Binance Confirms $6.3 Billion Hack, Bitcoin Slides to $76,300

Binance confirmed on Thursday a security breach with an estimated total impact of $6.3 billion, a figure that would rank it among the largest cryptocurrency thefts on record. Bitcoin slid to $76,301 on the news before recovering to trade near $77,800.

The world's largest exchange by volume broke its silence in a post on X. The initial investigation, Binance said, points to a compromised DevOps engineer's laptop. The attacker reportedly gained access to a service container and submitted unauthorized withdrawal transactions. Binance said it found no evidence of a wallet private key leak.

"The estimated total impact sits at around 6.3B," Binance posted. "We have worked with blockchain partners to freeze affected assets, with ~3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete."

The confirmed figure sits above earlier estimates, which ranged from $2.7 billion to $5.8 billion. The exchange pledged transparency: "We will share a detailed technical post-mortem once the investigation is complete and the facts are verified," it said.

How the incident unfolded

The selloff came fast. Bitcoin had touched a 24-hour high of $81,890 earlier in the session. Then millions in leveraged long positions liquidated as the breach news spread.

Alarm bells first rang when a user noticed more than $2.7 billion in assets — including Ethereum and stablecoins issued by Tether and Circle — moving from a Binance wallet to an external account under suspicious circumstances.

Stablecoin issuers moved quickly. Tether CEO Paolo Ardoino said the company froze more than 1.567 billion USDT. Circle also froze USDC tied to the suspected attacker. Aave reportedly froze its lending markets to stop the suspected attacker from borrowing against the stolen funds — a containment tactic that limits how quickly ill-gotten collateral can be leveraged into fresh withdrawals.

What does this change for users?

Deposits and withdrawals remain suspended while Binance runs security checks, freezes funds and works with law enforcement. The exchange said it has revoked the affected address authorization and is working to confirm the identities of those responsible.

Co-founder Yi He wrote on X that user funds are safe and that Binance will cover all hacking losses. Former CEO Changpeng Zhao, who remains a shareholder, tweeted during the exploit: "User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from [Tether and Circle]. I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered."

Binance.US said the incident does not affect its platform, drawing a firewall between the global exchange's operations and its US affiliate.

What comes next

The company has not released a timeline for the full post-mortem. Until then, it is asking users to rely only on official Binance channels for updates.

Operationally, the exposure runs through the exchange's Secure Asset Fund for Users (SAFU), an insurance reserve funded historically by trading-fee allocations. A $6.3 billion hit would test that buffer and the company's own balance sheet together, which is why the promised Proof of Reserves refresh matters — it is the mechanism by which Binance can verify to the market that customer liabilities remain fully backed after remediation.

The industry now waits on two deliverables: the detailed technical post-mortem and the updated Proof of Reserves. Both will shape how counterparties, regulators and users price counterparty risk on the exchange.