UPDATE: Binance has confirmed the hack, saying the incident occurred through a compromised laptop of an employee, enabling the attackers to drain up to $6.3 billion in cryptocurrency funds.
“Binance’s initial investigation suggests that the security incident may have involved a compromised DevOps engineer’s laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions,” the company said in a tweet. This means the hacker could install malware on the laptop, or run malicious computer code via the device’s software.
“We found no evidence of a wallet private key leak,” Binance added. “We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact stands at approximately $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.”
The results also confirm that the incident is the largest cryptocurrency heist in history. Despite the major theft, Binance reiterates that it will cover all losses with the company’s funds, including its emergency SAFU funds.
Original story:
Cryptocurrency exchange Binance is investigating a possible hack after more than $2 billion in digital funds were mysteriously transferred to a newly established wallet.
“We are aware of reports of a potential security issue and we are actively investigating,” Binance co-CEO Yi He tweeted on Thursday. She also signaled that Binance has an emergency fund to cover users in case a major loss occurs. “Safety first: withdrawals are currently disabled until the environment is confirmed to be safe,” she later added.
Fears of a hack arose after a user mysteriously moved more than $2.7 billion from a Binance wallet to an external account, via Ethereum and stablecoins from Tether and Circle Internet Group. A Coinbase director and Kairos Research now say that $5.8 billion appears to have “left Binance over Ethereum, Bitcoin and Tron.”
“The Binance Hack is STILL GOING,” tweeted Coinbase Senior Director Conor Grogan.
Concerns about the Binance hack prompted Tether Limited to freeze over 1.5 billion worth of cryptocurrency, according to Tether’s CTO. Circle also froze over $800 million in coordination with lawyers. Binance says that currently $2.54 billion in funds have been frozen. “This figure may continue to rise as our teams work closely with law enforcement, issuers, blockchain intelligence companies and industry partners to track and freeze additional assets,” the exchange said.
Binance’s co-founder and former CEO, Changpeng Zhao, also weighed in, tweeting: “It looks like a hack on Binance… I no longer manage Binance (.com), but as a shareholder, I expect all user funds to be fully covered.” If confirmed, the incident would be the largest crypto heist in history, dwarfing last year’s $1.5 billion hack of ByBit, which was later blamed on North Korean hackers.
Recommended by our editors
For now, the apparent hack appears to only affect Binance.com, not Binance.us, which was created for the US market. “We are a separate, independent platform, and customer funds and services are safe and operating normally. Please be assured that all user funds are safe,” Binance.us tweeted. Coinbase also says it is not affected.
The reported hack happened just as a separate security incident hit prediction market Polymarket, draining select users of their funds. One estimate puts the number of affected users at 700, with $2.7 million drained.
Polymarket temporarily halted trading and confirmed: “One of our third-party providers has been compromised, and we have referred this to relevant law enforcement. Anyone affected will be held accountable.”
Cybersecurity provider Hudson Rock points out that the third-party provider is DebugBear, which offers a web performance monitoring tool. Hudson Rock CTO Alon Gal says DebugBear’s service has been manipulated to load malicious code “that looks for a registered user’s trading session and tries to sell their positions and transfer assets.”
DebugBear has since confirmed an “ongoing security incident,” adding in a tweet: “If you use our RUM product, please remove the embed code from your website.”
About Our Expert
Michael Kan
Chief Reporter
Experience
I have been a journalist for over 15 years. I got my start as a school and urban reporter in Kansas City and joined PCMag in 2017, covering satellite internet services, cybersecurity, PC hardware, and more. I am currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I have covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories about availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival suppliers such as AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I combed through FCC filings for the latest news and drove to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly collecting and selling their personal information to third-party customers, as disclosed in my joint filing. investigation with motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now tracking how the AI-driven memory shortage will affect the entire consumer electronics market. I’m always eager to learn more, so please jump into the comments with feedback and send me tips.
Read the full bio