Binance Breach Hits 6.3 Billion Dollars as Tether and Circle Freeze the Stolen Stablecoins
Binance says a security incident at the exchange has an estimated impact of about $6.3 billion. If that figure holds, it’s the largest theft in crypto’s history, more than four times the $1.5 billion taken from Bybit in February 2025. About $3 billion of it has been frozen on-chain so far. Binance says it will cover every loss from its SAFU fund and company money, and that user funds are safe.
The way in was ordinary. Binance’s preliminary findings point to a compromised laptop belonging to a DevOps engineer. From there the attacker reached a service container and submitted withdrawal transactions that the exchange’s systems treated as its own. Binance says it has found no evidence that any wallet private key leaked. That matters. Nobody cracked a cold wallet. Someone got inside the machinery that is allowed to move money and asked it to move money.
Blockchain researchers first spotted unusually large transfers out of Binance-linked wallets on October 29. Arkham Intelligence tied close to $6 billion in bitcoin, ether, SOL and stablecoins to 55 addresses it links to the exploit. Binance suspended deposits and withdrawals, revoked the affected address authorizations, paused Binance Alpha trading and promised a technical post-mortem and an updated proof of reserves once the security scan is done. Co-CEO Yi He has tied the restart of withdrawals to the end of that scan. There’s no date.
The freeze worked where an issuer could press a button
Look at who did the freezing. Tether froze nearly $1.57 billion of USDT. Circle blocked more than $800 million of USDC. Ripple and other issuers restricted transfers of affected assets, and Arbitrum’s Security Council froze funds sitting on that network. Binance’s own verified frozen total stood at $2.54 billion at one point before rising to about $3 billion.
Most of the recovered money, then, is stablecoins. Fiat-backed tokens carry a freeze function in their contracts, and the issuers used it within hours. The bitcoin, ether and SOL in the haul have no issuer to call. Whatever share of the $6.3 billion sat in those assets is moving through mixers and bridges on the attacker’s schedule, which is why roughly $3.3 billion is still unaccounted for.
This is the same pattern we saw in the Bitget hack earlier this month, where the attacker paid up to 5% over spot to dump USDT and USDC before an issuer could freeze them. Attackers know the frozen-in-hours problem. On Binance’s scale they didn’t get out fast enough. For the crypto purist, a centralized issuer blacklisting addresses is a bug. For an exchange holding customer money, it has just been the best recovery tool in the industry.
Can SAFU actually pay for this
SAFU, the Secure Asset Fund for Users, was set up in 2018 and funded from a slice of trading fees. Binance built it up to about $1 billion by early 2022. It paid out once before, after the May 2019 breach in which hackers took 7,000 BTC, then worth about $40 million.
A $1 billion fund doesn’t cover a $3.3 billion hole. That’s why the pledge names company funds next to SAFU, and why the updated proof of reserves is the document to watch. If Binance can make every account whole from its own balance sheet and reopen withdrawals without a run, the episode becomes a very expensive operations failure. If the reserve report shows a gap, or withdrawals stay shut for weeks, it becomes a solvency question for the exchange that already anchors much of USDC’s distribution.
Two things cut in Binance’s favor. It’s the largest exchange by trading volume, and a large slice of the stolen assets is already frozen with issuers it does business with daily. Getting that $3 billion released back to Binance is a legal and procedural task. It isn’t a chase.
What exchange security buys and what it doesn’t
The industry spent a decade hardening key storage: multisig, hardware security modules, cold wallets in vaults. None of it was tested here. The weak point was a person’s laptop and the internal permissions behind it, the same kind of route attackers used against Bybit, where a compromised developer machine at its wallet provider led to the signing interface.
Expect regulators to read this as a case for what they already ask of banks: separation of duties, withdrawal limits that can’t be raised from one internal system, and independent review of who can authorize what. It’s also a fresh argument for the custody split that consolidation in the exchange business has been pushing toward, where the trading venue doesn’t hold the assets at all.
Binance’s users will most likely get their money back. The next exchange to lose this much may not have Binance’s balance sheet.