Binance reports a massive cyber attack and freezes over $2.5 billion

The world’s largest cryptocurrency exchange by daily trading volume, Binance, disclosed on Thursday that it suffered a massive cyberattack resulting in billions of dollars in losses. The company stated that more than $2.5 billion in funds had been frozen to prevent further siphoning of assets, though initial estimates of the total theft vary significantly among analysts. Binance temporarily suspended all deposits and withdrawals around 00:30 GMT on Friday while its teams conducted security checks, traced funds, and coordinated with law enforcement agencies. Blockchain data indicates the intrusion began at 21:24 Swiss time on Thursday. A single transaction moved approximately 167,464 Ether, valued at roughly $1.6 billion in USDT and dozens of other tokens, from a wallet identified as “Binance 14” to a newly created address. Subsequent transfers targeted other wallets across multiple blockchains. Analysts estimate the total loot includes around 18,000 Bitcoin, worth approximately $1.45 billion, along with Ether, XRP, Solana, and Tron. The originating address for the transfer appears to have been funded through Tornado Cash, a service designed to obscure the origin of cryptocurrency. Binance issued a series of conflicting statements on the social media platform X during the early stages of the crisis. Initial posts asserted that customer funds deposited on the site were “totally safe,” while later communications declared that the company would “cover all losses.” The exchange ultimately quantified the damage at approximately $6.3 billion, noting that around $3 billion had been frozen on the blockchain in collaboration with partners. However, the blockchain analytics firm Chainalysis provided a lower estimate, placing the current amount stolen at approximately $5.9 billion. Binance cautioned that these figures could rise as its teams work with authorities, issuers, and industry partners to identify and freeze additional targeted assets. Changpeng Zhao, the former head of Binance who no longer holds operational roles but remains the majority shareholder, commented on the incident via X. He described the event as looking like a cyberattack on the platform and estimated that related losses could be “a bit higher” than $1 billion. Zhao emphasized that user funds remained secure and expressed the expectation that all client money would be fully covered. The company plans to utilize its Safety Asset Fund (SAFU) emergency reserve and internal resources to offset the damages. Following the completion of its investigation, Binance intends to publish an updated proof of reserves. Major stablecoin issuers reacted swiftly to contain the spread of stolen assets. Paolo Ardoino, CEO of Tether, announced that his company froze approximately $1.6 billion in USDT assets linked to the potential attack. Jeremy Allaire, director general of Circle, stated that his firm immobilized roughly $800 million in USDC, an action taken in consultation with authorities. Ripple also assisted in blocking funds valued at approximately $200 million. USDT and USDC are stablecoins, meaning their value is pegged to the US dollar. Together, these entities froze nearly $2 billion in assets. Despite these efforts, the remaining stolen funds are being converted into Ether through decentralized exchanges such as Uniswap. Because Ether lacks a central issuer capable of freezing specific addresses, it is harder to track. Consequently, lending platforms like Aave and Kamino have restricted or paused markets to limit exposure. Market reaction was immediate and severe. Prices for major cryptocurrencies dropped sharply, excluding stablecoins which maintain fixed values. Around 00:25 GMT on Friday, Bitcoin had shed nearly 5 percent, falling below $77,000 at one point, while Ether declined by nearly 6 percent. The Binance coin, BNB, tumbled by approximately 10 percent. Within an hour of the news breaking, bets on rising prices totaling over $627 million were forcibly liquidated due to panic selling. The timing of the breach coincides with growing concerns among observers regarding the potential threat artificial intelligence models pose to cryptographic protocols and computer security. Some analysts drew parallels between this incident and previous attacks attributed to North Korean hackers. Notably, Binance had reported on Tuesday that it had successfully repelled several cyberattacks with links to North Korea. The current heist dwarfs the previous record for crypto theft, which stood at $1.5 billion after the Bybit platform was breached in February 2025. That earlier incident was also attributed to actors affiliated with North Korea. Neither Binance nor other official sources have publicly identified the origin of the current offensive. The US Department of Justice and the FBI did not immediately respond to requests for comment regarding the investigation. Binance stated it is collaborating with criminal investigators to identify the perpetrators. The company urged users to remain vigilant against scams and advised them not to trust unofficial links or messages requesting account information. As of the latest reports, the exact attribution of the attack remains open, with ongoing efforts focused on tracing the flow of stolen digital assets across the blockchain network.