Binance reported an exceptionally large-scale cyberattack, estimating the value of the assets affected at approximately $6.3 billion. The platform says it worked with partners to block some of them on the blockchain, while deposits and withdrawals were temporarily suspended. Initial reassuring statements about the security of customer funds were later followed by Binance’s commitment to cover any potential losses.
Binance’s announcement describes a major incident affecting digital assets associated with the platform. The total amount impacted is estimated at approximately $6.3 billion, according to a statement published on Binance’s Latin America X account. This figure refers to the assets affected by the incident and does not necessarily mean that the entire amount was stolen or lost.
The platform says its teams worked with blockchain specialists to identify and block assets linked to the attack. Approximately $3 billion is said to have been frozen on-chain, meaning it was immobilized directly on the blockchain. This measure is intended to prevent the assets from being moved or converted while the investigation continues.
Initial statements followed by a commitment to cover losses
Binance’s initial communications gave rise to contradictory messages. At first, the company assured customers that their deposited funds were “completely safe.” It later stated that it would cover “all losses,” without providing specific details about the scope of that coverage in the information released.
The difference between the total value of the affected assets and the losses that could ultimately be borne by the platform remains significant. Freezing some of the funds indicates that certain assets may have been identified and immobilized, but this alone does not establish how much can be recovered or how much has actually left the control of its owners.
Temporary suspension of deposits and withdrawals
At around 00:30 GMT on Friday, Binance announced the temporary suspension of all deposits and withdrawals. This type of measure is intended to limit the movement of funds while an incident is being analyzed and reduce the risk of further outflows. However, it may disrupt the transactions of customers who wish to transfer or withdraw their assets.
Binance also warned that the amount involved could change. Its teams are said to be working with authorities, cryptocurrency issuers, data analytics companies, and various industry partners to identify other assets potentially linked to the attack and, where possible, have them frozen.
Freezing assets involves stablecoin issuers
The response from companies that issue stablecoins was an important part of the response. These cryptocurrencies aim to maintain a stable value by being pegged to a traditional currency—in this case, the US dollar. Unlike assets whose prices fluctuate freely, stablecoins such as USDT and USDC are widely used for trading and transfers on digital markets.
Tether’s CEO announced the freezing of approximately $1.6 billion in assets in connection with a potential attack targeting Binance. Tether issues USDT, one of the largest cryptocurrencies in circulation. Meanwhile, Circle’s CEO reported that approximately $800 million in USDC had been frozen, noting that the action was taken in coordination with authorities.
The amounts reported by the issuers are part of the efforts to block assets linked to the incident. They should not automatically be added to the total announced by Binance: the available statements do not specify whether all the sums represent separate categories or overlap with assets already counted as frozen on-chain.
Cooperation among platforms, authorities, and specialist firms
Freezing assets on a blockchain depends, in particular, on the ability to track transactions and identify the wallets involved. Platforms, stablecoin issuers, and analytics companies can contribute to this effort by sharing information or blocking certain assets when they have the necessary technical and legal means.
Tether and Circle’s announcements therefore indicate that the response does not depend on Binance alone. The announced work with authorities and specialist partners is intended to help track the movement of funds, assess the scale of the incident, and try to limit opportunities to transfer or convert the affected assets.
Uncertain picture and differing estimates
Initial public reactions also put forward different assessments. Changpeng Zhao, Binance’s former CEO, described the event on X as a cyberattack targeting the platform. He estimated that losses could be “a little over” $1 billion, a figure significantly lower than the total of $6.3 billion later cited by Binance for the assets affected.
This discrepancy alone does not establish that the figures are fundamentally contradictory. The estimates may refer to different things: net losses, the value of the assets targeted, suspicious transactions detected, or funds immobilized. Without a detailed accounting, the precise meaning of each figure remains to be clarified.
Estimates may also change as teams analyze transactions and identify the wallets involved. Binance said the amount could increase if additional assets linked to the incident are discovered. The final assessment will therefore depend on technical investigations and the ability of the various parties to trace and block the funds.
An attack of remarkable scale in the cryptocurrency sector
If the reported amounts were confirmed in full, the incident would rank among the largest in the sector. By comparison, the hack of the Bybit platform in February 2025 resulted in the theft of approximately $1.5 billion. According to reports at the time, the attack was attributed to hackers linked to North Korea.
However, the comparison must account for the difference between sums involved in an investigation and amounts actually stolen. In Binance’s case, the $6.3 billion figure was presented as the total impacted, while the platform says a significant portion of the assets has been frozen. The final amount of losses can only be established after the transactions and recoverable funds have been examined.
Attacks targeting cryptocurrency infrastructure and applications can take different forms: system compromise, exploitation of a vulnerability, or transaction manipulation. The Flow blockchain’s recent response to a cyberattack, including reversing some fraudulent transactions, illustrates the complex choices networks may face when seeking to limit the consequences of an incident: how the Flow blockchain responded to a major cyberattack.
Platform and protocol security under scrutiny
The incident comes at a time when security is a central concern for exchanges, protocols, and holders of digital assets. A flaw in a service or application can lead to significant losses, but the consequences vary depending on the nature of the vulnerability, the protections in place, and the speed of the response.
Another example is a vulnerability in the Ill Bloom app, which led to the loss of $31 million in cryptocurrency. This incident is a reminder that the risks are not limited to major platforms: applications used to access digital financial services can also be a point of exposure. Details about this flaw are presented in this article: the Ill Bloom vulnerability and its consequences for users.
Cyberattack investigations also seek to establish whether organized groups are involved and to understand the methods used. Operations attributed to North Korean actors have already fueled debate about the reliability of blockchain-related infrastructure and the challenges of tracing assets. Another article looks at concerns related to these attacks and ecosystem security: security concerns following a cyberattack attributed to North Korean hackers.
Tracking assets and protective measures
In the hours and days following an attack, security teams analyze activity on the blockchain to trace transfers and identify the wallets involved. Information shared between platforms and partners can help identify assets suspected of being linked to the incident. Stablecoins may then be frozen to prevent them from being used or moved on the networks concerned.
For users, Binance’s announcements raise practical questions about access to deposits and withdrawals, as well as how any potential losses will be handled. The suspension of operations is described as temporary, but its duration and the arrangements for resuming them will depend on the progress of the checks. The platform says its customers’ funds remain protected and that it will cover losses, while the investigation is expected to clarify the amount actually compromised and the share of assets that can be recovered.
