Seven Months Pregnant, Binance Co-CEO He Yi Took 3 am Calls as 6.3 Billion dollar Crypto Heist Unfolded

Binance co-CEO He Yi reportedly worked through the night, taking calls as late as 3 am and participating in an emergency response involving around 100 people as the cryptocurrency exchange faced a massive cyberattack. The incident, which reportedly involved the theft of approximately $6.3 billion in digital assets, triggered an urgent response from Binance's senior leadership, cybersecurity specialists and blockchain investigators.

He Yi, who was around seven months pregnant at the time, joined the crisis response from Abu Dhabi. The emergency effort involved employees and security experts working across different locations to investigate the breach, track suspicious transactions and prevent further losses. According to reports, the team initially coordinated through Binance's internal communication channels before moving to a larger conference call. Participants worked across time zones, with discussions taking place in both English and Chinese.

Binance co-CEO Richard Teng was also involved in the overnight response, reportedly staying awake in Hong Kong as the company assessed the scale of the attack. The cyberattack saw hackers move billions of dollars in cryptocurrency within a short period. The speed of the transactions created significant challenges for investigators, as blockchain transfers are generally irreversible once confirmed.

Initial investigations pointed towards a possible compromise involving an employee's laptop. Cybersecurity investigators subsequently linked the operation to TraderTraitor, a hacking group associated with North Korea. The FBI also attributed the theft to North Korean actors. Following the breach, Binance temporarily suspended customer withdrawals while its security teams investigated the incident and assessed potential risks to user funds.

The exchange said it would cover the losses and worked with blockchain intelligence companies and other cryptocurrency platforms to trace the stolen assets. Stablecoin issuers, including Tether and Circle, reportedly froze substantial amounts of funds connected to the incident. The attack also highlighted the growing threat posed by sophisticated cybercriminal groups targeting cryptocurrency infrastructure. North Korea-linked hacking operations have previously been associated with several major digital asset thefts, including the $1.5 billion Bybit hack in February 2025.

The incident has renewed concerns about the security of cryptocurrency exchanges, particularly their wallet infrastructure, internal access controls and transaction monitoring systems. The immediate challenge was to contain the damage, investigate the breach and reassure customers about the safety of their holdings. The overnight response involving He Yi and a large emergency team highlighted the pressure facing the company's leadership as it dealt with one of the biggest reported cryptocurrency security incidents.

Disclaimer: This image is taken from Reuters.