Abstract:
“No crypto wallet is 100% secure,” Binance’s Changpeng Zhao posted on the social platform In the latest and largest cyberattack to hit the industry during this "Black October", hackers hit Binance on Thursday afternoon. In just 20 minutes, they stole at least $6.3 billion.
The speed, scale and technical sophistication of this robbery sent the crypto industry into turmoil and once again raised questions about the digital asset market: whether it can deliver on its promise to become a reliable alternative to the traditional financial system or a safe place to store funds. The upward momentum that drove Bitcoin and other cryptocurrencies to record highs last year has already stalled, and successive attacks, especially the attack on Binance, may bring an even heavier blow.
“This is a very difficult time for the encryption industry.” Ari Redbord, global policy director at TRM Labs, an encryption intelligence agency, said.
For Binance and its customers, this crisis came unexpectedly, like a sudden fright in a horror movie.
Without warning
At around 11:20 pm Abu Dhabi time (where Binance’s office is located) (3:20 am the next morning Beijing time), the company’s cybersecurity team detected an intrusion—more than $1 billion in funds flowed out of the exchange out of thin air. The team immediately notified the exchange's senior management and formed a crisis management team of about 100 people. Within a few minutes, everyone was connected to the online meeting, with every executive participating.
The team could only watch in horror as funds were transferred out of Binance accounts in real time. The initial tally of stolen funds was $1 billion, which was undoubtedly a huge amount of stolen money, but it was not yet a record.
However, the amount continued to rise, rising to US$3 billion. By 4:40 pm, it doubled directly and exceeded US$6 billion.
The alarm quickly spread throughout the industry. Security agencies that monitor blockchain (digital ledger of encrypted transactions) activities also discovered abnormal transactions on Binance, and automatically pushed a large number of warning messages to customers, including many of the world's leading crypto investors.
Binance’s cyber investigators immediately collaborated with crypto tracing partners TRM Labs, Chainalysis, and Elliptic to compile a list of on-chain addresses where the stolen funds were stored.
Binance’s next step is to contact issuers of stablecoins. These stablecoins are equivalent to digital dollars and are circulated among various crypto wallets. Issuers including Tether and Circle can freeze tokens and block suspicious wallets. Their quick cooperation is the key to preventing the laundering and transfer of stolen money.
But at this time, the crypto community has noticed that Binance suddenly lost billions of dollars. At 4:32 pm New York time, an X user "Spreek" posted: "The news is not confirmed, but Binance may have suffered a huge hacker attack."
Thirteen minutes later, Zach Witkoff’s cell phone rang, and the CTO made an unsettling call. The other party also discovered that something was wrong with Binance.
Obvious attack characteristics
"This attack had all the characteristics of a typical hacker attack," Witkoff said. He co-founded the encryption company World Liberty Financial with Trump and his son before the 2024 election. After Trump took office, he pardoned Zhao Changpeng; Zhao Changpeng pleaded guilty in 2023 to violating US anti-money laundering regulations.
Witkoff noticed that the hackers who attacked Binance received funds from Tornado Cash, a currency mixing tool that is often used by criminals to conceal the source of funds. "Even a novice in blockchain analysis can tell at a glance that this is a hacker intrusion."
Binance confirmed to Witkoff that it had been compromised and provided him with a list of addresses associated with the attack. Witkoff immediately collaborated with the issuer of World Liberty Financial’s stablecoin USD1 to freeze approximately $27 million in stolen assets.
Tether and Circle, the leading stablecoin issuers, followed suit and took freezing measures.
Although many parties cooperated to intercept some funds, Binance is still racing against time to search and freeze the remaining billions of dollars in stolen funds. But they soon realized that it was too late to act.
Executives such as He Yi, co-CEO of Binance and Changpeng Zhao’s friend, were on the phone with industry partners throughout the night. He Yi, who lives in the United Arab Emirates and is seven and a half months pregnant, stayed up all night. Another co-chief executive, Richard Teng, was on duty overnight in Hong Kong.
As they continue to search for stolen funds on the blockchain, hackers are also stepping up their actions.
At 5 p.m. Eastern Time (5 a.m. Beijing time), hackers deposited stablecoins worth $60 million into the crypto lending platform Aave and used them as collateral to lend out nearly 20,000 Ethereum, which was worth about $44.6 million at the time.
Assets such as Ethereum and Bitcoin cannot be frozen. This transaction is equivalent to transferring funds beyond the control of all centralized platforms. In other words, the hacker got the money and escaped successfully.
Decentralized platforms such as Aave later shut down the lending rights of suspicious accounts, but according to TRM Labs statistics, the hackers eventually escaped with approximately $2.4 billion in crypto assets that could not be frozen.
At 5:15 pm, the condemnation of the Binance crisis on social media intensified, and the company and founder could no longer ignore it.
Security of user funds
"Binance does appear to have been attacked by hackers," Changpeng Zhao posted on X, "User funds are safe!"
He initially posted that $1.7 billion in assets had been frozen at that time. Thirty minutes later, Binance issued an official announcement on
The suspension of currency withdrawals triggered a new round of panic on social platforms. Many X users commented that this scene was reminiscent of the FTX crash - the crypto exchange founded by Sam Bankman-Fried urgently suspended currency withdrawals on the eve of the crash. That night, Binance repeatedly emphasized the safety of all users’ funds.
At 10:25 pm (10:25 am Beijing time), Binance said it had frozen US$3 billion in related funds and still characterized the incident as a "security incident." The company's preliminary investigation revealed that an operation and maintenance engineer's laptop was compromised, and the attacker used it to illegally withdraw coins. (Binance subsequently stated that other company infrastructure may also have been compromised.)
Binance also announced for the first time its estimated total loss: $6.3 billion.
At 10:30 p.m., the media reported that this attack was related to the hacker organization TraderTraitor, citing the investigation results of network security agencies TRM Labs and Pangolin Intelligence. The organization has planned many large-scale cryptocurrency attacks, including the $1.5 billion theft of ByBit in 2025, which was previously the largest hacking incident in encryption history.
Musk, now is not the time
The billionaire’s troubles are not over yet, he received an interaction from Elon Musk.
Under Zhao Changpeng's post of appeasing users and promising compensation, an X user attached a screenshot of a similar statement made by Bankman-Fried, a former rival of Zhao Changpeng and a notorious encryption practitioner. Musk responded with a frowning emoji.
Five hours later, Zhao Changpeng responded.
"Elon, I have a lot of respect for you, but this is not the time for jokes," he wrote. "Please don't."
Related articles:
Bitcoin price fell below $77,000 for the first time in a month, and the Binance incident made the currency circle even worse
Comments