Binance has confirmed a hack involving about $6.3 billion in digital assets, making it the largest cryptocurrency theft on record. The exchange said it and its blockchain partners had frozen roughly $3 billion linked to the incident and pledged to cover all losses through its Secure Asset Fund for Users, known as SAFU, and company funds.
The disclosure puts Binance, the world’s largest cryptocurrency exchange by reported involvement in the incident, at the center of an unprecedented security breach. According to Cointelegraph, the exchange confirmed the scale of the theft on Friday, following a series of blockchain investigations that tracked suspicious movements from Binance-linked wallets.
The reported loss is approximately four times larger than the $1.5 billion hack of Bybit in February 2025, which had previously been regarded as the biggest cryptocurrency theft. The comparison was made by blockchain intelligence firm TRM Labs.
How the breach was detected
The first public warnings came from blockchain researcher Spreek. The researcher reported on X that assets held in a wallet linked to Binance had been moved to a newly created address through a contract call that was allegedly funded by Tornado Cash, a cryptocurrency-mixing service.
Spreek later said that wallets associated with the transfers had started selling Tether’s USDT through decentralized exchanges. Unlike a centralized exchange, a decentralized exchange allows users and wallets to trade through blockchain-based protocols rather than an operator-controlled order book. Such activity can make the movement and attempted conversion of stolen assets visible on public blockchains.
Blockaid, a blockchain security company, said its initial assessment identified about $3.3 billion in suspicious transfers involving Binance-linked wallets across the Ethereum, Arbitrum and Avalanche networks. The figure reflected the transfers identified at that stage and was not necessarily the final estimate of the total theft.
Arkham Intelligence subsequently identified a group of wallets labeled “binance-hacker-1029.” Those wallets were reported to hold approximately $5.84 billion in digital assets. Arkham’s figure represented the value of assets held by the wallets at the time, rather than a confirmed calculation of the stolen funds.
Binance co-founder Changpeng Zhao said the activity appeared to be a hack. He said Tether and Circle had frozen approximately $971 million and $823 million, respectively, and said he expected users’ funds to be fully covered.
Stablecoin issuers freeze linked tokens
Tether and Circle, the two largest stablecoin issuers by market capitalization, moved to restrict tokens connected with the attack. Stablecoins are digital tokens designed to track the value of an underlying currency, commonly the US dollar. Their issuers can sometimes freeze tokens held at identified blockchain addresses.
Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue to support the investigation. Shortly afterward, Tether CEO Paolo Ardoino said his company had frozen more than $1.567 billion in USDT linked to the hack.
Together, the issuers said they had frozen more than $2.36 billion in tokens. Binance separately said that its work with blockchain partners had helped freeze about $3 billion in affected assets. The different totals reflect the figures reported at different stages and by different parties during the initial response.
Binance said losses not recovered through the freeze would be covered by SAFU and its own funds. SAFU is an emergency reserve established by the exchange to protect users in certain circumstances. The pledge means Binance has said users should not bear the financial loss, although the investigation and asset-recovery effort remain ongoing.
Wider crypto-security concerns
The Binance incident followed a separate disruption at Polymarket, a prediction-market platform. Polymarket said trading had been temporarily halted after a compromise involving a third-party provider. The platform said it had fixed the issue, promised to reimburse affected users and reported that all systems were operating by 7:05 p.m. UTC on Thursday.
The sequence of events underlined the importance of tracing digital assets after a breach. Blockchain transactions are recorded publicly, allowing researchers, exchanges and token issuers to monitor wallet activity. At the same time, moving assets across multiple networks and trading them through decentralized venues can complicate efforts to identify and recover funds.
Moneyiar market picture
Moneyiar data recorded on Oct. 25, 2026, before Binance’s confirmation of the hack, showed BNB at $740.8618136891, up 0.81% over 24 hours and 3.32% over seven days. The same data showed edgeX at $0.3244313833, up 0.81% over 24 hours and 13.63% over seven days; Horizen at $5.7259060904, up 0.09% over 24 hours and down 1.51% over seven days; and Billions Network at $0.0139971939, down 0.59% over 24 hours and up 10.04% over seven days. These figures are Moneyiar data at the stated times and predate the reported Binance event.
