Binance reports $6.3 billion crypto breach, suspends deposits and withdrawals

Binance disclosed a $6.3 billion security breach on October 30, 2026, calling it possibly the largest cryptocurrency heist ever. The breach affected assets under Binance’s management.

The exchange quickly halted all deposits and withdrawals while it ran security checks and traced affected assets. Binance said the pause blocked further unauthorized transactions and kept user funds safe.

Binance said it froze or recovered roughly $3 billion in assets connected to the breach, though the fate of the remaining $3.3 billion was still unclear. The frozen assets include stablecoins and other cryptocurrencies traced back to the incident.

Stablecoin issuers moved to contain the spillover. Tether froze $1.57 billion and Circle froze $800 million in assets tied to the breach, while Ripple froze approximately $200 million. World Liberty Financial, tied to former US President Donald Trump, froze $27 million in stablecoins and $2 million in its own tokens linked to the breach.

Binance’s initial investigation suggests the breach began with a compromised DevOps engineer’s laptop, which gave the attacker access to internal systems. The intruder allegedly used the laptop to submit unauthorized withdrawal transactions. Separately, Binance said it saw no evidence that anyone had stolen private keys, pointing instead to compromised signing infrastructure. Binance is planning to release a detailed technical post-mortem once its investigations finish, giving a transparent account of what caused the breach and how Binance resolved it.

Blockchain security firm Blockaid spotted malicious wallet delegation through EIP-7702, a smart contract standard that lets accounts delegate execution to contract code. Attackers packed 50 authorizations into a single transaction to drain tokens and Ether, Blockaid said. The firm had also seen similar signs of “key misuse” during the attack.

Blockchain intelligence firm TRM pointed to North Korea’s Lazarus Group as the attacker with high confidence, citing resemblances to earlier Lazarus-linked heists. Lazarus is a North Korean hacking unit tied to several major crypto thefts. The firm pointed to overlaps with past attacks attributed to the group.

Changpeng Zhao, the Binance founder, confirmed the breach and welcomed the fast freeze of funds by Tether and Circle, though he said the total impact could top $6 billion. Binance pledged to cover all losses from the breach using its Secure Asset Fund for Users and corporate funds, assuring customers that their funds remain safe. The SAFU is a reserve kept only in Bitcoin that shields user assets when security breaches happen.

"User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m)."

Changpeng Zhao, Binance founder, Gizmodo

Bitcoin and other major cryptocurrencies fell after Binance disclosed the breach, with Bitcoin falling more than 5% to below $77,000. Analysts warn that the breach could push users from centralized exchanges toward decentralized alternatives, citing fears over counterparty and liquidity risks.

Blockchain intelligence firms and law enforcement are cooperating with Binance to track the stolen assets and recover them.

The breach follows a string of major crypto thefts in 2025, including a $1.5 billion Lazarus Group attack on Bybit and $2.87 billion in crypto thefts spread across nearly 150 incidents that year. Its 2025 annual report put customer assets under custody at $162.8 billion, making Binance the largest crypto exchange in the world by assets.