Binance says a security incident involving unauthorized withdrawals has caused an estimated $6.3 billion in total impact, with about $3 billion frozen on-chain so far.
The exchange says it will cover all losses and that user funds are safe, and it has suspended deposits and withdrawals while it investigates. Circle and Tether froze stablecoins tied to the incident.
Update: Binance and Bitget Stolen Funds Land at the Same Address
On-chain investigator ZachXBT has found a link between the Binance exploit and the $388 million Bitget hack from September. He said stolen funds from both incidents were commingled at the same address after arriving via THORChain.
“This indicates the same actor is likely behind both incidents. The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO,” he said.
Binance says its initial investigation points to a compromised DevOps engineer’s laptop, which allowed an attacker to access a service container and submit unauthorized withdrawals.
It found no evidence of a private key leak.
The exchange estimates total impact at around $6.3 billion, with about $3 billion frozen on-chain so far. Binance said it will cover all losses from its SAFU fund and company funds, and that user funds are safe. It also plans to publish an updated Proof of Reserves once remediation is complete.
How the Incident First Surfaced On-Chain
Early on-chain activity centered on an Ethereum address that appeared to hold more than $2.3 billion in tokens. Etherscan screenshots reviewed by BeInCrypto show it received 28,005.6 ETH from a Binance-labelled wallet, then sent 195,460 ETH, worth roughly $440 million, to another address.
Those movements initially prompted claims of a roughly $2 billion hack. Binance has since put the total estimated impact at around $6.3 billion. The on-chain figures above reflect a single address, not the exchange-wide total.
In an initial statement, a Binance spokesperson told BeInCrypto
“We are aware of reports of a potential security issue and we are actively investigating. At this stage, we have not confirmed any impact to user funds.”
The spokesperson said security teams were reviewing the activity and urged users to avoid unofficial links and requests for account information.
Binance Suspends Deposits and Withdrawals
As a precaution, Binance has temporarily suspended all deposits and withdrawals while security checks are completed. It has also revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Binance said its team is working around the clock, will share a detailed post-mortem once the investigation is complete, and will publish only confirmed figures. It urged users to rely only on official Binance channels for updates.
Tether and Circle Freeze Stablecoins
Tether and Circle froze stablecoins tied to the incident. Binance co-founder CZ thanked Tether for about $971 million and Circle for about $823 million, which together come to roughly $1.8 billion. Binance’s figure of about $3 billion frozen is higher than those two amounts alone, and the exchange has not broken down the total.
A separate on-chain blacklist registry shows Tether initiated a freeze request targeting approximately $971.1 million in USDT at the same address. Its last recorded status was pending execution, meaning those tokens were not yet frozen.
USDT also slipped roughly 0.1% below $1 on some exchange quotes, while one decentralized swap screenshot showed a much deeper discount. That isolated quote does not establish a market-wide depeg.
The crypto selloff was already underway before the wallet alerts, so a direct causal link remains unproven.
