Binance Reopens Withdrawals Amidst Massive Net Outflow Following $6.3 Billion Hack

Binance has resumed withdrawal services for 15 blockchain networks following a significant security breach that saw $6.3 billion pilfered by North Korean hackers from its hot wallets late last week. The exchange announced that it had processed approximately $4.65 billion in withdrawals and received $1 billion in deposits after reopening the services. Binance founder Changpeng Zhao reported that within the first 12 hours, the net outflow stood at a mere 2.1%, with "98% choose to stay." This confidence is partly bolstered by the fact that roughly 95% of the stolen cryptocurrency has already been replenished, utilizing a combination of Binance’s corporate reserves, insurance funds, and half of the assets held in the Secure Asset Fund for Users (SAFU).

The unprecedented hack, described as the largest in history, occurred on Thursday when North Korea’s TraderTraitor group reportedly gained access to delegated wallet permissions through a compromised laptop. Ido Ben-Natan, CEO of Blockaid, suggested that while attackers might have been able to steal the funds without utilizing EIP-7702 (account abstraction), this technology could have facilitated their ability to bypass safeguards and drain assets swiftly. However, Binance co-CEO Richard Teng refuted the notion that a single compromised laptop was solely responsible. Teng stated, "To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. Our investigation has not attributed responsibility to any individual."

FBI and Secret Service Intervene to Recover Billions

Changpeng Zhao expressed gratitude to the Secret Service for their swift action, stating they acted "within minutes to help track and freeze stolen funds… your speed, expertise and dedication helped contain the damage." Elliptic estimated that approximately $2.84 billion of the stolen assets, predominantly USDC and USDT, were frozen on-chain, leaving the hackers with $3.33 billion. The attackers reportedly rushed to convert the stolen stablecoins before they could be immobilized, borrowing around $44.6 million worth of ETH against stablecoins on Aave to facilitate this.

The FBI has attributed the attack to the TraderTraitor hackers, a group associated with North Korea’s Lazarus Group, which has also been implicated in multibillion-dollar hacks of Bybit and Bitget. President Donald Trump indicated that discussions regarding the incident would be held with North Korea. The FBI also released a list of addresses linked to the hack and specifically called upon THORnode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other digital asset service providers to block any transactions originating from or derived from these addresses.

THORChain Founder Resists Freeze Request

North Korean hackers have previously utilized THORChain to permissionlessly swap cryptocurrencies following attacks, leading to a 13% surge in the price of the protocol’s native token, RUNE, in anticipation of transaction fees. However, in a twist of fate for TraderTraitor, nine chains on THORChain, including Bitcoin, Ethereum, and Tron, were temporarily halted. These interruptions were due to unrelated automated system pauses that occurred shortly after the hack.

According to THORChain developer Chad Barraford, the network is operated by a relatively small group of individuals. If these node operators refuse to halt the protocol or block addresses, as has been suggested by past incidents and public statements, they could face legal repercussions given the scale of the theft and the involvement of the FBI and Secret Service. THORChain founder JP Thor, who claims to be no longer involved with the protocol, strongly advocated that THORNode operators should not cooperate and should uphold the principles of decentralization and permissionlessness. He articulated, "IMO if THORNodes decided to take the protocol offline next week then the experiment is over. The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed." THORChain can function with as few as four nodes processing transactions, and a third of the node operators can halt the network or choose to leave. Lookonchain reported that the attackers have also used the cross-chain platform Relay to swap $95.9 million of stolen SOL into Bitcoin.

Ramifications of the Hack

The Binance hack sent ripples through the crypto market, leading to a sharp sell-off in crypto-related stocks, including Coinbase and Circle. Crypto markets also experienced a downturn. Despite this, Strive CEO Matt Cole noted that Bitcoin had shown resilience, holding up better than expected. Cole expressed conviction that the incident would not alter the long-term investment thesis for Bitcoin. Bitcoin saw a temporary dip to around $76.5K before recovering to $77,745 at the time of writing. In the aftermath of the attack, Nasdaq-listed firm Next Technology Holding announced its board had approved the sale of its 5833 Bitcoin Treasury, valued at approximately $450 million.

Concerns have been raised that a rapid sell-off of the approximately 18,000 stolen Bitcoin and 430,000 Ether amassed by the attackers could exert downward pressure on BTC and ETH prices. Meanwhile, Senator Cynthia Lummis and The Digital Chamber have used the hack to renew their calls for comprehensive crypto legislation aimed at preventing and mitigating future attacks.

Tampered Trezor Linked to CryptoBilis Reseller

Trezor has issued a warning to customers who purchased its hardware wallets from former authorized reseller CryptoBilis since March, urging them to move their funds. This advisory follows a report of a suspected implant in a Trezor Safe 5 device. Trezor stated that a customer in Indonesia reported finding an unauthorized circuit board inside a Trezor Safe 5 purchased on Tokopedia in August. The company has not yet examined the device and has received no reports of related financial losses. This incident is reminiscent of previous reports of crypto losses involving Ledger wallets sold through CryptoBilis, which surfaced on October 9th, prompting Ledger to confirm an unauthorized hardware implant in one device.

Winners and Losers

At the close of the week, Bitcoin (BTC) experienced a 3% decline, trading at $77,745. Ethereum (ETH) was down 3.5% to $2,260, and XRP (XRP) saw a 3.9% decrease, trading at $1.02. The total cryptocurrency market capitalization stood at $2.21 trillion, according to CoinMarketCap. Among the top 100 cryptocurrencies, the week’s top performers were Hyperliquid (HYPE) with a 13.7% gain, Midnight (NIGHT) at 12.6%, and Pepe (PEPE) also at 12.6%. Conversely, the week’s biggest losers included Curve DAO (CRV) down 18.6%, VeChain (VET) down 15.9%, and Worldcoin down 13.8%.

Prediction of the Week: Binance Hack Could Accelerate Shift to Decentralized Exchanges

Geoffrey Kendrick of Standard Chartered posited that decentralized exchanges (DEXs) are likely to be significant beneficiaries of the Binance hack, reaffirming his confidence in Uniswap and its native token, UNI. Kendrick observed, "The decentralized exchange [Uniswap] has never had any exploits, and the hack of the largest centralized exchange, in Binance, should see the ratio of DEX to CEX trading continue to increase." The current DEX to CEX trading ratio stands at approximately 23.5%. Kendrick maintains his price target of $100 for Uniswap (UNI) by 2030, suggesting that the Binance hack could be a catalyst for this forecast to prove conservative.

Top FUD of the Week: CFTC Chair Warns of AI Agents’ Dangers

CFTC Chair Mike Selig has voiced concerns that autonomous AI agents could pose challenges to financial regulations designed for human traders, necessitating regulatory adaptation. Selig highlighted that Super Intelligence (SI) could democratize access to risk-management tools previously exclusive to large institutions, providing smaller traders and businesses with advanced capabilities. He stated, "SI can help process the vast amount of information significantly faster than human brain power and with greater accuracy." However, he also cautioned about the inherent risks associated with increased autonomy, including unpredictable agent behavior in response to market conditions and the potential for correlated trading activity among users of similar AI models. The speed of autonomous transactions could also complicate market surveillance and risk management efforts.

Blockchain Investigator Chainalysis Hit by Cybersecurity Incident

Blockchain analytics firm Chainalysis has reported being targeted in a cybersecurity incident, mirroring recent attacks on other platforms. The company stated, "Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens." While some non-sensitive customer data, including user IDs, names, and email addresses, was exposed, Chainalysis confirmed it has found no evidence of unauthorized access to sensitive investigation content or credentials. The firm is employing large language models to review its security protocols and emphasized that the incident is unrelated to the recent Binance crypto theft.

Texas Brothers Sentenced for Armed Crypto Robbery

Raymond Christian Garcia and Isiah Angelo Garcia of Waller, Texas, have been sentenced to 180 months and 186 months in prison, respectively, for their involvement in an armed robbery and kidnapping that resulted in the theft of cryptocurrency. The brothers were sentenced by US District Judge Donovan W. Frank after pleading guilty in June. Court documents indicate that in September 2025, the brothers traveled from Texas to Minnesota, where they kidnapped a victim and their family at gunpoint, holding them for over nine hours while demanding access to cryptocurrency accounts.

Top Magazine Features of the Week

• Bitcoin Turns 18: Has the Original Rebel Grown Up? This feature examines Bitcoin’s evolution amidst contemporary threats like AI-driven security risks, quantum computing concerns, and the recent record-breaking exchange hack.
• Binance Hackers Raced to Move Billions Before It Could Be Frozen: This article details how attackers scrambled to convert stolen stablecoins into untraceable cryptocurrencies as industry players like Tether and Circle moved to immobilize billions in assets.
• Will Gold’s ‘Infinite Mint Bug’ Make Bitcoin More Valuable? This piece explores the implications of a fusion startup’s claim to have turned mercury into gold and whether a potential increase in the gold supply could bolster Bitcoin’s narrative as a superior form of digital gold.