Binance, the world's largest crypto exchange, is facing a potential security issue that may have resulted in a significant crypto theft. On Thursday afternoon, observers noticed a large amount of crypto moving out of Binance wallets to an outside account, with over $2.7 billion in the first wave across Ethereum and stablecoins from Tether and Circle. The incident prompted Binance to pause all deposits and withdrawals and suspend trading on Binance Alpha, its platform for early-stage crypto projects.
The outflow of funds from Binance's wallets continued throughout the night, with outside analysts estimating that the total outflow had reached around $5.8 billion across Ethereum, Bitcoin, and Tron. However, Binance has not confirmed a figure for the loss. The funds appear to have come from Binance's hot wallets, which are crypto wallets that stay connected to the internet to process withdrawals and trades quickly. This makes them more vulnerable to attacks than money kept in offline "cold" storage.
The stablecoin companies, including Tether and Circle, took swift action to freeze specific wallets, preventing the coins from being spent. Tether froze over $1.5 billion, and Circle froze over $800 million, with the latter done in coordination with law enforcement. Binance's verified frozen total started at $2.54 billion and has since climbed to around $3 billion. The company is working with law enforcement, token issuers, and blockchain tracing firms to find and freeze more.
Binance's co-CEO, Yi He, stated that user funds are safe and that withdrawals will remain paused until the systems are confirmed secure. He also hinted that an emergency fund exists to cover users if losses hit them. Meanwhile, Binance's founder, Changpeng Zhao, who stepped down as CEO in 2023 after pleading guilty to money laundering violations and was pardoned by President Trump in 2025, acknowledged that the incident "does look like a hack" and that, as a shareholder, he expects users to be made whole.
The incident has also had an impact on the cryptocurrency market, with Bitcoin slipping around 3% to just under $79,000, Ether falling roughly 3.6% to around $2,275, and Binance's own BNB token dropping nearly 7% to around $704. The US arm of Binance, Binance.us, stated that it is a separate platform and is operating normally. Coinbase, another major cryptocurrency exchange, stated that it is not affected by the incident.
If the early numbers hold up, this incident would top the 2025 Bybit hack, when North Korean-linked hackers known as Lazarus stole around $1.5 billion. Meanwhile, a separate breach occurred at prediction market Polymarket, which appears to be unrelated to the Binance incident. Around 700 users had funds drained, totaling roughly $2.7 million, after a third-party provider was compromised.
Binance has warned users to ignore unofficial links and messages asking for account details, as scammers tend to show up during moments like this. The company is working to resolve the issue and restore normal operations. Withdrawals on Binance remain paused until the company says otherwise. Security firm Hudson Rock identified the compromised provider used by Polymarket as DebugBear, a website performance tool, which confirmed an ongoing security incident and advised customers to remove its code from their sites.
Key points
- Binance faces a potential $5.8 billion crypto theft, with around $3 billion frozen so far.
- The incident has had an impact on the cryptocurrency market, with Bitcoin, Ether, and Binance's BNB token experiencing significant price drops.
- A separate breach occurred at prediction market Polymarket, resulting in around $2.7 million in losses for 700 users.
