Binance, the world's largest cryptocurrency exchange, said Friday that a security incident hit an estimated $6.3 billion in assets. About $3 billion has been frozen on-chain with help from stablecoin issuers and partners.
The exchange said its initial investigation points to a compromised laptop belonging to a DevOps engineer. The attacker used it to reach a service container and submit unauthorized withdrawal transactions. Binance said it found no evidence that wallet private keys were leaked.
Binance pledged to cover all losses from its SAFU emergency fund and company funds and will publish an updated proof of reserves after its remedial work is done.
"User funds are safe!" Binance founder Changpeng Zhao wrote on X on Thursday. He added that the incident "does look like a hack on Binance."
Zhao said that he no longer manages Binance but, as a shareholder, expects all user funds to be fully covered.
Stablecoin freezes
Tether and Circle froze stablecoins tied to the incident on Thursday, using controls that let them block specific addresses.
Circle co-founder and CEO Jeremy Allaire said the company froze more than $800 million "in coordination with law enforcement." Tether CEO Paolo Ardoino also stated that Tether froze more than $1.5 billion related to "a potential Binance exchange hack."
Ripple froze about $200 million, Binance co-founder Yi He said on X, Reuters reported.
Binance put the verified frozen total at $2.54 billion on Thursday evening and said the figure could rise as it worked with law enforcement, issuers and blockchain intelligence firms. By Friday, the total had reached about $3 billion.
Withdrawals paused
Binance has suspended deposits and withdrawals on Thursday while it ran security checks. In a later update, it said deposits were operating normally. Withdrawals remain paused while the exchange rebuilds its withdrawal service and related addresses, and Binance said it expects to restart them within 48 hours.
Binance.US, a separate exchange, said it was not affected. Binance says it has more than 335 million registered users worldwide.
Bitcoin fell 3.2% on Thursday evening to below $79,000.
Attribution and what is not known
Blockchain analytics firm TRM Labs attributed the attack "with high confidence" to TraderTraitor, a North Korean state-sponsored hacking group, according to CyberInsider. TRM Labs stated that the same group carried out the $1.5 billion hack of the exchange Bybit in February 2025. Binance has not confirmed the attribution.
Binance also has not commented on how the engineer's laptop was compromised or which controls failed, and it has not provided a final loss figure. It said it plans a detailed post-mortem.
Zhao founded Binance in 2017. He pleaded guilty in 2023 to a felony tied to the exchange's failure to prevent money laundering and stepped down as CEO. President Donald Trump pardoned him in 2025.
