Binance halts withdrawals after suspected $2 billion-plus crypto theft

Binance suspended withdrawals across multiple blockchain networks Thursday after confirming it was investigating a major security breach that drained an estimated $2 billion from the world’s largest cryptocurrency exchange.

The company said in a statement provided to TechCrunch that its security teams were actively investigating what it described as a potential security issue affecting user wallets. Binance did not initially disclose the full scale of losses or whether funds had already been transferred beyond its control.

“Rest assured that user funds are completely safe,” the exchange stated, though it acknowledged the incident and committed to publishing verified details through official channels.

The announcement came shortly after Changpeng Zhao, Binance’s founder and largest shareholder who stepped down as chief executive, posted on X that he believed the exchange had been hacked. Zhao offered no specifics about the attack but said he expected customer assets to be “fully covered,” without explaining the basis for that claim.

The Scope of Losses

Cryptocurrency analysts tracking the incident reported that at least $2 billion had been drained from Binance’s hot wallets — the internet-connected storage systems that hold cryptocurrency available for trading and customer withdrawals. Some estimates suggested losses could reach $5.7 billion, though these figures remained unconfirmed and the theft was potentially still ongoing.

The scale of the theft placed it among the largest cryptocurrency heists on record. The crypto industry tracks major breaches by size, and a loss in the billions would rank the Binance incident near the top of historical occurrences.

Circle and Tether’s Response

The breach rippled through the broader crypto ecosystem as established players moved to contain exposure. Circle, a major financial technology company in the cryptocurrency space, froze approximately $800 million in Tether stablecoins that were passing through its infrastructure. Tether itself, one of the largest cryptocurrency firms by market capitalization, froze about $1.56 billion connected to the Binance incident, preventing those assets from moving further through the network.

These protective freezes represented the industry’s standard response to major breaches: locking down suspicious transactions before they could be moved across borders or converted to untraceable assets.

Historical Context

If confirmed, the Binance losses would rival or exceed the largest cryptocurrency theft on record. In 2025, hackers stole $1.4 billion from Bybit, another major crypto exchange, in what security researchers attributed to North Korean attackers. That breach had held the record for largest single crypto heist until reports of the Binance incident surfaced.

The Binance hack, if losses reach the higher estimates, would represent a significant escalation in the scale and impact of cryptocurrency exchange attacks, suggesting that even the world’s largest platform remains vulnerable to determined adversaries.

Binance’s Public Response

Read also: Alleged Chinese Spy Targeted Nvidia CEO in U.S. Investigation · Bluesky Blocks DHS Employee Data as Government Pursues Takedowns · Hackers leak 40,000 Department of Homeland Security employee records

The exchange emphasized user protection while providing minimal technical details about how the breach occurred or how deeply the attackers penetrated its systems. Spokesperson Ross O’Leary said that withdrawal suspensions across multiple blockchain networks were “following a security incident as a precautionary measure.”

The company did not disclose who it believed was responsible for the breach, whether it had received any ransom demands from the attackers, or a timeline for restoring withdrawals. Industry observers noted that the lack of detail was typical of ongoing investigations, though it left users without concrete information about when normal operations might resume.

User Communication Strategy

Binance warned users to remain vigilant against secondary threats that often accompany major breaches. The exchange specifically cautioned against unofficial links, messages claiming to be from Binance, and requests for account credentials, noting that scammers frequently exploit security incidents to trick users into surrendering access to their accounts.

This pattern of combining the original breach with opportunistic scams represents a common challenge in cryptocurrency incidents. The damage extends beyond the theft itself to include fraudulent follow-up attacks against frightened users.

Ecosystem-Wide Impact

The Binance incident was not an isolated event. Hours after the exchange announced its security measures, prediction market platform Polymarket briefly halted trading after confirming that a third-party vendor had been compromised in a separate attack.

The Polymarket Breach

The Polymarket incident traced back to compromised software developed by DebugBear, a security and performance monitoring company. Following that compromise, hackers successfully stole approximately $2 million in user funds from Polymarket customers. The platform paused withdrawals to prevent further unauthorized transfers, echoing Binance’s protective response.

The near-simultaneous nature of the Binance and Polymarket incidents raised questions about whether the attacks were coordinated or represented a broader shift toward targeting high-value cryptocurrency platforms and services. Security researchers did not immediately indicate that the incidents were connected.

Binance’s Track Record and Trust

Binance’s assertion that user funds would be fully covered carried weight given the company’s size and profitability, but the claim lacked immediate substantiation. The exchange operates as a private entity and does not file the detailed financial disclosures that would allow independent verification of whether it maintained sufficient reserves to cover multi-billion-dollar losses.

Zhao’s confidence about coverage, expressed without explanation, suggested faith in Binance’s balance sheet, but users and observers alike sought more concrete evidence about how the company would actually make customers whole. The exchange’s history of weathering regulatory pressure and operational challenges across multiple jurisdictions informed both its credibility and skepticism about its capabilities.

What Happens Next

Binance’s next critical communications would come through what it called official channels. The company committed to providing updates “as soon as we have verified information,” indicating that its investigation remained active and incomplete.

The restoration of withdrawals would serve as the market’s first clear signal that Binance had contained the breach and understood its scope. Until that happened, uncertainty would persist about the attack’s true scale and the company’s control over its systems.

Source: TechCrunch