On Thursday, Binance said its initial investigation suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. It said it found no evidence of a wallet private key leak, estimated total impact at about $6.3 billion, and reported about $3 billion frozen on-chain so far, in a post on X. Binance said it will cover all losses from its SAFU fund and company funds, and that deposits and withdrawals are suspended while security checks finish. It promised a technical post-mortem.

Early figures varied. Chainalysis estimated about $5.9 billion at the time of theft, CoinDesk reports. Tether and Circle froze more than $2.3 billion in stablecoins tied to the attacker. Investigator ZachXBT said North Korea's Lazarus Group is the likely culprit; that attribution is not confirmed by Binance or law enforcement. Widely shared posts claiming "$5.6 billion stolen" came from aggregators before Binance gave any figure.

What it means for you. Binance customers don't need to do anything to be made whole, according to the company. The real risk now is criminals using the headline. Expect fake "Binance support" calls and texts, emails promising refunds, and "verify your wallet" sites. Binance itself told users to rely only on official channels.

Action item: this week.
1. Tell staff and family: no real support agent asks for a password, a code or a seed phrase.
2. Check exchange news only in the official app or by typing the address yourself.
3. Turn on a withdrawal allowlist and use a passkey or hardware key to sign in.
4. If your business holds crypto, confirm who can approve a withdrawal and that it takes two people.
5. Admins: one laptop was the reported starting point here. Review who has standing access to systems that move money.

Also today

Polymarket users lost about $2.6 million through a compromised vendor script. Polymarket said one of its third-party providers was compromised, briefly halted trading on its international site, and will fully reimburse affected traders, per CNBC and BleepingComputer. Its US platform was not affected. If your website loads outside scripts, know which vendors they come from. Separately, KuCoin said it was not affected despite social media claims.