Binance loses $6B in 20 minutes as 100 executives watch helplessly

About 100 Binance executives and employees joined an emergency video call moments after the exchange's security team detected unauthorized withdrawals and alerted management. But even as the meeting began, assets were draining from accounts in real time. What started as $1 billion in losses surpassed $6 billion in just 20 minutes. The crisis team at the world's largest virtual asset exchange could only watch the theft unfold, the Wall Street Journal reported.

The breach was first detected at 4:20 p.m. Thursday Eastern time (local time) — 11:20 p.m. in Abu Dhabi — when the exchange's security team in Abu Dhabi confirmed that more than $1 billion in assets had already been withdrawn without authorization. Management was notified, an emergency video conference was convened, and senior executives joined within minutes.

The damage kept mounting throughout the call. The initial estimate of $1 billion quickly climbed to $3 billion, then crossed $6 billion around 4:40 p.m. Automated alert systems at blockchain analytics firms also flagged the anomalous transactions, notifying major investors and clients. At 4:32 p.m., a post appeared on X (formerly Twitter) warning of a possible large-scale hack at Binance, though it was described as unconfirmed.

The broader industry mobilized quickly. Taylor Monahan, a researcher at the nonprofit security group SEAL, contacted stablecoin issuer Tether at 4:38 p.m. Tether and Circle began tracing the suspicious transactions and moved to freeze assets in the wallets involved. Binance also worked with TRM Labs, Chainalysis and Elliptic to identify wallet addresses holding the stolen assets and request freezes.

Senior leadership pulled an all-nighter. Co-CEO Yi He, who was in the UAE, spent the night on calls with industry partners, while co-CEO Richard Teng, based in Hong Kong, also stayed up through the night coordinating the response, according to the Wall Street Journal. As teams tracked the movement of funds, the hackers were already switching into assets harder to freeze.

Around 5 p.m., the hackers deposited roughly $60 million worth of stolen stablecoins into Aave, a virtual asset lending platform, and used them as collateral to borrow approximately 20,000 ether. Unlike stablecoins, bitcoin and ether cannot be directly frozen by a central issuer targeting a specific wallet — a deliberate move, analysts believe, to evade tracking and asset freezes.

Aave and other platforms involved subsequently suspended lending to the suspicious accounts, but TRM Labs estimated the hackers had managed to move approximately $2.4 billion worth of virtual assets beyond reach.

As criticism mounted on social media, Binance officially acknowledged the hack around 5:15 p.m. The company suspended withdrawals and said user assets were safe. On Saturday, Binance announced it had recovered 90 percent of the stolen assets and said withdrawal services would resume Sunday.