Binance Security Incident Affects $6.3 Billion in Crypto Assets

Binance reports multibillion-dollar security incident

Binance said a security incident on its platform affected about $6.3 billion in assets, with nearly $3 billion frozen on-chain so far. The cryptocurrency exchange temporarily suspended deposits and withdrawals while it completed security checks, revoked authorization for the affected address, and engaged law-enforcement and blockchain-intelligence partners.

Blockchain intelligence firm Chainalysis estimated that approximately $5.912 billion was stolen at the time of the theft. It described the event as nearly four times larger than the next biggest crypto heist, making it the largest recorded cryptocurrency theft based on the figures available in the report.

Compromised DevOps device is under investigation

Binance said its initial investigation suggests that a compromised laptop belonging to a DevOps engineer may have enabled an attacker to access a service container and submit unauthorized withdrawal transactions. The company said it had found no evidence that wallet private keys leaked.

The incident highlights the importance of controls around developer workstations and the systems that can reach production services. A device compromise can become materially more serious when it provides a path to a privileged container or to transaction workflows capable of moving funds.

Freeze actions span several blockchain participants

Tether said it froze more than 1.567 billion USDT connected to the incident. Circle said it froze 800 million in related assets, while the Arbitrum Security Council reportedly executed a transaction to freeze about $30.5 million from the Binance exploit.

Binance said it is working with law-enforcement partners to identify the criminals and recover funds. It also said all losses would be covered through its Secure Asset Fund for Users, known as SAFU, and the company’s own funds.

Operational response remains central

The scale of the incident exceeds the approximately $1.5 billion theft from Bybit in February 2025, which was subsequently attributed to North Korea. The Binance case remains a developing event, and the stated figures reflect the available assessments and assets frozen at the time of the report.

For organisations operating high-value transaction systems, the practical implication is to tightly restrict privileged access from engineering endpoints, monitor service-container activity, and ensure withdrawal controls and incident response processes can be activated quickly.