The biggest crypto hack in history began with a rehearsal.
asserted
hack → begin → rehearsal
As trading hummed along on Binance, hackers were quietly running sequences of code on accounts they controlled on the Ethereum blockchain — just a couple of dollars or so at a time.
asserted
they → hum → time
According to cybersecurity analysts, they were testing a program designed to seize control of accounts owned by the world’s largest crypto exchange and smuggle their contents elsewhere.
uncertain
they → accord → contents
Just after 4pm (New York time) on Thursday, they attacked.
asserted
they → attack → Thursday
In short order, the infiltrators drained more than $US6 billion ($8.9 billion) from wallets across at least four different blockchains, setting off a worldwide effort to contain the damage.
asserted
infiltrators → drain → damage
From New York to Abu Dhabi and Kyiv, security researchers and Binance executives scrambled to trace the stolen money, freeze accounts and understand how the attackers had breached the exchange and pulled off a heist that has shaken confidence in the crypto industry as it tries to earn greater acceptance in finance’s mainstream.
asserted
it → scramble → mainstream
“It’s the largest bank robbery in human history,” said Ari Redbord, global head of policy and government affairs at TRM Labs, a blockchain analytics firm.
asserted
Redbord → ’ → Labs
Redbord’s firm was one of several that mobilised after the attack started.
asserted
attack → mobilise → several
“I literally haven’t slept and I haven’t stopped.”
asserted
I → sleep → ?
As Binance publicly said it could easily reimburse any losses from the hack on Friday, employees were privately expressing doubts to one another that they’d be paid bonuses this year, according to people familiar with the matter.
uncertain
they → say → matter
Only a month ago, cryptocurrency exchange Bitget was subject to a cyberattack that drained $US388 million.
asserted
that → drain → million
In February 2025, hackers stole nearly $US1.5 billion from cryptocurrency exchange Bybit.
asserted
hackers → steal → Bybit
But the scale of this week’s attack shocked even industry veterans.
asserted
scale → shock → veterans
Just as the exploit was unleashed, Taylor Monahan, who’s based in Los Angeles as a researcher at the non-profit security firm, SEAL, was on a group chat with other crypto investigators when someone at blockchain security firm zeroShadow sent a message about strange transactions at Binance.
asserted
someone → unleash → Binance
“I’m going to remain optimistic that everything’s fine,” Monahan told herself.
asserted
Monahan → go → herself
But she knew that if things weren’t OK, they were very bad.
asserted
they → know → ?
“It’s like a hack — like, a really big one.”
asserted
It → ’ → hack
By 4.38pm, Monahan suspected the worst and contacted Tether, the firm that issues the USDT dollar-backed stablecoin.
asserted
that → suspect → stablecoin
“In our souls, we knew it was a hack,” she said.
asserted
she → know → souls
Tether responded immediately but didn’t acknowledge that there was an infiltration.
asserted
Tether → respond → ?
Less than 30 minutes later, the firm began the process of freezing the transactions on its blockchain, as did Circle, issuer of the USDC stablecoin.
asserted
Circle → begin → stablecoin
Scrolling X
Yi He, Binance’s co-founder and co-chief executive officer, was at home in Abu Dhabi when she first noticed something wrong.
asserted
she → scroll → something
The executive had logged off work and was scrolling through X before going to bed about 12.30am in Abu Dhabi (4.30pm in New York).
asserted
executive → log → York
Posts on the social media site alerted her to trouble.
asserted
Posts → alert → trouble
Alarmed, she logged back on and saw that Binance’s security and wallet teams – which are empowered to act on hacks without executive sign off – were already at work, trying to stop more losses.
asserted
which → log → losses
Within minutes, the company created a war room that swelled to about 100 people around the world.
asserted
that → create → world
Yi and hundreds of Binance employees would stay up through the night, co-ordinating efforts within the company and with other crypto firms and law-enforcement agencies including the Federal Bureau of Investigation and the US Secret Service.
asserted
Yi → stay → Investigation
At 5.15pm (New York time), Binance publicly acknowledged it was aware of a “potential security issue” and that it was investigating the rumoured breach.
asserted
it → acknowledge → breach
At 5.18pm, Circle chief executive Jeremy Allaire announced the stablecoin company had frozen more than $US800 million associated with a “potential exploit involving Binance”.
asserted
company → announce → Binance
Seven minutes later, Tether CEO Paolo Ardoino announced that his firm had frozen more than $US1.5 billion “related to a potential Binance exchange hack”.
asserted
firm → announce → hack
Soon, crypto companies of every stripe started flooding social media to promise onlookers that they were safe.
asserted
they → start → onlookers
Binance competitors, including Kraken, Coinbase and Bybit, proclaimed they were unharmed.
asserted
they → include → Kraken
Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have all said North Korea is behind the heist.
asserted
Korea → say → heist
They observed funds stolen from Binance commingle with crypto seized in the Bitget hack, which researchers had already attributed to the Democratic People’s Republic of Korea.
asserted
researchers → observe → Korea
At the weekend, the FBI also blamed North Korea for the hack.
asserted
FBI → blame → hack
Chainalysis labelled the hack as “the largest in the history of crypto, and one of the single-largest financial crimes of all time”.
asserted
Chainalysis → label → time
Still, even as the heist became more widely publicised, hackers continued to drain funds from Binance.
asserted
hackers → publicise → Binance
The code attackers used gave them access to blockchain accounts owned by Binance and let the hackers empty them, all while exchange funds kept replenishing the accounts.
asserted
funds → use → accounts
Estimates of the amount stolen crept higher, eventually reaching $US6.3 billion.
asserted
Estimates → steal → billion
The attack comes at an inopportune time for an industry that is getting unprecedented support from the US government.
asserted
that → come → government
…and 24 more, not listed.
The Aporia
