UPDATE: Binance has confirmed the hack, and says the incident may have occurred through an employee’s compromised laptop, enabling the attacker to drain as much as $6.3 billion in cryptocurrency funds.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the company said in a tweet. This suggests the hacker was able to install malware on the laptop, or run malicious computer code over the device’s software.
“We have found no evidence of any wallet private key leak,” Binance added. “We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.”
The findings also confirm the incident is the largest cryptocurrency heist in history. Despite the huge theft, Binance reiterates it’ll cover all loses using the company’s funds, including its emergency SAFU funds.
Original story:
Cryptocurrency exchange Binance is investigating a possible hack after more than $2 billion in digital funds were mysteriously transferred to a newly established wallet.
“We are aware of reports of a potential security issue and we are actively investigating,” Binance co-CEO Yi He tweeted on Thursday. She also signaled Binance has an emergency fund to cover users in the event a major loss occurs. “Safety first: withdrawals are currently disabled until the environment is confirmed to be secure,” she later added.
Fears of a hack emerged after a user spotted more than $2.7 billion mysteriously moving from a Binance wallet to an external account, spanning Ethereum and stablecoins from Tether and Circle Internet Group. A Coinbase director and Kairos Research now say $5.8 billion appear to have “left Binance across Ethereum, Bitcoin, and Tron.”
“The Binance hack is STILL GOING,” tweeted Coinbase’s senior director Conor Grogan.
Concerns about the Binance hack prompted Tether Limited to freeze over 1.5 billion in cryptocurrency, according to Tether’s CTO. Circle has also frozen over $800 million in coordination with law enforcement. Binance says currently $2.54 billion in funds have been frozen. “This figure may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets,” the exchange said.
Binance’s co-founder and former CEO, Changpeng Zhao, also weighed in, tweeting: “It does look like a hack on Binance… I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.” If confirmed, then the incident would be the largest crypto heist in history, dwarfing last year’s $1.5 billion hack of ByBit, which was later blamed on North Korean hackers.
Recommended by Our Editors
For now, the apparent hack appears to only affect Binance.com, not Binance.us, which was created for the US market. “We are a separate, independent platform, and customer funds and services are secure and operating normally. Rest assured, all user funds are safe,” Binance.us tweeted. Coinbase also says it’s not affected.
The reported hack occurred just as a separate security incident hit the prediction market Polymarket, causing select users to have their funds drained. One estimate puts the number of affected users at 700, with $2.7 million drained.
Polymarket temporarily halted trading and confirmed: “One of our third-party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole.”
Cybersecurity provider Hudson Rock indicates that the third-party provider is DebugBear, which provides a web performance monitoring tool. Hudson Rock CTO Alon Gal says DebugBear’s service was tampered with to load malicious code “that looks for a logged-in user’s trading session and attempts to sell their positions and transfer the assets.”
DebugBear has since confirmed an “ongoing security incident,” adding in a tweet: “If you use our RUM product, please remove the embed code from your website.”
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Leave a Reply