Behind the scenes of crypto's biggest nightmare: a record-breaking cyber heist

Summary

Binance's founder Changpeng Zhao had warned a week earlier that "No crypto wallet is 100% safe." In 20 minutes, hackers had made off with $6.4 billion.

Last week, the founder of the world's largest crypto exchange delivered a chilling warning that read more like a tagline to a horror movie than a reminder to be vigilant on cybersecurity.

"No crypto wallet is 100% safe," Binance's Changpeng Zhao wrote on X, the social-media platform. "No tech is 100% secure."

Binance's own users were soon caught in a whirlwind of recent software hacks, widespread panic and bitter recriminations. In the latest, and biggest, cyberattack that has buffeted the world this "Black October," North Korean hackers ransacked Binance on Thursday afternoon. In 20 minutes, they had made off with $6.4 billion.

The speed, scale and sophistication of the heist has left the crypto industry reeling, and renewed questions about the digital-asset markets and whether they will ever fulfill their promise as a viable alternative to the traditional financial system or even a safe place to store money. The momentum that had lifted bitcoin and other cryptocurrencies to record highs last year had already stalled. But the recent spate of attacks, punctuated by Binance's hit, threatens to deal a more serious blow.

"It's a really tough moment for the crypto industry," said Ari Redbord, global head of policy at crypto intelligence firm TRM Labs.

And for Binance and its customers, the moment arrived like a jump scare.

No warning

Around 11:20 p.m. in Abu Dhabi, home to Binance offices (4:20 p.m. in New York), the company's cybersecurity team detected a breach -- more than $1 billion had been siphoned from the exchange, seemingly out of the blue. The group alerted the exchange's top executives, who convened a crisis team of some 100 employees. Within minutes, the staff were on a conference call. Every single senior executive had signed on.

The team could only watch in horror as money streamed out of Binance's accounts, in real time. An initial tally of the stolen funds placed it at $1 billion; a massive heist, to be sure, but not a record.

But the figure kept rising -- and rising. It reached $3 billion, then by 4:40 p.m., doubled to more than $6 billion.

Alarm bells soon began to sound across the industry. Security firms that monitor activity on blockchains, the digital ledgers where crypto transactions are recorded, had also spotted the anomaly at Binance. Those firms' automatic alerts began to flood the offices of their clients, many of the world's biggest crypto investors.

The company's cyber investigators began to work with their own partners that specialize in tracing cryptocurrency -- TRM Labs, Chainalysis and Elliptic -- to compile a list of digital addresses containing the pilfered funds.

Binance's next move was to reach out to the issuers of the stablecoins that function as digital dollars that move between crypto wallets. Because these firms, including Tether and Circle, can freeze their coins in place and blacklist suspicious wallets, their rapid cooperation can be the key to stemming the flow of stolen money before it can be laundered.

By then, though, the wider crypto world began to notice Binance was suddenly missing billions of dollars. "Unconfirmed, but possibly massive binance hack," one X user with the handle "Spreek" wrote at 4:32 p.m. New York time.

Thirteen minutes later, Zach Witkoff's mobile phone buzzed a disturbing call from his chief technology officer: He, too, had spotted something wrong at Binance.

Hallmarks of a Hack

"This had all the hallmarks of a hack," said Witkoff, who founded World Liberty Financial, a crypto firm, with President Trump and his sons in the lead up to the 2024 election. After taking office, Trump pardoned Zhao, who pleaded guilty in 2023 to violating U.S. anti-money-laundering requirements.

Witkoff noticed that Binance's hackers had received funds from Tornado Cash -- a "mixer" program often used by bad actors to obfuscate the source of their funds. "This was so obviously a hack that someone who is a novice in blockchain analytics would know."

Binance confirmed to Witkoff that it had suffered a breach and gave him a list of hack-linked addresses. Witkoff worked with the company that issues USD1, World Liberty Financial's stablecoin, to freeze some $27 million in stolen assets.

Tether and Circle, the largest stablecoin companies, soon followed suit.

While their cooperation helped stop some funds from escaping, Binance was still in a race to find and then freeze billions more. They would soon learn they didn't get there fast enough.

The company's top executives, including Yi He, Binance's co-CEO and Zhao's romantic partner, had spent the evening and early-morning hours on the phone calls with industry partners. Yi, who is based in the U.A.E. and seven in a half months pregnant, didn't sleep the entire night. Richard Teng, Yi's co-CEO, stayed up all night in Hong Kong.

But as they continued to scour the blockchains for missing funds, the hackers had been busy, too.

At 5 p.m. ET, the hackers placed $60 million worth of stablecoins into a crypto-lending platform called Aave. The coins served as collateral the hackers used to borrow almost 20,000 ether, worth about $44.6 million at the time.

Ether and other assets like bitcoin can't be frozen, so the transaction essentially moved the money beyond the outer limits of any centralized platform's control. Meaning, the hackers were home free.

Decentralized platforms like Aave eventually shut down loans to those suspicious accounts, but the hackers ultimately escaped with some $2.4 billion in un-freezable crypto assets, according to TRM.

By 5:15 p.m., the social-media outcry on Binance's crisis had grown too loud for the company and its founder to ignore.

Funds are safe

"It does look like a hack on Binance," Zhao wrote on X. "User funds are safe!"

In his initial X post, Zhao said $1.7 billion had been frozen so far. Thirty minutes later, Binance delivered its own statement on the incident, writing on X that it was aware of "a potential security issue" and would be pausing all withdrawals until it was resolved.

The withdrawal pause sparked a new wave of panic on social media -- with some on X remarking that it reminded them of the collapse of FTX, Sam Bankman-Fried's crypto exchange, which famously paused withdrawals ahead of its precipitous collapse. Throughout the evening, Binance insisted that all user funds were safe.

At 10:25 p.m., Binance said $3 billion had been frozen in connection to what it had continued referring to as a "security incident." The company said an initial investigation indicated that a DevOps engineer's laptop had been compromised, allowing an attacker to make unauthorized withdrawals from Binance. (The company said later that other company infrastructure may have been compromised as well).

The company also gave its first official estimate of the total monetary impact: $6.3 billion.

At 10:30 p.m., The Wall Street Journal reported findings from cybersecurity research firms TRM Labs and Pangolin Intelligence that the attack was linked to North Korea's state-sponsored TraderTraitor hacking unit. The same group has been behind many of the largest crypto attacks, including the $1.5 billion ByBit attack in 2025, previously the largest hack in crypto history.

Not now, Elon

Crypto has long been a favored target of sophisticated hackers, but the pace and severity has worsened this year. Suspected North Korea-linked hackers were responsible for nearly 89% of reported crypto hack losses so far this year, according to Chainalysis.

In an earlier exchange on X, a user argued the losses represented just 0.69% of Binance's total assets. "Loss might be a bit higher than that, but will cover," Zhao replied.

Then, as if the billionaire's night weren't bad enough, he heard from Elon Musk.

An X user had replied to a post from Zhao reassuring users that Binance would cover user losses with a screenshot of a similar statement from Bankman-Fried, the infamous entrepreneur and once Zhao's rival. Musk responded with a grimace emoji.

Five hours later, Zhao responded.

"Elon, have a lot of respect for you, but bad time to troll," he wrote. "Please stop."