Seven months pregnant, Binance co-CEO He Yi worked through the night to oversee the cryptocurrency exchange's response after hackers stole over $6 billion in virtual assets, as the company scrambled to restore services, The New York Times reported.
Operating from her base in Abu Dhabi, He Yi navigated the crisis overnight, taking calls as late as 3 am local time. As the company worked to resume withdrawals, an informal emergency war room brought together around 100 participants, including cryptocurrency tracers and security personnel.
The team later moved to a 100-person conference call, with staff muting and unmuting themselves as they coordinated the response in a mix of English and Chinese, the report said.
Deep Dive
How did Binance co-CEO He Yi coordinate the response to the $6.3 billion hack?
Why did Binance suspend withdrawals after the cyberattack, and when did they resume?
How did Binance cover losses from the cryptocurrency hack?
The breach began around 4.20 pm on Thursday, October 29, triggering alarms at the cryptocurrency exchange as unusual transactions started appearing. As funds were drained, the company's top executives set up an informal emergency war room on Wea, its internal messaging system, the NYT report added.
Also Read | Binance resumes Bitcoin, Ether withdrawals after $6.3 billion crypto hack linked to North Korea
FBI blames North Korea, Binance resumes withdrawals
{{/usCountry}}Also Read | Binance resumes Bitcoin, Ether withdrawals after $6.3 billion crypto hack linked to North Korea
FBI blames North Korea, Binance resumes withdrawals
{{/usCountry}}Meanwhile, the Federal Bureau of Investigation (FBI) on Saturday accused North Korea of being behind the cyberattack that led to the theft of more than $6 billion in virtual assets from Binance.
"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor," the agency said in a statement.
Binance, the world's largest cryptocurrency exchange by daily trading volumes, had suspended customer withdrawals immediately after the attack to investigate the breach. The news of the hack also triggered a sharp fall in the prices of most major cryptocurrencies on Friday, AFP reported.
The exchange said withdrawals would be restored in phases. After resuming the service on Sunday, Binance recorded a net outflow of $3.6 billion in crypto assets, Bloomberg reported.
Also Read | Binance says it has covered 90% of losses after $6.3 billion crypto hack
X posts during crisis
While the leadership and the staff worked internally to contain the breach, Binance founder and majority shareholder Changpeng Zhao continued to post on X to his 12.9 million followers on the platform.
He shared prayer hand emojis and engaged in public exchanges.
After midnight, Elon Musk posted a grimacing emoji under an X post comparing Zhao to disgraced FTX founder Sam Bankman-Fried, according to the report.
Zhao pushed back, replying, "Elon, have a lot of respect for you, but bad time to troll. Please stop."
"Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support. Thanks!" the post added.
Addressing the exchange online, Yi He clarified, “Our company's revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares.”
(with input from agencies)