What happened. Users reported funds moving out of Binance wallets on Thursday, and founder Changpeng Zhao, who no longer runs the company but is its largest shareholder, posted on X that Binance had likely been hacked. Binance told TechCrunch it is "actively investigating," and spokesperson Ross O'Leary said withdrawals were paused on multiple networks as a precaution. Who is behind it, and how they got in, is not public.
How big. Crypto watchers cited by TechCrunch put the drain from Binance's hot wallets (the internet-connected wallets an exchange uses to pay out withdrawals) at $2 billion or more, and some estimates run up to $5.7 billion. None of that is confirmed, and the theft may still be going on. Tether froze about $1.56 billion and Circle about $800 million in stablecoins tied to the hack. If the billions hold up, it passes Bybit's $1.4 billion theft in 2025, the largest single crypto heist until now, which was blamed on North Korea.
Why defenders should care. A hot wallet is a signing key on an online system, so treat this as a key-custody and signing-workflow failure until shown otherwise. Separately on Thursday, Polymarket briefly halted trading and withdrawals after a third-party software supplier, DebugBear, was compromised; researchers say about $2 million in user funds was taken. Any team holding hot keys should check who and what can approve a transfer, cap what sits online, and watch third-party scripts that run inside signing or payout flows.