Binance suspends withdrawals after suspected multi-billion crypto theft

At least $2 billion has reportedly been drained from Binance's hot wallets, and some estimates put the damage at up to $5.7 billion. The world's largest cryptocurrency exchange has confirmed it is dealing with a security incident and has suspended withdrawals on multiple networks as a precaution.

Binance said in an emailed statement that it is "aware of reports of a potential security issue and are actively investigating." The company added: "Rest assured that user funds are completely safe."

"Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information," the statement read. Binance also warned users to remain cautious of scams and to avoid unofficial links, messages, or requests for account information.

Spokesperson Ross O'Leary confirmed the exchange has "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure."

What does this change for crypto holders?

For now, withdrawals are frozen and the numbers keep moving. The affected assets sit in hot wallets — cryptocurrency wallets connected to the internet — which makes them the most exposed part of any exchange's infrastructure. Observers warn the theft may still be ongoing, and the figures remain unconfirmed.

Binance founder Changpeng Zhao, who no longer runs the company but remains its largest shareholder, said in a post on X that the company likely had been hacked. He said he expects users' funds to be "fully covered" but offered no explanation for the claim. Binance has not said whether it has received any correspondence from the hackers, and responsibility remains unattributed.

Stablecoin issuers move fast

The largest issuers in the stablecoin market acted within hours. Financial technology giant Circle froze about $800 million in Tether as it passed through its networks. Tether itself froze roughly $1.56 billion connected to the Binance hack, bringing the combined frozen total to more than $2.3 billion.

Freezing funds at the issuer level is one of the few levers available once crypto leaves an exchange. It does not recover assets held outside major stablecoins, and it says nothing about the hot wallets already drained.

How does this compare?

If the confirmed losses reach into the billions, the incident would likely rank among the largest crypto breaches in history, according to leaderboards that track crypto thefts. The current record holder is the 2025 Bybit breach, in which hackers stole $1.4 billion in a single attack — a theft attributed to North Korean actors.

Even the low-end estimate of $2 billion would exceed that record. The upper estimate of $5.7 billion would roughly quadruple it, though that figure lacks confirmation.

A separate incident the same day

Earlier on Thursday, prediction market operator Polymarket briefly halted trading after confirming that a third-party company was compromised, prompting the platform to pause withdrawals. Security researchers said hackers stole around $2 million in user funds after compromising a piece of software developed by a company called DebugBear.

The Polymarket incident appears unrelated to the Binance breach. It does, however, underline the same lesson: the compromise point was a vendor's software, not the platform itself.

For enterprise security teams, the pairing is instructive. A vendor compromise at DebugBear cost Polymarket's users $2 million. Whatever hit Binance's hot wallets may cost billions. The scale differs; the attack surface — third-party and internet-connected infrastructure — does not.