Binance Probes Suspected Hack as Crypto Firms Freeze $3bn

Binance is investigating a suspected hack that may be the largest cryptocurrency exchange breach on record, after its founder said the incident does look like a hack on Binance. By Thursday evening, crypto firms had frozen about $3bn in funds, while Binance suspended transactions during security checks and pledged to cover all losses. The exchange had not yet confirmed whether funds were pilfered, leaving the full extent of damage unclear.

What Happened: A Suspected Hack at Binance

The incident, which unfolded on October 29, 2026, involved an estimated $6.3bn in digital assets across roughly ten blockchains, according to analytics firms TRM Labs and Chainalysis. This far exceeds the $1.5bn Bybit hack in 2025 and marks one of the largest security scares involving the world's biggest cryptocurrency exchange. This follows a series of high-profile crypto exchange security breaches over the past two years.

Binance initially described the event as a 'security issue' and temporarily suspended deposits and withdrawals while it conducts security checks, freezes funds, and works with law enforcement. Co-founder Changpeng Zhao wrote on X that it does look like a hack on Binance and praised Tether and Circle for quickly freezing funds, adding that he expects all user funds to be fully covered. Zhao stepped down as CEO in 2023 and was pardoned by President Trump in November 2025.

Response: Firms Freeze Billions in Assets

Stablecoin issuers and other crypto firms moved rapidly to freeze assets. Tether CEO Paolo Ardoino said his firm froze more than $1.5bn in USDT; Circle CEO Jeremy Allaire said it froze over $800m in USDC. World Liberty Financial froze $27m of its USD1 stablecoin, Ripple said it was actively freezing affected funds, and an Arbitrum Security Council freeze covered $30m. In total, about $3bn was frozen on-chain, roughly half the reported $6.3bn impacted.

The coordinated response highlights how stablecoin issuers freeze suspicious transfers can limit damage during major breaches. Ardoino called the freezes the fastest response in stablecoin history, while Allaire emphasized that Circle works with exchanges and law enforcement to halt illicit flows.

How the Attack Reportedly Happened

Investigators suspect a compromised DevOps engineer's laptop allowed an attacker to access a service container and submit unauthorized withdrawals. Binance's investigation uncovered additional breach points but found no evidence of a private key leak. Analytics firms Chainalysis, TRM Labs and Check Point attributed the attack with high confidence to North Korean unit TraderTraitor, also known as Lazarus Group crypto heists, which Western agencies say funds Pyongyang's weapons programmes. Blockchain investigator ZachXBT linked addresses to the $388m Bitget hack. Binance has not confirmed attribution and is working with law enforcement.

The suspected North Korean involvement echoes the Bybit hack 2025, when the same group stole $1.5bn in one of the previous largest crypto thefts.

Binance's Response and User Fund Safety

Co-CEO Richard Teng said user funds remain safe, with losses absorbed by the Binance SAFU insurance fund and corporate reserves. User assets are secure. We will cover all losses., Teng said. Withdrawals were temporarily suspended for a security overhaul while deposits remained operational. The exchange said it has disabled withdrawals and is working with law enforcement.

Impact on Crypto Markets

Bitcoin fell over 4% following the alerts, according to market data. Binance.US and Coinbase said they were unaffected. The incident underscores ongoing vulnerabilities in crypto exchange security best practices and may accelerate regulatory scrutiny of centralized platforms.

Frequently Asked Questions

Is Binance safe after the hack?

Binance says user funds are safe and will be covered by its SAFU fund and corporate reserves. Withdrawals were temporarily suspended during security checks, but the exchange has pledged to cover all losses.

How much was stolen from Binance?

Estimates vary, but analytics firms put the total impacted at about $6.3bn, of which roughly $3bn was frozen on-chain. Binance has not confirmed the exact amount pilfered.

Who is behind the Binance hack?

Chainalysis, TRM Labs and Check Point attribute the attack to North Korea's TraderTraitor/Lazarus Group, but Binance has not named an attacker and is investigating.

Will Binance users get their money back?

Yes, according to Binance. Co-founder CZ said he expects all user funds to be fully covered, and the exchange's SAFU insurance fund plus corporate funds will absorb losses.

Conclusion

As Binance probes the suspected hack and crypto firms freeze $3bn, the incident may become the largest crypto exchange theft on record. The exchange's commitment to cover losses and the rapid industry response have limited immediate fallout, but questions remain about the full scope and the attackers' identity. Investors will watch for official confirmation and further freezes in the coming days.