The largest cryptocurrency heist in history began with a sequence of small-scale tests. Cybersecurity analysts report that hackers quietly executed code on Ethereum accounts they controlled, moving just a couple of dollars at a time to test a program designed to seize control of wallets and drain their contents. Just after 4 p.m. New York time on Thursday, the attackers struck the world’s largest cryptocurrency exchange, draining more than $6 billion from wallets across at least four different blockchains.
The breach triggered an immediate global response. Security researchers, law enforcement agencies, and Binance executives scrambled across New York, Abu Dhabi, and Kyiv to trace stolen funds, freeze accounts, and investigate the methodology behind the unprecedented attack. Ari Redbord, global head of policy and government affairs at blockchain analytics firm TRM Labs, described the event as “the largest bank robbery in human history,” adding that he had neither slept nor stopped working since the breach began.
The alarm spread quickly through investigator networks. Taylor Monahan, a researcher at the nonprofit security firm SEAL based in Los Angeles, was participating in a group chat when a member from zeroShadow flagged unusual transactions on Binance. By 4:38 p.m., Monahan contacted Tether, the issuer of the USDT dollar-backed stablecoin. Tether responded immediately and began the process of freezing transactions on its blockchain, a step mirrored shortly after by Circle, the issuer of the USDC stablecoin.
Simultaneously, Yi He, Binance’s co-founder and co-chief executive officer, noticed suspicious activity while scrolling through X at her home in Abu Dhabi around 12:30 a.m. local time, which was 4:30 p.m. in New York. Discovering that Binance’s security and wallet teams were already attempting to halt losses, the company established a war room that rapidly grew to about 100 personnel worldwide. The operation coordinated efforts internally alongside other crypto companies and law enforcement agencies, including the Federal Bureau of Investigation and the U.S. Secret Service.
Publicly, Binance acknowledged a potential security issue at 5:15 p.m. Moments later, Circle CEO Jeremy Allaire announced that his firm had frozen more than $800 million tied to the exploit, followed quickly by Tether CEO Paolo Ardoino disclosing that his company had frozen over $1.5 billion. Competitor exchanges, including Kraken, Coinbase, and Bybit, issued statements assuring users of their safety.
Blockchain intelligence firms including TRM Labs, Chainalysis, and Elliptic attributed the heist to North Korea, noting that stolen funds commingled with crypto seized during a previous cyber-attack on Bitget in September 2025 that researchers had also linked to the Democratic People’s Republic of Korea. Chainalysis characterized the incident as the largest in crypto history and one of the single-largest financial crimes ever recorded. Despite containment efforts, attackers continued draining funds as exchange reserves replenished connected wallets, pushing total estimates to $6.3 billion.
The breach arrives at a sensitive juncture for the digital asset sector, which has recently received strong regulatory and administrative support in the United States, including a September SEC rule allowing public company stocks to trade on blockchains. Odysseas Lamtzidis, founder of blockchain security firm Phylax Systems, witnessed the attack while traveling on a flight and warned that such vulnerabilities threaten broader institutional adoption, noting the industry still resembles the “Wild West.”
Addressing the potential reputational damage in a video posted on X alongside co-CEO Richard Teng, Yi vowed that Binance would continue cooperating with law enforcement and reimburse all affected users. Speaking in Mandarin, she acknowledged security shortcomings and pledged increased investment in defenses. A company spokesperson also dismissed private employee concerns regarding annual bonuses.
Amid the turmoil, some market participants capitalized on the volatility. Morten Christensen, a cryptocurrency trader operating AirdropAlert.com from Mexico, coordinated short positions with six peers on a Discord call, generating tens of thousands of dollars as cryptocurrency values dropped in the wake of the breach.
