The world's largest cryptocurrency exchange, Binance, is investigating a major security incident preliminarily estimated to involve $6.3 billion. An attacker is believed to have gained access to the company's infrastructure through a compromised engineer's laptop and carried out unauthorized transactions. Cryptocurrency companies have already frozen about $3 billion in assets, while Binance has temporarily suspended deposits and withdrawals. The exchange has pledged to cover users' losses in full.

How the hack may have happened

Binance's initial statement said it was investigating a potential security issue. The company later disclosed its preliminary account of what happened: the laptop of an engineer responsible for developing and operating services may have been compromised. This allowed the attacker to gain access to a container running a service and submit unauthorized withdrawal transactions.

Binance said, however, that it had not yet found any evidence that cryptocurrency wallet private keys had been exposed. This is an important distinction: according to the preliminary account, the attacker may have exploited access to internal infrastructure without directly obtaining the keys that control the wallets.

The exchange estimated the overall scale of the incident at approximately $6.3 billion. However, this figure represents a preliminary estimate of the assets affected, rather than a confirmed total of final losses. The company said that, together with its blockchain infrastructure partners, it had already frozen approximately $3 billion in assets.

Binance suspended deposits and withdrawals for the duration of the investigation to check the security of its systems, freeze assets and work with law enforcement. The company said it would reimburse all losses.

Binance founder and former CEO Changpeng Zhao, who no longer runs the exchange, also said he expected users to be reimbursed in full. He said he was speaking on the matter as a shareholder in the company.

Stablecoins helped freeze assets

The issuers of the two largest stablecoins — Tether (USDT) and Circle (USDC) — played an important role in responding to the incident. They reported freezing funds linked to the suspected hack.

Tether CEO Paolo Ardoino said the company had frozen more than $1.5 billion. Circle CEO Jeremy Allaire reported freezing more than $800 million in assets and cooperating with law enforcement.

The ability to freeze certain assets is one of the features of centrally managed stablecoins. Their issuers can restrict transactions involving specific addresses in accordance with their authority and procedures. This helps prevent the movement of suspicious funds, although it does not guarantee recovery of the full amount or mean that frozen assets have already been returned to victims.

That is why neither the reported scale of the incident nor the amount of the losses can yet be considered final. Some assets have been frozen, and the investigation must determine how much was actually stolen and how much can be recovered.

Cryptocurrency prices fell in response

Reports of potential losses at Binance sparked concern among investors. According to data published on the morning of October 30, Bitcoin fell by approximately 3.5%, while Ethereum dropped by more than 4%.

The market's reaction reflects not only potential financial losses but also concerns about the security of infrastructure that handles large volumes of cryptocurrency transactions. Binance remains the world's largest cryptocurrency exchange by trading volume, so a serious incident affecting it could undermine confidence across the market.

However, a hack of an exchange does not in itself mean that the Bitcoin or Ethereum blockchains have been compromised. The vulnerability may have been in the company's internal systems that support its services and process transactions.

If Binance's preliminary estimate is confirmed, the incident would exceed the scale of previous major thefts in the cryptocurrency market. Before this, one of the most high-profile cases was the theft of approximately $1.5 billion from the Bybit exchange. The U.S. FBI linked that attack to North Korean hackers.

Polymarket reported security issues on the same day

Alongside the Binance investigation, a security incident occurred at Polymarket, the largest prediction market platform by trading volume. Users reported unauthorized withdrawals, prompting the company to temporarily halt trading.

Polymarket said the issue stemmed from a breach at one of its third-party service providers and that it had referred the matter to law enforcement. Trading later resumed. A platform spokesperson also said affected users would be reimbursed for their losses, although the company had not yet been able to confirm the amount of potential losses.

According to a source familiar with the situation, the attack may have been linked to the compromise of DebugBear, a website performance monitoring service. It is unclear exactly how Polymarket used the platform. DebugBear itself confirmed that it was investigating a security incident and treating it as a priority.

Polymarket's U.S. platform was reportedly unaffected. There is no evidence that the Binance and Polymarket incidents are connected.

Both cases, however, demonstrate how serious the consequences can be when not only trading platforms' core systems but also employees' devices or third-party services integrated into their infrastructure are compromised.

For Binance, the main priority now is to confirm the extent of the losses and restore system operations without exposing users to new risks. Even if a significant portion of the assets can be recovered or frozen, the incident will be a serious test of confidence in the world's largest cryptocurrency exchange.