Over sleepless nights, Binance fought to contain hack
The biggest crypto hack in history began with a rehearsal.
asserted
hack → fight → rehearsal
As trading hummed along on Binance at midweek, hackers were quietly running sequences of code on accounts they controlled on the Ethereum blockchain – just a couple dollars or so at a time.
asserted
they → hum → time
According to cybersecurity analysts, they were testing a program designed to seize control of accounts owned by the world’s largest crypto exchange and smuggle their contents elsewhere.
uncertain
they → accord → contents
Just after 4pm New York time on Oct 29, they attacked.
asserted
they → attack → Oct
In short order, the infiltrators drained more than US$6 billion from wallets across at least four different blockchains, setting off a worldwide effort to contain the damage.
asserted
infiltrators → drain → damage
From New York to Abu Dhabi to Kyiv, security researchers and Binance executives scrambled to trace the stolen money, freeze accounts and understand how the attackers had breached the exchange and pulled off a heist that has shaken confidence in the crypto industry as it tries to earn greater acceptance in finance’s mainstream.
“It’s the largest bank robbery in human history,” said Ari Redbord, global head of policy and government affairs at TRM Labs, a blockchain analytics firm.
asserted
Redbord → scramble → Labs
Redbord’s firm was one of several that mobilised after the attack started.
asserted
attack → mobilise → several
“I literally haven’t slept and I haven’t stopped.
asserted
I → sleep → ?
As Binance publicly said it could easily reimburse any losses from the hack on Oct 30, employees were privately expressing doubts to one another that they would be paid bonuses this year, said people familiar with the matter.
uncertain
people → say → matter
Only a month ago, cryptocurrency exchange Bitget was subject to a cyber-attack that drained US$388 million.
asserted
that → drain → million
In February 2025, hackers stole nearly US$1.5 billion from cryptocurrency exchange Bybit.
asserted
hackers → steal → Bybit
But the scale of last week’s attack shocked even industry veterans.
asserted
scale → shock → veterans
Just as the exploit was unleashed, Taylor Monahan, who is based in Los Angeles as a researcher at the non-profit security firm SEAL, was on a group chat with other crypto investigators when someone at blockchain security firm zeroShadow sent a message about strange transactions at Binance.
asserted
someone → unleash → Binance
“I’m going to remain optimistic that everything’s fine,” Monahan told herself.
asserted
Monahan → go → herself
But she knew that if things were not OK, they were very bad.
asserted
they → know → ?
“It’s like a hack – like, a really big one.”
asserted
It → ’ → hack
By 4:38pm, Monahan suspected the worst and contacted Tether, the firm that issues the USDT dollar-backed stablecoin.
asserted
that → suspect → stablecoin
“In our souls, we knew it was a hack,” she said.
asserted
she → know → souls
Tether responded immediately but did not acknowledge that there was an infiltration.
asserted
Tether → respond → ?
Less than 30 minutes later, the firm began the process of freezing the transactions on its blockchain, as did Circle, issuer of the USDC stablecoin.
asserted
Circle → begin → stablecoin
Scrolling X
Yi He, Binance’s co-founder and co-chief executive officer, was at home in Abu Dhabi when she first noticed something wrong.
asserted
she → scroll → something
The executive, who is well along into a pregnancy, had logged off work and was scrolling through X before going to bed around 12:30am in Abu Dhabi (4:30pm in New York).
asserted
who → log → York
Posts on the social media site alerted her to trouble.
asserted
Posts → alert → trouble
Alarmed, she logged back on and saw that Binance’s security and wallet teams – which are empowered to act on hacks without executive sign-off – were already at work, trying to stop more losses.
asserted
which → alarm → losses
Within minutes, the company created a war room that swelled to about 100 people around the world.
asserted
that → create → world
Yi and hundreds of Binance employees would stay up through the night, coordinating efforts within the company, with other crypto firms and with law-enforcement agencies including the Federal Bureau of Investigation and the US Secret Service.
asserted
Yi → stay → Investigation
At 5:15pm, Binance publicly acknowledged it was aware of a “potential security issue” and that it was investigating the rumoured breach.
asserted
it → acknowledge → breach
At 5:18pm, Circle CEO Jeremy Allaire announced that the stablecoin company had frozen more than US$800 million associated with a “potential exploit involving Binance”.
asserted
company → announce → Binance
Seven minutes later, Tether CEO Paolo Ardoino announced that his firm had frozen more than US$1.5 billion “related to a potential Binance exchange hack”.
asserted
firm → announce → hack
Soon, crypto companies of every stripe started flooding social media to promise onlookers that they were safe.
asserted
they → start → onlookers
Binance competitors like Kraken, Coinbase, and Bybit all proclaimed that they were unharmed.
asserted
they → proclaim → Kraken
Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have all said North Korea is behind the heist.
asserted
Korea → say → heist
They observed funds stolen from Binance commingle with crypto seized in the Bitget hack, which researchers had already attributed to the Democratic People’s Republic of Korea.
asserted
researchers → observe → Korea
Chainalysis labelled the incident as “the largest in the history of crypto, and one of the single-largest financial crimes of all time”.
asserted
Chainalysis → label → time
Still, even as the heist became more widely publicised, hackers continued to drain funds from Binance.
asserted
hackers → publicise → Binance
The code attackers used gave them access to blockchain accounts owned by Binance and let the hackers empty them, all while exchange funds kept replenishing the accounts.
asserted
funds → use → accounts
Estimates of the amount stolen crept higher, eventually reaching US$6.3 billion.
Mainstream crypto
The attack comes at an inopportune time for an industry that is getting unprecedented support from the US government.
asserted
that → steal → government
The Trump administration has been pushing for mainstream adoption of cryptocurrencies and blockchain technology, including through its regulators.
asserted
administration → push → regulators
In September, the Securities and Exchange Commission approved a rule that allows for public company stocks to trade on blockchains.
asserted
stocks → approve → blockchains
The Binance hack could undermine those efforts, experts fear.
uncertain
experts → undermine → efforts
…and 19 more, not listed.
The Aporia
