Inside the scramble to contain the largest crypto heist in history

Ben Weiss, Muyao Shen and Olga Kharif

November 1, 2026 — 12:29pm

The biggest crypto hack in history began with a rehearsal.

As trading hummed along on Binance, hackers were quietly running sequences of code on accounts they controlled on the Ethereum blockchain — just a couple of dollars or so at a time. According to cybersecurity analysts, they were testing a program designed to seize control of accounts owned by the world’s largest crypto exchange and smuggle their contents elsewhere.

Just after 4pm (New York time) on Thursday, they attacked.

In short order, the infiltrators drained more than $US6 billion ($8.9 billion) from wallets across at least four different blockchains, setting off a worldwide effort to contain the damage.

From New York to Abu Dhabi and Kyiv, security researchers and Binance executives scrambled to trace the stolen money, freeze accounts and understand how the attackers had breached the exchange and pulled off a heist that has shaken confidence in the crypto industry as it tries to earn greater acceptance in finance’s mainstream.

“It’s the largest bank robbery in human history,” said Ari Redbord, global head of policy and government affairs at TRM Labs, a blockchain analytics firm.

Redbord’s firm was one of several that mobilised after the attack started. “I literally haven’t slept and I haven’t stopped.”

As Binance publicly said it could easily reimburse any losses from the hack on Friday, employees were privately expressing doubts to one another that they’d be paid bonuses this year, according to people familiar with the matter.

The crypto industry is no stranger to malevolent actors. Only a month ago, cryptocurrency exchange Bitget was subject to a cyberattack that drained $US388 million. In February 2025, hackers stole nearly $US1.5 billion from cryptocurrency exchange Bybit. But the scale of this week’s attack shocked even industry veterans.

Just as the exploit was unleashed, Taylor Monahan, who’s based in Los Angeles as a researcher at the non-profit security firm, SEAL, was on a group chat with other crypto investigators when someone at blockchain security firm zeroShadow sent a message about strange transactions at Binance.

“I’m going to remain optimistic that everything’s fine,” Monahan told herself. But she knew that if things weren’t OK, they were very bad. “It’s like a hack — like, a really big one.”

By 4.38pm, Monahan suspected the worst and contacted Tether, the firm that issues the USDT dollar-backed stablecoin. “In our souls, we knew it was a hack,” she said. Tether responded immediately but didn’t acknowledge that there was an infiltration. Less than 30 minutes later, the firm began the process of freezing the transactions on its blockchain, as did Circle, issuer of the USDC stablecoin.

Scrolling X

Yi He, Binance’s co-founder and co-chief executive officer, was at home in Abu Dhabi when she first noticed something wrong.

The executive had logged off work and was scrolling through X before going to bed about 12.30am in Abu Dhabi (4.30pm in New York). Posts on the social media site alerted her to trouble.

Alarmed, she logged back on and saw that Binance’s security and wallet teams – which are empowered to act on hacks without executive sign off – were already at work, trying to stop more losses. Within minutes, the company created a war room that swelled to about 100 people around the world. Yi and hundreds of Binance employees would stay up through the night, co-ordinating efforts within the company and with other crypto firms and law-enforcement agencies including the Federal Bureau of Investigation and the US Secret Service.

At 5.15pm (New York time), Binance publicly acknowledged it was aware of a “potential security issue” and that it was investigating the rumoured breach.

At 5.18pm, Circle chief executive Jeremy Allaire announced the stablecoin company had frozen more than $US800 million associated with a “potential exploit involving Binance”. Seven minutes later, Tether CEO Paolo Ardoino announced that his firm had frozen more than $US1.5 billion “related to a potential Binance exchange hack”.

Soon, crypto companies of every stripe started flooding social media to promise onlookers that they were safe. Binance competitors, including Kraken, Coinbase and Bybit, proclaimed they were unharmed.

Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic have all said North Korea is behind the heist. They observed funds stolen from Binance commingle with crypto seized in the Bitget hack, which researchers had already attributed to the Democratic People’s Republic of Korea.

At the weekend, the FBI also blamed North Korea for the hack.

Chainalysis labelled the hack as “the largest in the history of crypto, and one of the single-largest financial crimes of all time”.

Still, even as the heist became more widely publicised, hackers continued to drain funds from Binance. The code attackers used gave them access to blockchain accounts owned by Binance and let the hackers empty them, all while exchange funds kept replenishing the accounts. Estimates of the amount stolen crept higher, eventually reaching $US6.3 billion.

Mainstream crypto

The attack comes at an inopportune time for an industry that is getting unprecedented support from the US government. The Trump administration has been pushing for mainstream adoption of cryptocurrencies and blockchain technology, including through its regulators. In September, the Securities and Exchange Commission approved a rule that allows for public company stocks to trade on blockchains. The Binance hack could undermine those efforts, experts fear.

Odysseas Lamtzidis, founder of blockchain security company Phylax Systems, was on a plane travelling to Miami from New York when he saw a Telegram chat discussing the attack. “It was very scary. I remember breathing heavy because it was huge amounts of capital moving around, and people on the plane were asking if I was OK,” he said.

‘It’s still a Wild West.’

Odysseas Lamtzidis, founder of Phylax Systems,

He watched as the attackers moved from one wallet to the next, and kept posting on X to alert users.

“I think this is very scary for organisations and adoption of crypto because these types of events should be impossible to happen, not improbable,” he said. “It’s still a Wild West.”

Yi and her co-chief executive, Richard Teng, on Friday confronted the potential reputational damage the attack could do. In a video posted on X, Yi promised Binance would continue to work with law enforcement to find the attackers. The company has vowed to reimburse any users who lost funds in the hack.

“We won’t let the hackers take away the momentum this industry deserves,” she said in her video post, speaking in Mandarin. “Of course, there are areas where we could have done better. We should have invested more in security earlier, and set stricter standards. Going forward, we won’t hold back, whether it’s investing in security or fighting hackers.”

On Saturday, the company said it had restored 90 per cent of the tokens which hackers had stolen, pledging to reinstate customers’ ability to withdraw funds the following day.

Asked about employees’ bonus concerns, a spokesperson said Binance didn’t expect any impact there either.

In the midst of the turmoil, some traders found opportunity.

Morten Christensen, a cryptocurrency trader who also runs AirdropAlert.com, a site that tracks cryptocurrency giveaways, made tens of thousands of dollars on Thursday. He was in Mexico, on a Discord call with six friends, brainstorming strategies to take advantage of the hack. They had decided to short cryptocurrencies, which were starting to drop in value when his wife walked into his office. He sent her back out. “Binance got hacked, babe,” he said. “Need to lock in.”

With assistance from Ryan Weeks and Teresa Xie

Bloomberg

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.

More:

• Cryptocurrencies
• World markets
• Fintech
• Cybersecurity

From our partners