Binance hack biggest crypto theft in history, hackers steal $6 billion

Hackers have made off with an estimated $6.3 billion in a suspected cyber heist targeting Binance, the world's largest cryptocurrency exchange, according to The Wall Street Journal (WSJ). The incident could rank as the biggest-ever cryptocurrency theft, raising fresh questions about the safety of funds held on digital asset exchanges.Binance, however, has described the figure as the estimated financial impact of the security incident and has not explicitly confirmed that $6.3 billion was stolen. In an official update published on October 30, the exchange said the estimated total impact was around $6.3 billion, while approximately $3 billion of the affected assets had been frozen on-chain. (Photo: X/Binance) Blockchain analytics firm Chainalysis separately confirmed that at least $5.912 billion had been stolen as of 8:30 pm ET on Thursday. The remaining affected assets are yet to be fully accounted for.Binance has assured customers that their money is safe and said it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds. However, it has temporarily suspended deposits and withdrawals while it investigates the incident, secures its wallet infrastructure and works with law enforcement and blockchain intelligence partners. The incident has already unsettled cryptocurrency markets. Bitcoin fell more than 3% to a six-week low of $76,368, while ether declined more than 3% to a two-month low of $2,178 in early Asian trading on Friday. BNB, the token originally launched by Binance, was down 5% over the previous 24 hours at $709.70, according to CoinGecko.Shares of cryptocurrency exchange Coinbase fell 4.8%, while those of bitcoin-buying company Strategy dropped nearly 6% in extended US trading.BINANCE PUTS FINANCIAL IMPACT AT $6.3 BILLION, $3 BILLION FROZEN The scale of the suspected heist has become clearer as Binance, blockchain investigators and cryptocurrency companies track the movement of the affected assets.In its security incident update published on October 30, Binance said: "The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far."The exchange has not provided a detailed breakdown of the remaining affected assets or an update on their status.Chainalysis, meanwhile, confirmed that at least $5.912 billion had been stolen as of 8:30 pm ET on Thursday. The funds had moved across several blockchain networks, including Bitcoin, Ethereum, Tron, Ripple and multiple Layer 2 networks.Eric Jardine, head of research at Chainalysis, told Reuters that the investigation was still under way and the firm could not yet confirm the cause of the hack."The investigation is ongoing, and we cannot yet confirm the cause of the hack. As of 8:30 p.m. ET (0030 GMT), we have confirmed that at least $5.912 billion was stolen, with funds moving across multiple blockchains, including Bitcoin, Ethereum, Tron, Ripple and several Layer 2 networks," Jardine said.He added that around $3 billion had been frozen."Blockchain transparency and coordination across the industry are helping disrupt the movement of stolen funds. Our investigators are actively identifying additional opportunities to freeze funds and support recovery efforts," Jardine told Reuters.Several cryptocurrency companies have helped freeze assets linked to the incident.Stablecoin issuer Tether said it had frozen nearly $1.57 billion in assets linked to the breach, while Circle froze more than $800 million.Ripple also froze roughly $200 million in funds, according to Binance co-founder Yi He. Jack McDonald, senior vice-president of stablecoins at Ripple, said the company was monitoring reports of a potential exploit involving Binance and was freezing affected funds while coordinating with relevant parties.World Liberty Financial, a cryptocurrency company linked to US President Donald Trump and his family, said it had worked with cryptocurrency custodian BitGo to freeze funds stolen in what it described as a Binance hack. Yi He said around $27 million in stablecoins and about $2 million worth of World Liberty tokens had been frozen.It is important to distinguish between assets that have been frozen and money that has actually been recovered and returned to customers. Freezing cryptocurrency can prevent it from being moved or spent, but it does not automatically mean the funds have been returned to their owners.HOW DID THE BINANCE HACK HAPPEN?Binance's initial investigation suggests that the security breach may have started with a compromised laptop belonging to one of its DevOps engineers.According to the exchange, the compromised device allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.In its October 30 update, Binance said: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."The exchange also said it had found no evidence that wallet private keys had been leaked."We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified," Binance said.In simple terms, the suspected breach may have started with an employee's work laptop. The attacker allegedly used access gained through that device to enter an internal system and initiate unauthorised withdrawals.A service container is an isolated computing environment used to run a particular application or service. Such systems can have permissions that allow them to perform specific tasks. If an attacker gains unauthorised access, they may be able to misuse those permissions.However, the exact sequence of events remains unclear. Binance has described this as an initial finding and said it will publish a detailed technical post-mortem after the investigation is complete. Chainalysis has also said it cannot yet confirm the cause of the incident.The exchange has not reported evidence of a wallet private key leak. This is significant because private keys are used to authorise access to and transactions from cryptocurrency wallets. Binance's current explanation instead points towards a possible compromise of an employee's device and access to an internal system.Bernardo Brites, chief executive officer of Trace Finance, told Reuters that advances in artificial intelligence could make it harder for companies to defend their systems against cyberattacks."It's becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them," Brites said.However, there is no confirmation that artificial intelligence was used in the Binance incident.IS INVESTORS' MONEY SAFE?The immediate concern for Binance customers is whether their cryptocurrency holdings are safe and when they will be able to access their money.Binance has said that user funds are safe and that it will cover all losses arising from the incident. In its official security update, the exchange said:"Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe."The exchange has also temporarily suspended deposits and withdrawals while security checks are completed. It said it had revoked the affected address authorisation and engaged law enforcement agencies and blockchain intelligence partners to trace and recover the funds.This means customers may temporarily be unable to deposit or withdraw cryptocurrency through the exchange. The suspension does not, by itself, mean that their account balances have been lost. However, it does mean that users may not be able to move their holdings while the checks are under way.Binance operates a Secure Asset Fund for Users, commonly known as SAFU. It is a reserve intended to protect users in the event of security breaches. The exchange has said it will use this fund along with company funds to cover all hacking losses.Binance also said it would publish an updated Proof of Reserves once the remediation process is complete. Proof of Reserves is a disclosure intended to show the assets held by an exchange against its customer liabilities. The updated disclosure could provide users with further information about the exchange's holdings after the incident.Binance has 335 million registered users globally and held around $162.8 billion in assets under custody, according to its 2025 annual report.While the company's assurance that it will cover losses is important for customers, the investigation and recovery process is still under way. The exchange has not yet provided a detailed account of how the entire estimated $6.3 billion impact will be addressed.ANALYSTS WARN OF LIQUIDITY PRESSURE AND FRESH INVESTOR CONCERNSThe consequences of the Binance breach could extend beyond the immediate loss of cryptocurrency. Analysts have warned that the suspension of deposits and withdrawals could affect trading activity, liquidity and the movement of money between exchanges.Tim Sun, senior researcher at HashKey Group in Hong Kong, told Reuters that the incident could have wider implications for the cryptocurrency industry."We believe the implications of the Binance incident could well extend beyond the immediate loss of assets. The incident could rank among the largest security breaches in the history of the cryptocurrency industry," Sun said.He also flagged the potential impact on liquidity, given Binance's position as the world's largest digital-asset trading platform."Our bigger concern is the potential liquidity impact. As the largest digital-asset trading platform globally, any disruption to Binance's deposit and withdrawal operations could affect market makers' ability to move capital across venues," he said.Market makers are firms or traders that provide liquidity by placing buy and sell orders. They help ensure that buyers and sellers can trade without large price movements. If they cannot move funds between exchanges, trading can become more difficult and the difference between buying and selling prices can widen.Aravind Srinivasan, head of systematic OTC business at crypto market maker GSR, told Reuters that trading conditions on Binance had already weakened."It's the biggest hack in history... spreads are wider and liquidity is thin in Binance too on spot. The average bid/ask spread on spot bitcoin was five times wider than normal earlier this morning, and 2.5 times for ether. Spreads have since narrowed slightly," Srinivasan said.A wider bid-ask spread means the difference between the price at which buyers are willing to purchase an asset and the price at which sellers are willing to sell it has increased. This can make trading more expensive for investors.Geoffrey Kendrick, head of digital assets research at Standard Chartered, told Reuters that cryptocurrency prices could remain under pressure."I suspect the negative price action still has some way to go. Only after assets are unfrozen and more detail of the hack emerges will we find a new base," Kendrick said.Sun also warned that the incident could make investors reassess the risks of holding digital assets on centralised exchanges."It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges, as well as counterparty, solvency and liquidity risks," he said.Damon Xu, founder of 1Token in Singapore, told Reuters that traders could reduce their exposure to strategies that depend on moving funds across different exchanges."We expect cross-exchange strategies to be scaled back and leverage to decline," Xu said.He explained that even if affected users are eventually compensated, a temporary inability to access funds could create problems for traders operating across multiple platforms."Even if affected users are ultimately made whole, funds being locked during the interim could leave traders in a situation where they are profitable on one venue but unable to access capital, while facing margin shortages and forced liquidations on another," he said.Xu added that decentralised exchanges could benefit if some traders move their activity away from centralised platforms. The strong performance of Hyperliquid during this period was noteworthy, he said, as some capital and trading activity could migrate on-chain.BINANCE HACK ADDS TO LONG LIST OF CRYPTOCURRENCY THEFTSThe Binance incident is not the first major security breach to hit the cryptocurrency industry. Over the years, several exchanges and digital-asset platforms have suffered attacks resulting in losses running into hundreds of millions and, more recently, billions of dollars.One of the best-known cases was the collapse of Mt. Gox in 2014 after it lost close to $500 million worth of bitcoin. More recently, cryptocurrency exchange Bybit lost around $1.5 billion in an attack last year.Kenneth Goh, director of private wealth management at UOB Kay Hian in Singapore, told Reuters that the industry had a long history of exchange thefts."Crypto has a long record of exchange thefts. Mt. Gox collapsed in 2014 after losing close to $500 million in bitcoin, and Bybit lost about $1.5 billion only last year," Goh said.The scale of cryptocurrency thefts has also increased. Researchers at TRM Labs said attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks in 2025.In September, cryptocurrency exchange Bitget said around $350 million in cryptocurrency had been stolen from its platform, adding to concerns about the industry's vulnerability to cyberattacks.Goh said the Binance incident was particularly significant because of the exchange's size and position in the global cryptocurrency market."What stands out this time is where it happened. The world's largest exchange should have the strongest controls in the industry, and it has still been breached. Investors will now look more closely at where their assets are held and who is responsible when something goes wrong," he told Reuters.The incident has also renewed questions about how cryptocurrency exchanges protect customer assets and what happens when their systems are compromised. Even when an exchange promises to compensate affected users, customers may face temporary restrictions on accessing their funds and uncertainty over how quickly stolen assets can be recovered.The immediate focus is on tracing the affected cryptocurrency, freezing assets that can still be located and establishing exactly how the attacker gained access to Binance's systems.Binance said it had revoked the affected address authorisation and was working with law enforcement and blockchain intelligence partners to trace and recover funds. Chainalysis also said its investigators were identifying further opportunities to freeze assets.In its security update, Binance said: "Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice."The exchange has promised to publish a detailed technical post-mortem once the investigation is complete and an updated Proof of Reserves after remediation.For customers, the key questions are when deposits and withdrawals will resume, how much of the affected cryptocurrency can ultimately be recovered and whether Binance can provide a complete account of the incident.The breach could also have a lasting impact on how investors assess cryptocurrency exchanges. As Goh told Reuters, investors may now pay closer attention to where their digital assets are held and who is responsible when something goes wrong.- Ends