Binance said Friday that a security incident had an estimated impact of $6.3 billion, with around $3 billion in cryptocurrency assets frozen so far. The exchange pledged to cover all losses. Those are large numbers, and they deserve more scrutiny than a reassuring press statement can provide.
The company's own explanation is the most unsettling part. Binance said an initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." In plain terms, a single employee device was enough to open a path to withdrawals at the world's largest crypto exchange. That is a failure of internal controls, not a freak accident, and customers have every reason to ask how such access was possible in the first place.
Binance has offered comfort. Co-founder Yi He said deposits were unaffected, the exchange expects to begin resuming withdrawals within 48 hours, and customer funds remain safe. It said losses would be covered through its Secure Asset Fund for Users and company funds. Those commitments matter, but they are promises, and the company has yet to publish the technical post-mortem it says is coming. Until that document appears, users are being asked to trust a process they cannot inspect.
The wider response is also telling. Circle, Tether and Ripple have all moved to freeze funds tied to the hack, and Circle's CEO said more than 800 million in USD Coin had been frozen. Yet Arkham Intelligence linked nearly $6 billion in digital assets to 55 wallet addresses it associates with the potential exploit. The gap between frozen funds and suspected flows is a reminder that the industry's cleanup tools are still reactive and incomplete.
Exploits are not new to this sector. The report notes that Bybit lost roughly $1.5 billion in 2025 and Bitget lost more than $350 million in a separate theft. Each incident is treated as an isolated crisis, followed by reassurance and a fresh promise of better security. Regulators and large exchanges should stop accepting that cycle. They should require independent audits of withdrawal controls, clear standards for privileged access on engineering devices, and timely public disclosure of root causes. The next victim should not have to wait for a post-mortem to learn whether their money is safe.