The World’s Largest Exchange Hits the Brakes

Binance, the largest cryptocurrency exchange by trading volume, has suspended all deposits and withdrawals while it investigates what could turn out to be the biggest crypto theft ever recorded. The exchange first acknowledged a security incident on October 30, 2026, and has since raised its own estimate of the potential impact to $6.3 billion, with roughly $3 billion of that figure already frozen on-chain through cooperation with blockchain partners.

In a public statement, Binance told users that “user funds are safe” and promised to personally cover any losses once the investigation concludes, while declining to specify an entry point, name a suspect, or offer a timeline for reopening withdrawals.

A Moving Target: Estimates Have Swung Wildly

Few numbers in this story have stayed still for long. Early reporting linked suspicious transfers to large outflows across Ethereum, Bitcoin, and TRON, with figures cited around $1.45 billion in Bitcoin and $875 million in Ether alongside various stablecoins. Other outlets placed the range anywhere between $1.7 billion and $5.7 billion as analysts worked to separate confirmed attacker-controlled wallets from ordinary exchange activity that simply looked unusual in the moment.

That gap matters because a large transfer out of an exchange wallet is not, on its own, proof of theft — investigators still need to trace which receiving addresses are actually connected to the same attacker before a number can be called reliable. Binance’s own updated estimate of $6.3 billion is the exchange’s internal figure rather than an independently audited total, and the company has stressed that tracing efforts are still underway.

Stablecoin Issuers Move Fast to Freeze Funds

Within hours, the companies behind major stablecoins began locking down wallets tied to the suspected attack. Tether reportedly froze close to $1.57 billion, Circle froze more than $800 million, and Binance co-founder Yi He said Ripple had frozen roughly $200 million more — together accounting for close to $2.4 billion in blocked stablecoin funds. Binance separately reported $2.54 billion in verified frozen assets as tracing continued.

It’s worth being precise about what “frozen” means here: these actions stop the funds from moving further, but they do not automatically return money to Binance or its users. Recovery, if it happens, is a distinct and typically much slower legal and technical process.

A DevOps Laptop in the Crosshairs

In its most recent update, Binance said its preliminary investigation points toward a compromised laptop belonging to a DevOps engineer as the likely entry point, suggesting an attacker may have used that access to reach a service container and push through unauthorized withdrawal transactions. Importantly, Binance says it has found no evidence that wallet private keys themselves were leaked — which, if it holds up, would be a meaningfully less catastrophic root cause than a direct key compromise, though the exchange has emphasized that the investigation is still active and the picture could change.

This wouldn’t be the first time an exchange breach traced back to compromised infrastructure rather than a stolen key outright. Earlier incidents in the industry, including the widely analyzed Bybit breach, have shown attackers manipulating transaction data during what looked like a routine transfer after compromising a wallet provider’s environment — a useful point of comparison, though nothing currently ties that earlier case to this one.

What Happens Next

Binance has said it will publish a full post-mortem once its internal review wraps up. Until then, the exchange’s Secure Asset Fund for Users (SAFU), reported at roughly $1 billion in Bitcoin, would need to stretch far beyond its usual role if the final confirmed loss lands anywhere near the higher end of current estimates. No detailed compensation plan has been published yet.

For users and the broader market, the key unresolved questions are the same ones investigators are racing to answer:

• What is the final, independently verified loss figure?
• Which specific wallets and transactions belong to the attacker versus ordinary exchange operations?
• What was the precise technical root cause, and has it been fully closed off?
• When can deposits and withdrawals safely resume?

Until Binance publishes concrete answers, security researchers are advising users to treat circulating dollar figures as estimates rather than settled facts, and to rely only on the exchange’s official channels for updates rather than social media chatter.