At about 4:20 p.m. on Thursday, a string of unusual transactions started to cause alarm at Binance, the world’s largest cryptocurrency exchange.
Money was pouring out of the company’s accounts, a multibillion-dollar deluge of digital coins. It had all the hallmarks of a crypto heist — a high-speed bank robbery conducted over the internet.
As the news spread, Binance’s top executives put together an informal war room on Wea, the company’s internal messaging system, with about 100 participants, including specialized cryptocurrency tracers and security personnel.
They eventually transitioned to a mass conference call, with 100 boxes on the screen, where employees took turns muting and then unmuting, communicating in a mixture of English and Chinese. Among them was He Yi, Binance’s co-chief executive, who is seven months pregnant, and worked through the night from her base in Abu Dhabi, taking a call at 3 a.m. local time.
Ms. He and her colleagues were navigating one of the most damaging crises in Binance’s long and troubled history. A team of North Korean hackers had penetrated the exchange analysts said, and drained more than $6 billion in the largest crypto heist of all time. Binance was forced to halt deposits and withdrawals, and posted a series of frantic messages on X, promising that it would cover any losses.
It was a surreal situation made even more surreal by the actions of Binance’s founder, Changpeng Zhao, who spent the evening narrating the events to his 12.9 million followers on X. He posted prayer hand emojis, publicly jousted with the site’s owner, Elon Musk, and insisted that “user funds are SAFU” — using a bit of crypto slang to reassure customers that hundreds of millions of dollars in deposits would not simply vanish into thin air.
“It hurts, but we will survive,” Mr. Zhao declared.
The impact of the Binance attack rippled across the crypto industry, from Abu Dhabi to New York, setting off a frantic effort to salvage some of the stolen funds and prompting law enforcement inquiries. This account of how the hack unfolded is based on interviews with four people with knowledge of the events, as well as analyses by crypto forensics firms and documents reviewed by The New York Times.
For years, Binance has been the most important and contentious company in the crypto world. After Mr. Zhao founded it in 2017, it quickly turned into a behemoth, the No. 1 destination for customers looking to convert traditional currencies into digital coins like Bitcoin and Ether.
It also became a haven for crime. In 2023, Binance pleaded guilty to anti-money-laundering violations that had allowed criminals to move money and paid $4.3 billion in penalties to U.S. regulators. Mr. Zhao was sentenced to four months in prison.
For all its troubles, however, Binance never lost popularity among the crypto faithful. It remains the world’s largest exchange by a distance, and Mr. Zhao, who lives in Abu Dhabi, is something of an industry folk hero. Binance’s main platform is banned in the United States. But last year, the company forged a business relationship with World Liberty Financial, the Trump family crypto start-up. President Trump granted a pardon to Mr. Zhao last October, paving the way for Binance to expand into the U.S. market.
But on the night of Oct. 29, the company had to deal with the aftermath of the $6 billion hack.
Such attacks have become commonplace in the crypto world. In February 2025, the North Koreans stole $1.5 billion from Bybit, a rival exchange. Bybit was breached after Ben Zhou, its chief executive, approved a seemingly routine transaction that granted the thieves access to the exchange’s internal system.
It’s not clear precisely how the North Koreans got around Binance’s defenses. An initial investigation pointed to a compromised laptop, Binance said Friday. But the company later said it had uncovered “additional points of breach.”
Much of the drama played out in public. Almost all crypto transactions are recorded on the blockchain, a ledger of money movements that anyone can look up. That meant crypto analysts could see funds leaving Binance in real time.
On Thursday afternoon, Jonathan Levin, the chief executive of the crypto analytics firm Chainalysis, was on a video call with a former senior U.S. official, discussing the need for the U.S. government to deploy cyber attacks against adversaries. Then Mr. Levin got the news about Binance.
“I looked at my phone and was like, ‘Oh, this doesn’t look good,’” he said in an interview.
A group of Chainalysis employees gathered in a conference room in New York named “Silk Road,” after another crypto platform that was famously hacked. They worked until the early hours of Friday morning, eating Malaysian food and analyzing transactions to get a clearer picture of what had happened.
Soon both Chainalysis and another analytics firm, TRM Labs, attributed the attack to an elite North Korean hacking unit called TraderTraitor. North Koreans have targeted crypto companies for years, using the proceeds of those thefts to fund its nuclear program, according to Western officials.
The hackers have developed increasingly complex strategies to steal crypto and launder the proceeds, a painstaking endeavor that can take months to complete. In a blog post on Friday, Chainalysis said the attackers had deployed “laundering patterns we have not seen before,” conducting thousands of transactions over a short period, probably with the help of automation.
“The level of sophistication of these actors can’t be understated,” Mr. Levin said in the interview.
At the same time, Binance’s colleagues in the industry mobilized to intercept some of the laundered crypto. Certain digital coin issuers can freeze funds, allowing them to halt a money-laundering operation in its tracks.
Soon after the hack, Tether and Circle, two major issuers, announced that they had frozen stashes of their own coins that the hackers had seized from Binance, a combined total of more than $2 billion in crypto. Binance is now working to gain access to those funds, the company said.
But $2.4 billion in crypto is already “beyond any issuer’s reach,” according to TRM. In a social media post on Friday, Binance said that it had set aside $6.34 billion to cover losses from the hack.
How much money Binance has in reserve is not publicly known. After midnight, Mr. Musk posted a grimacing emoji underneath an X post comparing Mr. Zhao to Sam Bankman-Fried, the disgraced crypto mogul whose FTX exchange collapsed in 2022.
“Bad time to troll,” Mr. Zhao responded. “Please stop.” He noted that Binance owns over $1 billion in shares in SpaceX, Mr. Musk’s rocket company.
Mr. Zhao’s comment got the attention of Ms. He, Binance’s co-chief executive and his longtime romantic partner. (Mr. Zhao is Binance’s majority shareholder but doesn’t have a formal role at the company.)
“Our company’s revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares,” Ms. He wrote.
With the industry reeling, Ms. He and her co-chief executive, Richard Teng, told Binance employees to “stay disciplined,” according to a message reviewed by The Times.
“Do not speculate internally or externally,” the message said. “We know this is an intense moment, and we deeply appreciate everyone working overtime to make this right.”
They also tried to address the growing unease in the crypto world. Speaking in Mandarin in a video posted to X on Friday, Ms. He said that the rise of artificial intelligence had turned hacking into “a threat to the entire industry.”
“Of course, there are many things that we have done wrong,” she said. “We should have invested in security much earlier and more extensively, and established more rigorous standards.”
Word of Binance’s hack even reached Mr. Trump, who was asked about it by a reporter on Friday. “People never see the money anymore,” he said. “I’ve always felt it was a little bit dangerous. But they say they have it pretty much under control. We’ll see.”
Among the companies that rushed to Binance’s aid was the Trump family firm, World Liberty, the issuer of a coin known as USD1.
Zach Witkoff, the company’s chief executive and the son of one of Mr. Trump’s top advisers, announced on X that World Liberty had frozen $27 million in USD1 that was “associated with the Binance hack.”
“We stand by our industry partners,” he wrote.
“Thank you!” Mr. Zhao responded, followed by three prayer hand emojis.
Michael Forsythe and Dustin Volz contributed reporting.
The post How Binance’s $6.3 Billion Hack Went Down appeared first on New York Times.
