The world’s largest cryptocurrency exchange, Binance, was thrown into crisis on Thursday, 29 October, after a series of suspicious transactions triggered an unprecedented outflow of digital assets worth more than $6 billion. What initially appeared to be a possible security breach soon escalated into one of the biggest cryptocurrency thefts on record.
According to The New York Times (NYT) news report, Binance executives scrambled to contain the damage as funds moved out of the exchange’s accounts. The company halted deposits and withdrawals, mobilised security teams and cryptocurrency tracking specialists, and assured customers that it would absorb any losses.
The attack was later attributed by blockchain analytics firms Chainalysis and TRM Labs to TraderTraitor, an elite North Korean hacking group. The FBI also confirmed the findings, according to NYT news report.
The incident has once again raised questions about the security of major cryptocurrency platforms, particularly as hackers become more sophisticated in exploiting vulnerabilities and moving stolen digital assets across the blockchain.
Binance executives scramble to contain the breach
The first signs of trouble emerged at around 4:20 PM on Thursday, 29 October, when unusually large transactions began draining funds from Binance-linked accounts.
As concerns mounted, the company’s senior executives assembled an emergency response team through its internal messaging platform, Wea. Around 100 employees, including security specialists and cryptocurrency tracing experts, joined the effort before the discussions moved to a large conference call.
Among those coordinating the response was Binance co-chief executive He Yi, who was in Abu Dhabi. Despite being seven months pregnant, she remained involved through the night, including during a call at around 3 AM local time, NYT reported.
The exchange also turned to its social media channels to reassure customers. Binance founder Changpeng Zhao, meanwhile, provided updates to his millions of followers on X, using the platform to address concerns and insist that customer deposits were safe.
Zhao acknowledged the severity of the situation but expressed confidence that the company would weather the crisis. Binance also pledged to cover losses arising from the breach, according to NYT news report.
North Korean hacking group linked to the attack
The precise method used by the attackers to penetrate Binance’s systems remains unclear, according to NYT news report.
The exchange initially pointed to a compromised laptop as a possible entry point, but later said its investigation had identified additional points of breach.
The scale of the outflows became visible almost immediately because cryptocurrency transactions are recorded on public blockchains. This allowed analysts and blockchain intelligence firms to follow the movement of funds as the incident unfolded.
Chainalysis chief executive Jonathan Levin was among those who noticed the unusual activity. According to NYT, Levin was on a video call with a former senior US official when he received news of the suspected breach.
Teams at Chainalysis and TRM Labs subsequently began tracing the transactions. Their investigations linked the attack to TraderTraitor, a North Korean hacking unit associated with several major cryptocurrency thefts.
North Korean cybercriminal groups have repeatedly targeted cryptocurrency businesses, with Western officials alleging that the proceeds help fund the country’s nuclear and weapons programmes.
The latest incident follows the February 2025 attack on rival exchange Bybit, in which hackers stole around $1.5 billion. That breach was reportedly enabled after a routine transaction approval gave attackers access to the exchange’s internal systems.
Crypto firms move to freeze stolen funds
As the stolen assets moved across the blockchain, other players in the cryptocurrency industry stepped in to help limit the damage.
Stablecoin issuers Tether and Circle announced that they had frozen holdings of their respective digital currencies linked to the attack. The combined value of the frozen assets was more than $2 billion, according to NYT news report.
The move offered Binance a potential route to recover a portion of the stolen funds. However, not all the assets could be intercepted.
Blockchain intelligence firm TRM Labs estimated that around $2.4 billion in cryptocurrency had already moved beyond the reach of issuers who could freeze their tokens.
Chainalysis also flagged the sophistication of the laundering operation. In a blog post, the firm said the attackers had used transaction patterns it had not previously encountered, with thousands of transfers taking place in a short period. The activity suggested that automation may have played a role in moving the funds.
Binance later said it had set aside $6.34 billion to cover losses connected with the incident.
Zhao’s public exchanges with Elon Musk draw attention
While Binance’s security teams worked to track the stolen assets, Zhao’s activity on X added another dimension to the unfolding crisis.
The exchange’s founder posted updates and interacted with users as concerns spread across the crypto community. At one point, he responded to a post comparing him with Sam Bankman-Fried, the former FTX chief whose exchange collapsed in 2022.
Elon Musk also joined the online discussion, prompting Zhao to ask him to stop the public jibes at a time when Binance was dealing with the fallout of the attack.
Zhao pointed out that Binance held more than $1 billion worth of shares in Musk’s SpaceX. He Yi subsequently said the company did not need to sell those holdings to meet the losses, adding that Binance’s annual revenue was sufficient to absorb the financial hit.
Zhao remains Binance’s majority shareholder, although he does not hold a formal executive position at the exchange. He Yi and Richard Teng serve as the company’s co-chief executives.
Binance acknowledges gaps in its security preparedness
The breach has renewed scrutiny of Binance’s risk controls and security investments, particularly given the company’s dominant position in the global cryptocurrency market.
In an internal message reviewed by NYT, He Yi and Teng urged employees to remain disciplined and avoid speculation about the incident. They also acknowledged the pressure on staff working to contain the breach.
In a video posted on X on Friday, He Yi said the rapid development of artificial intelligence had made cyberattacks a growing threat to the entire cryptocurrency industry.
She also acknowledged that Binance had not invested sufficiently in security in the past and needed stronger safeguards and more rigorous standards, according to NYT report.
Her comments underline a wider concern for cryptocurrency businesses: as digital asset markets expand, security systems must keep pace with increasingly sophisticated attacks.
Trump-linked crypto firm freezes $27 million
The incident also drew attention from the White House, with US President Donald Trump asked about the breach by reporters on Friday. Trump described cryptocurrency as potentially dangerous but said he had been told the situation was largely under control, , according to NYT report.
Among the companies that responded to Binance’s request for assistance was World Liberty Financial, the cryptocurrency venture associated with the Trump family.
Zach Witkoff, the company’s chief executive and son of a senior Trump adviser, said on X that World Liberty had frozen $27 million worth of its USD1 stablecoin linked to the Binance attack.
The move added to the broader industry effort to prevent the stolen funds from being moved or converted.
A fresh test for the world’s largest crypto exchange
Founded by Zhao in 2017, Binance rapidly grew into the world’s largest cryptocurrency exchange, becoming a major gateway for investors seeking to trade Bitcoin, Ether and other digital assets.
Its growth, however, has been accompanied by regulatory and compliance challenges. In 2023, Binance pleaded guilty to anti-money-laundering violations in the United States and agreed to pay $4.3 billion in penalties. Zhao was sentenced to four months in prison.
Despite those setbacks, the exchange has retained a substantial global user base. Its business ties with World Liberty Financial and the pardon granted to Zhao by Trump last October have also brought renewed attention to its prospects in the US market, according to NYT report.
The latest breach could prove another significant test. While Binance has pledged to cover the losses and industry partners have managed to freeze some of the assets, the incident highlights the risks facing even the largest players in the digital asset ecosystem.
The investigation into how the hackers gained access to Binance’s systems is continuing, while the effort to trace and recover the remaining funds remains a priority, , according to NYT report.
Disclaimer: This story is for educational purposes only. The views and recommendations above are those of individual analysts or broking companies, not Mint. We advise investors to check with certified experts before making any investment decisions.
About The Author
