Binance Hack: What the Suspected Theft Means for Users and Crypto Prices

Binance, the world's largest crypto exchange, is investigating a suspected hack that hit its hot wallet on Thursday. Some withdrawals have been paused, and crypto prices fell sharply. Binance and its co-founder say user funds are safe, but the size of the theft is still disputed.

According to CryptoTicker, a Binance hot wallet was drained in a single transaction at 20:24 UTC, with roughly $2.8 billion leaving on Ethereum. Axios reported that analysts and traders estimate the total taken at between $1.7 billion and $5.7 billion, which could make it the largest crypto hack on record.

What changed for Binance users

Binance limited withdrawals after the incident. CryptoTicker reported that, as of its latest update, the exchange was still processing Bitcoin, Ether and the USDT stablecoin on the Ethereum and Tron networks. Binance paused Solana, XRP and stablecoins on Solana, Optimism, Avalanche, NEAR and Polygon, citing wallet maintenance.

Binance had posted no new statement on its official announcement page as of CryptoTicker's 00:38 UTC update. A company spokesperson told Axios that the exchange's security teams are reviewing all relevant information urgently and that the investigation continues.

How big was the theft? Reports differ

The figures vary by source. CryptoTicker said confirmed outflows are about $2.8 billion on Ethereum, while trackers put outflows across six blockchains at up to $3.55 billion. Axios cited the wider $1.7 billion to $5.7 billion range. Binance has not confirmed the total value taken or who may be behind the attack, according to Axios.

Tether and Circle, the issuers of the USDT and USDC stablecoins, froze funds linked to the attacker. CryptoTicker put the frozen amount at around $2.4 billion. Axios, citing Changpeng Zhao, reported more than $1 billion. CryptoTicker said its own check of the blacklists found 1,175.5 million USDT and 823.0 million USDC frozen on the attacker's address, though about 700 million USDT had moved before the freeze.

The attacker has since been sending out tokens that the stablecoin issuers cannot freeze, CryptoTicker reported, and the 195,460 ETH from the theft had not moved as of its latest update.

How the market reacted

Within an hour of the drain, Bitcoin slid from $80,327 to $78,763, CryptoTicker reported. BNB, Binance's own token, lost up to 6.3% in that time. About $628 million in leveraged positions were force-closed in one hour.

By 00:38 UTC, according to CoinMarketCap figures cited by CryptoTicker, Bitcoin traded at $77,160, down 4.9% over 24 hours. BNB stood at $684.21, down 9.9%. Total crypto market value had shrunk to $2.65 trillion earlier in the evening.

Not every coin fell. CryptoTicker said Hyperliquid's HYPE token was up 15% over 24 hours and Tron's TRX almost 5%.

What this means for people with money on exchanges

For customers, the central question is whether they will be made whole. Zhao, who Axios says is no longer a Binance executive, said user funds are safe. He said, speaking as a shareholder according to Crypto Briefing via CryptoTicker, that all user funds will be fully covered. A Binance spokesperson also said user funds are safe, Axios reported.

Kevin March, a co-founder of JPEG Trading, told Axios that Binance's size makes it more insulated than other exchanges. He said it could cover potential losses through its insurance and balance sheet. He also said the hack was "unprecedented" and that it would have been catastrophic for any other crypto business. Axios noted that massive attacks can leave smaller exchanges vulnerable to collapse if customers rush to withdraw.

The practical effects so far are limited withdrawals on some networks and sharp price swings, including forced closures of leveraged trades. Axios said broader reverberations in crypto markets and prices remain possible.

Context: a string of attacks

Axios linked the incident to a wave of cyberattacks and data breaches in what it called “Black October,” when a series of hacks and AI-discovered bugs raised fears of a wider crisis. Hours earlier, the prediction market Polymarket confirmed a cyberattack in which an attacker took at least $2.7 million in user funds, Axios reported. For comparison, North Korea-linked hackers stole about $1.5 billion in crypto from the Bybit exchange in 2025, according to Axios.

What to watch next

Trading in Asia was due to open from midnight UTC, with Tokyo, Seoul and Hong Kong markets coming online, CryptoTicker noted. Open questions include Binance's next statement, the final loss figure, who was responsible and when the paused withdrawals will resume.

Around Prague, based on reporting by CryptoTicker.io, Axios