Biggest-ever crypto hack impacts $6.3 billion as Binance works to contain fallout

Binance said Friday that a security incident had an estimated impact of $6.3 billion, with around $3 billion in cryptocurrency assets frozen so far, and pledged to cover all losses.

The world's largest crypto exchange said an initial investigation suggests "the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."

Binance co-founder Yi He said deposits remained unaffected and continued to operate normally, while the exchange was working on enhancements to its withdrawal service and related address controls. It expects to begin resuming withdrawal services within the next 48 hours.

The exchange said it would cover all losses using its Secure Asset Fund for Users and company funds, adding that customer funds remained safe.

Binance also temporarily suspended deposits and withdrawals, revoked the affected address authorization and enlisted law enforcement and blockchain intelligence firms to trace and recover funds.

The company said it would publish a technical report, and an updated Proof of Reserves after remediation efforts.

"We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified," Binance said.

The announcement followed moves by several crypto firms, including Circle Internet Group , Tether and Ripple, to freeze funds tied to the hack.

Bitcoin fell more than 4% to $77,994.96 on Friday as the hack weighed on crypto markets. Shares of Circle tumbled about 5% in after-hours trading on Thursday.

"Our teams are aware of reports of a potential security issue and are actively investigating," a Binance spokesperson said. "Rest assured that user funds are completely safe." Binance also said on X that Binance Alpha trading had been temporarily suspended, and that "the current verified total frozen is $2.54 billion."

Circle CEO Jeremy Allaire said Thursday evening in a social media post that the company had frozen more than 800 million in USD Coin associated with the incident. USDT stablecoin issuer Tether CEO Paolo Ardoino also said in on X that his firm had frozen more than 1.5 billion of its stablecoin that may have been related to a potential breach.