Hackers stole $6.3b from Binance. We’re tracking exchange flows

In the span of about 20 minutes, hackers stole $6.3b from Binance’s hot wallets on Friday, resulting in the largest crypto hack on record.

Binance froze withdrawals for roughly 45 hours. Stablecoin issuers froze $3b of USDT & USDC.

Since withdrawals resumed, users have withdrawn over $6.4b. 7d Net inflows for the world’s largest crypto exchange currently sit at -$12b.

The attackers gained access through a compromised employee computer.

An exploiter’s wallet supplied $60m USDT on Aave and borrowed $44m of WETH, leading to a temporary freeze of Aave’s v3 & v4 lending markets. Markets were unfrozen shortly after.

Stablecoin market cap fell to its lowest level since October 2025, but there’s currently no sign of stablecoin or lending stress. Other major exchanges have seen net inflows over the last 7 days.

After two days of net outflows following the hack, Binance saw nearly $3b in inflows today.

These outflows were about 8% of Binance’s reserves at their peak: relatively manageable compared to Bybit’s hack in February 2025 that was 36% of reserves. Binance used about half of its $1b SAFU fund and corporate funds to cover the losses.

Read Binance’s response update here.

Stablecoins make up over 65% of the $6.3b in net outflows from Binance’s tracked wallets since withdrawals resumed.

On the same day as the Binance hack, Polymarket’s frontend was compromised, allowing malicious code to sell user positions and transfer assets to hacker-controlled wallets. Polymarket temporarily suspended trading and committed to reimbursing impacted users.

DefiLlama’s hacks database tracks five additional hacks in the days following, most recently a $40m protocol logic exploit on Mercado Bitcoin, Brazil’s largest exchange.

Only two of the top 10 largest hacks have taken place this year, but due to the sheer size of the Binance hack, this year’s hacked amount is two times larger than any complete year of hacks in crypto’s history.

In 2026, 328 hacks have taken place, more than double 2025.

As part of our mission to provide transparency & accurate DeFi data, we’re announcing Verified: independent verification of offchain reserves, stablecoin backing, vaults, financial statements, and more.

Our first Verification page is live alongside Frax Finance. Now you can track frxUSD’s backing - including offchain assets - in real-time.

Users can see how each source was checked, when it was last confirmed and what cadence to expect while protocols can keep their records and positions private.

If you’re part of a company with offchain reserves or financial statements, reach out below to get Verified by DefiLlama.

Which yield pools are growing fastest? Which pools just added rewards?

Introducing Yield Discover: see which pools are growing the fastest, which ones are launching rewards, and newly listed pools.

Verified yields are live on nearly 250 Solana pools. We simulate what real holders would receive if they withdrew, and whether they can exit instantly or experience delays based on deposit size.

See detailed pool stats: 30d Stability, number of pool holders, Base + Reward yield split and simulate rewards based on your deposit size. Jupiter Lend USDC is currently paying 6.16% - if you deposited $10,000 on February 27th you’d be on track to earn 4.77% annualized.

See all Verified yields on Solana

Schedule a call with our analyst team at DefiLlama Research for more market insights and to explore our market intelligence tools.

Flare design starts from the challenge of giving smart contracts reliable access to information that lives outside the chain. This report looks at how that architecture works, where it is already producing results, and what would show it scaling.

Following our report on Zama, “A Look Into Confidential DeFi,” Ryan Celaj, our head of research, and Kyle Cai, our former senior research analyst, sat down with the company’s CEO and co-founder, Rand Hindi.

Now that the market has real size, how good is the liquidity behind it? To find out, we took a live snapshot of four names (AAPL, TSLA, GOOGL and SPY) across perps on Bitget, Binance, OKX and Bybit, and spot on Bitget, Binance, OKX, Bybit and Hyperliquid.

Based on overwhelming interest, we’re launching even more hack and revenue markets.

Also, returning this month are revenue markets for Collector Crypt, Hyperliquid, Pump, Aero and Uniswap.

Tracking protocol revenues? We just launched revenue markets for Hyperliquid, Pump, Aero, Uniswap, Collector Crypt, and Papertrade. New markets like fomo and Polymarket revenues coming soon.

Hedge against exploit risk by trading the odds of total DeFi hacks and exploits of specific protocols. We have markets for whether there will be exploits of major protocols this month. We also have weekly and monthly markets for the size of the largest hack.

Thanks for reading! Reply to this email and tell us what you want covered next week.