Binance Reports $6.3 Billion Security Breach, Tether and Circle Freeze Assets

Binance has reported an estimated $6.3 billion impact from a major security incident involving unauthorized withdrawals, after an attacker allegedly gained access through a compromised DevOps engineer’s laptop. The exchange says it has frozen approximately $3 billion in affected assets with the help of blockchain partners and law enforcement.

The incident triggered an emergency response from Binance, including the temporary suspension of deposits and withdrawals and the revocation of authorization for the affected address. Stablecoin issuers Tether and Circle also froze assets linked to the incident, with their combined freezes exceeding $2.3 billion.

Binance says user funds remain safe and that it will cover all losses through its Secure Asset Fund for Users (SAFU) and company funds. The incident nevertheless shook market confidence, with Bitcoin falling below $78,500 as selling pressure and liquidations increased.

How the Binance security breach happened

Binance’s initial investigation suggests that an attacker may have compromised a DevOps engineer’s laptop. This allegedly allowed the attacker to access a service container and submit unauthorized withdrawal transactions.

The exchange has not yet released a complete technical post-mortem. It also stated that investigators found no evidence of a wallet private-key leak.

That distinction is important. The reported attack appears to involve access to internal systems and the withdrawal authorization process, rather than a confirmed theft of wallet private keys.

Binance has revoked authorization for the affected address and is working with law enforcement agencies, blockchain intelligence firms, and industry partners to trace the assets.

The exchange has promised to publish a detailed technical explanation after its investigation is complete and the facts have been verified.

$6.3 billion impact and billions in frozen assets

Binance estimates that the incident affected approximately $6.3 billion in assets. However, this figure should not be interpreted as a confirmed amount permanently stolen.

The exchange said approximately $3 billion in affected assets had been frozen on-chain through coordination with blockchain partners. Tether and Circle separately reported freezing more than $2.3 billion in stablecoins linked to the incident.

On-chain tracking reports also identified substantial movements involving Bitcoin, Ethereum, and stablecoins. However, estimates of the total assets moved have varied between monitoring platforms and reporting snapshots.

The difference between affected assets, unauthorized withdrawals, and successfully frozen funds matters. Frozen assets may be prevented from moving further, but their recovery and eventual return depend on the investigation and recovery process.

Tether and Circle freeze billions in stablecoins

Stablecoin issuers played an important role in the immediate response.

Tether froze approximately $1.57 billion in assets associated with the incident, while Circle froze more than $800 million. Their combined action accounts for more than $2.3 billion in reported stablecoin freezes.

These freezes demonstrate how centralized stablecoin issuers can intervene when funds linked to suspected criminal activity move through their networks.

However, freezing tokens does not automatically mean that the assets have been returned to Binance or their rightful owners. The recovery process still requires coordination between the exchange, issuers, investigators, and relevant authorities.

Other blockchain and crypto companies have also reportedly helped identify and restrict affected assets.

Binance says SAFU will cover all losses

Binance has reassured customers that their account balances and funds remain safe despite the incident.

The exchange said it would cover all losses using its SAFU fund and company resources. SAFU, short for Secure Asset Fund for Users, is Binance’s emergency protection reserve, established to help cover losses during unexpected security incidents.

The fund has previously been used following Binance’s 2019 security breach, when hackers stole approximately 7,000 BTC worth around $40 million at the time.

Binance has also temporarily suspended deposits and withdrawals while completing security checks. It said services would resume after the affected systems and addresses had been secured.

Users should rely on Binance’s official announcements for updates and avoid unofficial messages or links claiming to provide recovery assistance.

Binance breach highlights growing crypto security risks

The incident comes after several major security breaches across the crypto industry in 2026.

Related: Crypto hacks reached $1.18 billion across 107 incidents in Q3 2026. The report highlighted how compromised suppliers, developer tools and operational infrastructure can create risks beyond traditional smart contract vulnerabilities.

The Binance incident brings these concerns into sharper focus because of the scale of the reported impact. It also demonstrates the importance of securing developer devices, internal service containers, access permissions, and withdrawal authorization systems.

What happens next?

Binance’s immediate priorities are to complete its security checks, trace the affected assets, and coordinate with stablecoin issuers and law enforcement to recover as much as possible.

The exchange has promised to cover all losses and publish an updated Proof of Reserves after remediation. Its detailed technical post-mortem should provide more clarity about how the attacker accessed the service container and how the unauthorized withdrawals were approved.

For now, the $6.3 billion estimate remains the reported total impact, not a confirmed final loss. The amount ultimately recovered, the investigation’s findings, and Binance’s ability to restore normal operations will determine the longer-term consequences of the incident.