is investigating a major security incident estimated to have affected approximately $6.3 billion in assets, potentially making it the largest cryptocurrency theft on record.
The company said all deposits and withdrawals have been temporarily suspended while it conducts security checks and works with law enforcement. Binance said its teams are "working around the clock" to resolve the issue.
"Rest assured that user funds are completely safe," a Binance spokesperson said in a statement. "Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information."
Binance's initial investigation suggests the breach may have originated from a compromised DevOps engineer's laptop, which allowed an attacker to access a service container and submit unauthorised withdrawal transactions. The company said it found "no evidence of any wallet private key leak."
Around $3 billion in affected assets has been frozen on-chain so far, the company said, adding that it is working with blockchain partners, law enforcement, stablecoin issuers, and blockchain intelligence firms to trace and freeze additional funds. Binance said it will cover all losses.
Stablecoin providers Tether and Circle each said they froze funds in response to the incident. Jeremy Allaire, co-founder and CEO of Circle, said his company had frozen the equivalent of more than $800 million in currency associated with the incident "in coordination with law enforcement." Tether CEO Paolo Ardoino said the company froze the equivalent of more than $1.5 billion related to "a potential Binance exchange hack."
Blockchain intelligence firm TRM said it assessed with "high confidence" that the attack was carried out by North Korea's hacking unit TraderTraitor, which investigators have linked to the Lazarus Group. Ari Redbord, TRM's global head of policy, described the attack as "unprecedented" and a "watershed."
"When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity. That makes this a global security issue, not just a crypto theft," Redbord said.
The incident dwarfs the previous record for a crypto theft, set in 2025 when the Lazarus Group carried out a $1.5 billion heist on rival exchange Bybit. Cybercriminals stole $2.87 billion in crypto assets across nearly 150 hacking incidents in 2025, according to TRM's 2026 Crypto Crime Report.
The price of bitcoin fell following news of the breach. Reports placed the drop at between 3.2 percent and approximately 5 percent, with the price falling to somewhere between $77,000 and under $79,000, depending on the source.
Sean Foley, a crypto markets expert at Macquarie University in Sydney, said the attack highlighted the risks of centralised exchanges and could push more traders toward decentralised alternatives.
"Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange's holdings, the larger a target it becomes," Foley said.
Binance was founded in 2017 by Changpeng Zhao, who pleaded guilty in 2023 to a felony related to his failure to prevent money laundering on the platform and stepped down as CEO. He was the first person ever sentenced to prison time for violations of the Bank Secrecy Act, which requires US financial institutions to know their customers, monitor transactions, and file reports of suspicious activity. President Donald Trump pardoned him in 2025.
Zhao posted on social media Thursday saying "User funds are safe!" but acknowledged the incident "does look like a hack on Binance." He added that while he no longer manages Binance, "as a shareholder, I expect all user funds will be fully covered."
Binance currently holds approximately $155 billion in assets under management, more than any other exchange, according to CoinMarketCap.
