Binance said on Thursday that a security breach had affected an estimated $6.3 billion in assets, prompting the world’s largest cryptocurrency exchange to suspend deposits and withdrawals as it sought to contain a potentially record theft. The company said it was working with law enforcement, digital-currency issuers and other industry partners to trace the assets. Bitcoin and other major cryptocurrencies fell as the incident raised fresh questions about the security of funds held on centralised trading platforms.

The exchange said about $3 billion had been recovered or frozen, but provided no update on the remaining $3.3 billion. Co-founder Yi He pledged that Binance would cover losses from the hack. Those figures leave an important distinction between the estimated assets affected and the losses that may ultimately remain after recovery efforts. Binance’s reported impact was also different from the estimate offered by blockchain analytics company Chainalysis, which put the amount stolen at approximately $5.

The scale remained subject to uncertainty as the company and industry participants issued differing assessments. In another statement, Binance reported that more than $2.5 billion had been frozen, while former chief Changpeng Zhao estimated that losses could be somewhat above $1 billion. Zhao no longer runs Binance but remains a majority shareholder. The estimates were not presented on a consistent basis: assets affected, amounts stolen, funds frozen and eventual losses are distinct measures. The available statements did not reconcile those differences into a final accounting.

Read more: Netanyahu bloc wins 53 seats in Israel, short of a majority

Chainalysis and other industry specialists said the incident could be the largest cryptocurrency theft on record. The comparison is with the roughly $1.5 billion stolen from Bybit in February 2025, an attack attributed to hackers affiliated with North Korea. Aravind Srinivasan, head of the systematic over-the-counter business at cryptocurrency market maker GSR, described the Binance breach as the largest hack in history. That assessment was more categorical than the provisional language surrounding the exchange’s figures, with recovery work still under way.

Binance’s initial investigation suggested that an engineer’s compromised laptop may have provided the entry point. According to the company, an attacker used that access to reach one of its systems and make unauthorised withdrawals. The explanation remained preliminary rather than a confirmed account of the full attack. Miguel Morel, chief executive of blockchain intelligence company Arkham, said its data indicated that an unidentified actor appeared to have taken billions of dollars from Binance. No attacker was identified in the company’s account.

The operational response extended beyond tracking the missing assets. At about 0030 GMT on Friday, Binance said deposits and withdrawals had been halted while its teams checked security, froze funds and worked with law enforcement. The exchange also said it was securing its wallet infrastructure. Its assurances about the safety of customer money sat alongside the suspension and its commitment to absorb losses. Binance said the amount frozen could rise as investigators, issuers and industry partners continued tracing assets connected to the breach.

Read more: 2021 federal deficit fell $360 billion as recovery lifted revenue

The disruption affected a platform with 335 million registered users worldwide. Binance’s 2025 annual report put assets under custody at about $162.8 billion, providing context for the exchange’s role in the digital-asset market without establishing the eventual financial cost of this incident. Binance maintains a user-protection reserve, held entirely in bitcoin, intended to safeguard customer assets following security breaches. Its commitment to compensate users and the existence of that fund did not, in the statements provided, resolve how the final losses would be met.

Stablecoin companies accounted for substantial reported freezes. Tether said it had blocked nearly $1.57 billion connected to the incident; its chief executive, Paolo Ardoino, described the amount frozen as about $1.6 billion. Circle chief Jeremy Allaire said his company had frozen more than $800 million in USDC. Tether’s USDT and Circle’s USDC are stablecoins tied to the US dollar. These announcements described assets immobilised by issuers, rather than establishing that all of those funds had already been returned to Binance or its customers.

Other companies also joined the containment effort. World Liberty Financial, the cryptocurrency business linked to US President Donald Trump and his family, said it had worked with custodian BitGo to freeze stolen funds. Yi said $27 million in stablecoins and about $2 million in World Liberty tokens had been frozen. She also reported that Ripple had frozen roughly $200 million. Ripple’s senior vice president of stablecoins, Jack McDonald, said the company was monitoring the possible exploit, blocking affected funds and coordinating with relevant parties.

The market reaction spread across cryptocurrencies and listed businesses exposed to them. Bitcoin fell more than 3% to $76,368, a six-week low, while ether, the second-largest cryptocurrency by market capitalisation, declined more than 3% to a two-month low of $2,178. Other market readings put ether down 4. The differing readings underscored that the quoted prices were not a single market snapshot. Coinbase Global shares lost 4.8%, while bitcoin buyer Strategy fell nearly 6% in extended US trading.

The breach came as digital assets were already facing pressure from higher US interest rates and weaker demand from buyers of exchange-traded funds, analysts said. Tim Sun, a senior researcher at Hong Kong-based HashKey Group, warned that the incident could further reduce investors’ willingness to take risks. He said it might also prompt closer scrutiny of the security of assets held at centralised exchanges, alongside the financial strength of counterparties and their ability to meet obligations and provide liquidity.

Bernardo Brites, chief executive of payments and stablecoin infrastructure company Trace Finance, offered a view of the possible competitive consequences. He expected users to move away from smaller and medium-sized exchanges that might struggle to absorb a substantial hack. Brites also warned that artificial intelligence was making vulnerabilities harder to address quickly enough. That was a broader warning about security capabilities, not evidence that artificial intelligence had played a role in the Binance attack described by the company.

The incident adds to an established pattern of large thefts. Researchers at TRM Labs said attackers took $2.9 billion in cryptocurrency across nearly 150 attacks in 2025. Bitget reported roughly $350 million stolen in September, following the Bybit breach in 2025. Authorities have also warned that organised criminal groups increasingly use digital currencies to transfer money across borders outside conventional finance. Those concerns form part of the wider security backdrop, although the identity and affiliations of the Binance attacker remained unknown.

Other platforms sought to distinguish their operations from the affected exchange. Binance.US, a separate business, said the breach had not affected it. Coinbase likewise said it was unaffected and was watching developments. In an unrelated incident earlier on Thursday, prediction-market operator Polymarket paused trading after a security problem involving a third-party provider. It subsequently reopened trading and promised full reimbursement to affected traders. There was no stated connection between that disruption and the attack Binance was investigating.

For Binance, the immediate priorities remained securing its systems, tracing the affected assets and extending freezes through its partners. The company’s preliminary account of the entry point still required investigation, while the differing loss estimates left the final financial impact unresolved. Its promise to cover customer losses was therefore separate from the continuing effort to recover funds. Whether the incident establishes a theft record depends on a clearer accounting of the amount stolen, while recoveries will determine how much of that loss ultimately remains.