Binance has confirmed to TechCrunch that it is actively investigating a security incident after users reported funds being drained from the exchange's wallets. In an emailed statement, the company acknowledged reports of a potential security issue and assured users that their funds remain completely safe. Binance spokesperson Ross O'Leary stated that withdrawals have been temporarily suspended on multiple networks as a precautionary measure while security teams review all relevant information with urgency. The exchange urged users to remain cautious of scams and avoid unofficial links or requests for account information.
News of the breach emerged shortly after Changpeng Zhao, the founder and largest shareholder of Binance, posted on X that the company likely suffered a hack. Although Zhao no longer runs the company, he expressed confidence that user funds would be fully covered, though he did not provide an explanation for this claim. Financial technology firm Circle froze approximately $800 million in Tether as it moved through its networks, while crypto giant Tether itself froze about $1.56 billion related to the incident.
Crypto watchers estimate that at least $2 billion has been drained from Binance's hot wallets, which are internet-connected storage systems. Some estimates suggest the loss could exceed $5.7 billion, though these figures remain unconfirmed and the theft may still be ongoing. It is currently unclear who is behind the attack, and Binance has not indicated whether it received any correspondence from the perpetrators. If confirmed, this incident would likely rank as one of the largest cryptocurrency breaches in history.
For context, hackers stole a record $1.4 billion in a single breach from exchange Bybit in 2025, an attack blamed on North Korean hackers. In a separate incident earlier on Thursday, prediction market platform Polymarket briefly halted trading after confirming that a third-party company was compromised. Security researchers reported that hackers stole around $2 million in user funds by compromising software developed by DebugBear.
Sources: TechCrunch.