Binance, the world's largest cryptocurrency exchange, said $6.3 billion of funds are involved in what the industry is describing as crypto's biggest-ever hack. Digital tokens fell on the news.

"The estimated total impact sits at around $6.3B," Binance said in a post on X. "We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far." That leaves roughly half of the total still unfrozen.

The exchange has temporarily suspended all withdrawals, which it expects to resume within 48 hours, co-founder Yi He said in a separate post on X. The company said it will cover all losses and that "user funds are safe." The 48-hour target gives the market a concrete checkpoint for how quickly the exchange can restore normal operations.

Attack Attributed to North Korea

Blockchain intelligence firm TRM Labs said North Korea was behind the heist, which it called "the largest crypto theft on record."

"TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence," the firm said. "We make this judgment with high confidence." United Nations and US investigators have repeatedly blamed North Korea-linked hackers for record cryptocurrency thefts, proceeds that officials say help fund the sanctioned state's weapons programs.

The hackers appear to have exploited how Binance authorizes transactions, according to TRM. They seemingly gained access to the exchange's systems and used internal software to authorize transfers across 10 different blockchains, including Bitcoin and Ethereum.

Binance said the incident may involve a compromised software engineer's laptop. "We have found no evidence of any wallet private key leak," the company said.

The record total dwarfs the biggest publicly known crypto hack until now, at exchange Bybit in February 2025, in which attackers made off with almost $1.5 billion of tokens — less than a quarter of the total now reported at Binance.

Stablecoin Issuers Move to Freeze Funds

The two biggest stablecoin issuers said they took steps to freeze the missing currency. Paolo Ardoino, the chief executive officer of Tether, said in an X post that it froze more than $1.5 billion of the stablecoin "related to a potential Binance exchange hack." Jeremy Allaire, who runs Circle Internet Group Inc., said $800 million of its coin had been frozen amid "reports of a potential exploit involving Binance." Such freezes are possible because centralized stablecoin issuers retain the ability to block their tokens at specific blockchain addresses.

Binance's emergency insurance and reserve fund, the Secure Asset Fund for Users (SAFU), was established in 2018 to serve as a backstop for customers in "extreme situations," according to the exchange. The SAFU is generally maintained at around $1 billion, but has fluctuated in the past in tandem with market movements, Binance said in 2024.

"Attackers are operating at unprecedented speed and scale," but "the tools to track and trace operate at that speed too," said Ari Redbord, global head of policy at TRM Labs. "Stablecoin issuers freeze within hours. Investigators follow funds across chains in real time."

Tokens Sell Off

Bitcoin dropped 3% at the end of the US session and a further 3% in Asia trading, falling below $77,000 to its lowest level since September, with other tokens also selling off.

"The rumored Binance hack is definitely driving down coin prices," said Fredrick Collins, chief executive and co-founder of crypto data platform Velo Data. "Binance is such a behemoth in crypto that any hit to confidence in them is a hit to confidence in the industry as a whole, especially as people have already been skittish over the increasing cyber capabilities of AI."

For crypto investors who had been basking in a two-month-long price rebound, the Binance incident is a potential setback. Notorious previous episodes of theft and fraud among fallen crypto giants such as FTX and Mt. Gox set the stage for protracted bear markets — bruises the industry has worked to put behind it in US President Donald Trump's promised new era of regulatory clarity for cryptocurrencies.

Sentiment was already fragile after a spate of crypto security incidents. In recent months, hundreds of millions of dollars were drained from Bitget, while tampering tied to Ledger devices also led to millions of dollars in losses.

Traders had already been bracing for greater volatility in the crypto market this week, with $11 billion in options set to expire Friday. That comes days ahead of the US midterm elections taking place next week, when Democrats could potentially retake one or both chambers of Congress and open the door to greater regulatory scrutiny for the industry.

A Long History of Exchange Thefts

Exchange thefts and malfeasance have been an ever-present backdrop of crypto's almost two-decade ascent, the most famous of which was the collapse of Sam Bankman-Fried's FTX in November 2022. In what remains perhaps the most notorious hacking incident, Japan-based Bitcoin exchange Mt. Gox was struck in 2011. Over time, the hackers made off with tokens worth billions of dollars based on the current market price. Mt. Gox eventually went bankrupt.

"It's a huge damage to crypto because of the consistent successful hacks in the space," said Tian Zeng, chief executive officer of crypto hedge fund Third Eye. "The fact that exploits keep happening makes it dangerous in the age of newest AI models being released every two weeks."

Polymarket Halts Trading the Same Day

The Binance incident came on the same day event-contract venue Polymarket halted trading on its international exchange for an hour after it said that a third-party software provider was compromised. More than 700 Polymarket users were drained of $2.7 million in funds, said blockchain analytics platform Bubblemaps, in a post on X. A spokesman declined to comment on the numbers.

Recent security incidents haven't been confined to crypto firms. South Korea's Daishin Securities disclosed a data leak affecting about 38,000 customers this week, and Mirae Asset Global Investments reported a hacking incident, Yonhap reported. In Japan, hackers on Tuesday threatened to release data of traders using a GMO Internet Group cloud service for foreign-exchange trading.

— Bloomberg