Over sleepless nights, Binance fought to contain hack

The biggest crypto hack in history began with a rehearsal.As trading hummed along on Binance at midweek, hackers were quietly running sequences of code on accounts they controlled on the Ethereum blockchain – just a couple dollars or so at a time. According to cybersecurity analysts, they were testing a program designed to seize control of accounts owned by the world’s largest crypto exchange and smuggle their contents elsewhere.Just after 4pm New York time on Oct 29, they attacked.In short order, the infiltrators drained more than US$6 billion from wallets across at least four different blockchains, setting off a worldwide effort to contain the damage.From New York to Abu Dhabi to Kyiv, security researchers and Binance executives scrambled to trace the stolen money, freeze accounts and understand how the attackers had breached the exchange and pulled off a heist that has shaken confidence in the crypto industry as it tries to earn greater acceptance in finance’s mainstream.“It’s the largest bank robbery in human history,” said Ari Redbord, global head of policy and government affairs at TRM Labs, a blockchain analytics firm. Redbord’s firm was one of several that mobilised after the attack started. “I literally haven’t slept and I haven’t stopped.”As Binance publicly said it could easily reimburse any losses from the hack on Oct 30, employees were privately expressing doubts to one another that they would be paid bonuses this year, said people familiar with the matter.The crypto industry is no stranger to malevolent actors. Only a month ago, cryptocurrency exchange Bitget was subject to a cyber-attack that drained US$388 million. In February 2025, hackers stole nearly US$1.5 billion from cryptocurrency exchange Bybit. But the scale of last week’s attack shocked even industry veterans.Just as the exploit was unleashed, Taylor Monahan, who is based in Los Angeles as a researcher at the non-profit security firm SEAL, was on a group chat with other crypto investigators when someone at blockchain security firm zeroShadow sent a message about strange transactions at Binance.“I’m going to remain optimistic that everything’s fine,” Monahan told herself. But she knew that if things were not OK, they were very bad. “It’s like a hack – like, a really big one.”By 4:38pm, Monahan suspected the worst and contacted Tether, the firm that issues the USDT dollar-backed stablecoin. “In our souls, we knew it was a hack,” she said.Tether responded immediately but did not acknowledge that there was an infiltration. Less than 30 minutes later, the firm began the process of freezing the transactions on its blockchain, as did Circle, issuer of the USDC stablecoin.Scrolling XYi He, Binance’s co-founder and co-chief executive officer, was at home in Abu Dhabi when she first noticed something wrong.The executive, who is well along into a pregnancy, had logged off work and was scrolling through X before going to bed around 12:30am in Abu Dhabi (4:30pm in New York). Posts on the social media site alerted her to trouble.Alarmed, she logged back on and saw that Binance’s security and wallet teams – which are empowered to act on hacks without executive sign-off – were already at work, trying to stop more losses. Within minutes, the company created a war room that swelled to about 100 people around the world. Yi and hundreds of Binance employees would stay up through the night, coordinating efforts within the company, with other crypto firms and with law-enforcement agencies including the Federal Bureau of Investigation and the US Secret Service.At 5:15pm, Binance publicly acknowledged it was aware of a “potential security issue” and that it was investigating the rumoured breach.At 5:18pm, Circle CEO Jeremy Allaire announced that the stablecoin company had frozen more than US$800 million associated with a “potential exploit involving Binance”.Seven minutes later, Tether CEO Paolo Ardoino announced that his firm had frozen more than US$1.5 billion “related to a potential Binance exchange hack”.Soon, crypto companies of every stripe started flooding social media to promise onlookers that they were safe.Binance competitors like Kraken, Coinbase, and Bybit all proclaimed that they were unharmed.Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have all said North Korea is behind the heist. They observed funds stolen from Binance commingle with crypto seized in the Bitget hack, which researchers had already attributed to the Democratic People’s Republic of Korea.Chainalysis labelled the incident as “the largest in the history of crypto, and one of the single-largest financial crimes of all time”.Still, even as the heist became more widely publicised, hackers continued to drain funds from Binance. The code attackers used gave them access to blockchain accounts owned by Binance and let the hackers empty them, all while exchange funds kept replenishing the accounts. Estimates of the amount stolen crept higher, eventually reaching US$6.3 billion.Mainstream cryptoThe attack comes at an inopportune time for an industry that is getting unprecedented support from the US government. The Trump administration has been pushing for mainstream adoption of cryptocurrencies and blockchain technology, including through its regulators.In September, the Securities and Exchange Commission approved a rule that allows for public company stocks to trade on blockchains.The Binance hack could undermine those efforts, experts fear.Odysseas Lamtzidis, founder of the blockchain security company Phylax Systems, was on a plane travelling to Miami from New York when he saw a Telegram chat discussing the attack. “It was very scary. I remember breathing heavy, because it was huge amounts of capital moving around and people on the plane were asking if I was OK,” he said.He watched as the attackers moved from one wallet to the next, and kept posting on X to alert users.“I think this is very scary for organisations and adoption of crypto because these types of events should be impossible to happen, not improbable,” he said. “It’s still a Wild West.”Yi and her co-CEO Richard Teng on Oct 30 confronted the potential reputational damage the attack could do.In a video posted on X, Yi promised Binance would continue to work with law enforcement to find the attackers. The company has vowed to reimburse any users who lost funds in the hack.“We won’t let the hackers take away the momentum this industry deserves,” she said in her video post, speaking in Mandarin.“Of course, there are areas where we could have done better. We should have invested more in security earlier, and set stricter standards. “Going forward, we won’t hold back, whether it’s investing in security or fighting hackers.”On Oct 31, the company said it has restored 90% of the tokens hackers absconded with, pledging to reinstate customers’ ability to withdraw funds the following day.Asked about employees’ bonus concerns, a spokesperson said Binance does not expect any impact there either.In the midst of the turmoil, some traders found opportunity. Morten Christensen, a cryptocurrency trader who also runs AirdropAlert.com, a site that tracks cryptocurrency giveaways, made tens of thousands of dollars on Oct 29.He was in Mexico, on a Discord call with six friends, brainstorming strategies to take advantage of the hack.They had decided to short cryptocurrencies, which were starting to drop in value, when his wife walked into his office. He sent her back out. “Binance got hacked, babe,” he said. “Need to lock in.” BLOOMBERG