At about 4:20 p.m. on Thursday, a string of unusual transactions started to cause alarm at Binance, the world’s largest cryptocurrency exchange.
Money was pouring out of the company’s accounts, a multibillion-dollar deluge of digital coins. It had all the hallmarks of a crypto heist — a high-speed bank robbery conducted over the internet.
As the news spread, Binance’s top executives put together an informal war room on Wea, the company’s internal messaging system, with about 100 participants, including specialised cryptocurrency tracers and security personnel.
They eventually transitioned to a mass conference call, with 100 boxes on the screen, where employees took turns muting and then unmuting, communicating in a mixture of English and Chinese. Among them was He Yi, Binance’s co-CEO, who is seven months pregnant, and worked through the night from her base in Abu Dhabi, taking a call at 3am local time.
He and her colleagues were navigating one of the most damaging crises in Binance’s long and troubled history. A team of North Korean hackers had penetrated the exchange and drained more than $6 billion in the largest crypto heist of all time. Binance was forced to halt deposits and withdrawals, and posted a series of frantic messages on the social platform X, promising that it would cover any losses.
It was a surreal situation made even more surreal by the actions of Binance’s founder, Changpeng Zhao, who spent the evening narrating the events to his 12.9 million followers on X. He posted prayer hand emojis, publicly jousted with the site’s owner, Elon Musk, and insisted that “user funds are SAFU” — using a bit of crypto slang to reassure customers that hundreds of millions of dollars in deposits would not simply vanish into thin air.
“It hurts, but we will survive,” Zhao declared.
The impact of the Binance attack rippled across the crypto industry, from Abu Dhabi to New York, setting off a frantic effort to salvage some of the stolen funds and prompting law enforcement inquiries. This account of how the hack unfolded is based on interviews with four people with knowledge of the events, as well as analyses by crypto forensics firms and documents reviewed by The New York Times.
For years, Binance has been the most important and contentious company in the crypto world. After Zhao founded it in 2017, it quickly turned into a behemoth, the No. 1 destination for customers looking to convert traditional currencies into digital coins like Bitcoin and Ether.
It also became a haven for crime. In 2023, Binance pleaded guilty to antimoney-laundering violations that had allowed criminals to move money and paid $4.3 billion in penalties to US regulators. Zhao was sentenced to four months in prison.
For all its troubles, however, Binance never lost popularity among the crypto faithful. It remains the world’s largest exchange by a distance, and Zhao, who lives in Abu Dhabi, is something of an industry folk hero. Binance’s main platform is banned in the United States. But last year, the company forged a business relationship with World Liberty Financial, the Trump family crypto startup. President Donald Trump granted a pardon to Zhao last October, paving the way for Binance to expand into the US market.
But on the night of October 29, the company had to deal with the aftermath of the $6 billion hack.
Such attacks have become commonplace in the crypto world. In February 2025, the North Koreans stole $1.5 billion from Bybit, a rival exchange. Bybit was breached after Ben Zhou, its CEO, approved a seemingly routine transaction that granted the thieves access to the exchange’s internal system.
It’s not clear precisely how the North Koreans got around Binance’s defences. An initial investigation pointed to a compromised laptop, Binance said Friday. But the company later said it had uncovered “additional points of breach.”
Much of the drama played out in public. Almost all crypto transactions are recorded on the blockchain, a ledger of money movements that anyone can look up. That meant crypto analysts could see funds leaving Binance in real time.
On Thursday afternoon, Jonathan Levin, CEO of crypto analytics firm Chainalysis, was on a video call with a former senior US official, discussing the need for the US government to deploy cyberattacks against adversaries. Then Mr. Levin got the news about Binance.
“I looked at my phone and was like, ‘Oh, this doesn’t look good,’” he said in an interview.
A group of Chainalysis employees gathered in a conference room in New York named “Silk Road,” after another crypto platform that was famously hacked. They worked until the early hours of Friday morning, eating Malaysian food and analyzing transactions to get a clearer picture of what had happened.
Soon both Chainalysis and another analytics firm, TRM Labs, attributed the attack to an elite North Korean hacking unit called TraderTraitor. The FBI confirmed their findings. North Koreans have targeted crypto companies for years, using the proceeds of those thefts to fund its nuclear programme, according to Western officials.
The hackers have developed increasingly complex strategies to steal crypto and launder the proceeds, a painstaking endeavour that can take months to complete. In a blog post on Friday, Chainalysis said the attackers had deployed “laundering patterns we have not seen before,” conducting thousands of transactions over a short period, probably with the help of automation.
At the same time, Binance’s colleagues in the industry mobilised to intercept some of the laundered crypto. Certain digital coin issuers can freeze funds, allowing them to halt a money-laundering operation in its tracks.
Soon after the hack, Tether and Circle, two major issuers, announced that they had frozen stashes of their own coins that the hackers had seized from Binance, a combined total of more than $2 billion in crypto. Binance is now working to gain access to those funds, the company said.
But $2.4 billion in crypto is already “beyond any issuer’s reach,” according to TRM. In a social media post on Friday, Binance said it had set aside $6.34 billion to cover losses from the hack.
How much money Binance has in reserve is not publicly known. After midnight, Musk posted a grimacing emoji underneath an X post comparing Zhao to Sam Bankman-Fried, the disgraced crypto mogul whose FTX exchange collapsed in 2022.
“Bad time to troll,” Zhao responded. “Please stop.” He noted that Binance owns over $1 billion in shares in SpaceX, Musk’s rocket company.
Zhao’s comment got the attention of He, Binance’s co-CEO and his longtime romantic partner. (Zhao is Binance’s majority shareholder but doesn’t have a formal role at the company.) “Our company’s revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares,” He wrote.
With the industry reeling, He and her co-CEO, Richard Teng, told Binance employees to “stay disciplined,” according to a message reviewed by the Times.
“Do not speculate internally or externally,” the message said. “We know this is an intense moment, and we deeply appreciate everyone working overtime to make this right.”
They also tried to address the growing unease in the crypto world. Speaking in Mandarin in a video posted to X on Friday, He said that the rise of artificial intelligence had turned hacking into “a threat to the entire industry.”
“Of course, there are many things that we have done wrong,” she said. “We should have invested in security much earlier and more extensively, and established more rigorous standards.”
Word of Binance’s hack even reached Trump, who was asked about it by a reporter on Friday. “People never see the money anymore,” he said. “I’ve always felt it was a little bit dangerous. But they say they have it pretty much under control. We’ll see.”
Among the companies that rushed to Binance’s aid was the Trump family firm, World Liberty, the issuer of a coin known as USD1.
Zach Witkoff, the company’s CEO and the son of one of Trump’s top advisers, announced on X that World Liberty had frozen $27 million in USD1 that was “associated with the Binance hack”.
“We stand by our industry partners,” he wrote. “Thank you!” Zhao responded, followed by three prayer hand emojis.
This article originally appeared in The New York Times.
Source: Khaleej Times