Binance Restores Access as Billions in Crypto Reshuffle
Binance has reopened withdrawals across 15 blockchain networks in the aftermath of what has been labeled the largest hack in the history of digital assets. The breach, which occurred late last week, saw North Korean-linked hackers siphon approximately $6.3 billion from the exchange's hot wallets.
According to the exchange, roughly $4.65 billion in withdrawal requests were processed in the period following the reopening, while $1 billion in new deposits came in. Founder Changpeng Zhao noted that the net outflow over the first 12 hours stood at just 2.1 percent, remarking that "98% choose to stay!"
However, third-party tracking paints a somewhat different picture. DeFi Llama's wallet tracker recorded $5.8 billion in outflows over a 24-hour window, though the exchange cautioned that its figures may reflect internal transfers or movements into newly established hot wallets rather than genuine exits from the platform.
On the replenishment front, Binance indicated that approximately 95 percent of the stolen cryptocurrency has already been backfilled. The funding was drawn from a combination of the company's corporate reserves, insurance provisions, and 50 percent of the assets held in the Secure Asset Fund for Users (SAFU).
The Attack Vector and Law Enforcement Response
The breach, which took place on Thursday, was attributed by the FBI to the TraderTraitor group, a unit linked to North Korea's Lazarus Group. The same collective was previously implicated in multibillion-dollar heists against Bybit and Bitget. According to reporting, the attackers gained access to delegated wallet permissions through a compromised laptop.
Ido Ben-Natan, CEO of Blockaid, told Cointelegraph that the perpetrators could have extracted the funds without leveraging EIP-7702 (account abstraction), though the standard may have aided them in circumventing safeguards and draining assets in a single operation.
Binance co-CEO Richard Teng pushed back on the simplified narrative. "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," Teng stated, adding that the internal investigation has not assigned responsibility to any particular individual.
Zhao publicly thanked the U.S. Secret Service for "acting within minutes to help track and freeze stolen funds," crediting the agency's speed and expertise with containing the damage.
Elliptic's analysis suggested that approximately $2.84 billion of the stolen assets—predominantly USDC and USDT—were frozen on-chain, leaving the hackers with roughly $3.33 billion in liquid holdings. In a time-sensitive maneuver, the attackers borrowed around $44.6 million worth of ETH against stablecoins on the Aave protocol to beat the unprecedented stablecoin blocks.
President Donald Trump indicated the administration would "talk to North Korea about it." The FBI also published a list of addresses connected to the theft, specifically flagging THORnode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other digital asset service providers, urging them to block transactions involving or derived from those addresses.
THORChain's Decentralization Standoff
The protocol at the center of a contentious debate is THORChain, a decentralized cross-chain swap network that North Korean hackers have historically used to move stolen assets permissionlessly. In the wake of this latest attack, the protocol's native token RUNE surged 13 percent on expectations of elevated swap fees.
Ironically for the attackers, nine chains on THORChain—including Bitcoin, Ethereum, and Tron—are currently halted. Automated systems paused the protocol for reasons unrelated to the hack shortly after it occurred.
Chad Barraford, a THORChain developer, explained on the Unchained podcast that only around 50 individuals operate the network's 100 THORChain nodes. Given the scale of the theft and the involvement of both the FBI and the Secret Service, node operators who refuse to halt the protocol or block identified addresses could face criminal prosecution.
THORChain founder JP Thor, who stated he is no longer involved in the project, took a firm stance against government compliance. "IMO if THORNodes decided to take the protocol offline next week then the experiment is over," he said, arguing that operators should remain true to the principles of decentralization and permissionlessness.
Governance mechanics allow one-third plus one of THORnode operators to vote in favor of halting activity. Operators may also simply exit the network if they do not wish to process the flagged funds. The protocol can continue functioning with as few as four active nodes.
Separately, on-chain analytics firm Lookonchain reported that the attackers have also been using the cross-chain platform Relay to convert approximately half of $95.9 million in stolen SOL into Bitcoin.
Market Reactions and Wider Ecosystem News
The heist triggered a sharp sell-off in crypto-linked equities, with shares of Coinbase, Circle, and Strategy all declining. Broader crypto markets also dipped, though Strive CEO Matt Cole noted that Bitcoin held up better than anticipated. He bottomed near $76,500 before recovering to $77,745 by the time of writing. Cole expressed confidence that the incident would not alter Bitcoin's long-term investment thesis over any reasonable horizon.
In related corporate news, Nasdaq-listed Next Technology Holding announced its board had approved the sale of its 5,833-bitcoin treasury, valued at approximately $450 million.
The attackers are reported to have amassed at least 18,000 BTC and 430,000 ETH from the theft and subsequent swaps, though some tallies of the FBI-identified addresses put the figures considerably higher at 551,612 ETH and 18,270 BTC. Market participants worry that a rapid liquidation of those holdings could exert meaningful downward pressure on both BTC and ETH prices.
Senator Cynthia Lummis and The Digital Chamber seized on the incident to renew their push for comprehensive crypto legislation aimed at preventing and mitigating the impact of future attacks.
In the hardware wallet space, Trezor urged customers who purchased its devices from former authorized reseller CryptoBilis since March to transfer their funds. The warning followed a report from an Indonesian customer who discovered an unauthorized circuit board inside a Trezor Safe 5 purchased on Tokopedia in August. Trezor stated it had not yet examined the device and had received no reports of associated losses. This follows Ledger's confirmation on October 9 of an unauthorized hardware implant in one device sold through the same reseller.
At week's end, Bitcoin was down 3 percent at $77,745, Ethereum fell 3.5 percent to $2,260, and XRP dropped 3.9 percent to $1.02. The total cryptocurrency market capitalization stood at $2.21 trillion per CoinMarketCap. Among the top 100 assets, the week's top altcoin gainers were Hyperliquid (HYPE) at +13.7 percent, Midnight (NIGHT) at +12.6 percent, and Pepe (PEPE) at +12.6 percent. The top losers included Curve DAO (CRV) at -18.6 percent, VeChain (VET) at -15.9 percent, and Worldcoin at -13.8 percent.
Standard Chartered analyst Geoffrey Kendrick identified decentralized exchanges as a likely beneficiary of the incident, reaffirming his conviction in Uniswap and the UNI token. He noted that Uniswap has never suffered an exploit and that the hack of the largest centralized exchange should accelerate the shift in the DEX-to-CEX trading ratio, currently around 23.5 percent. Kendrick maintained his $100 price target for UNI by 2030, suggesting the Binance incident is "another reason why that forecast may end up being too low."
On the regulatory front, CFTC Chair Mike Selig warned that autonomous AI agents could challenge financial regulations built around human traders. He said Super Intelligence could democratize risk-management tools once reserved for large institutions, but cautioned that agents could react unpredictably to market conditions, generate correlated trading behavior among users of similar models, and complicate market surveillance.
Blockchain analytics firm Chainalysis disclosed it was targeted in a cybersecurity incident. The company stated its investigation found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens, though some non-sensitive customer data including user IDs, names, and email addresses was exposed. Chainalysis confirmed the incident was unrelated to the Binance theft.
In a separate law enforcement matter, Raymond Christian Garcia and Isiah Angelo Garcia, both of Waller, Texas, were sentenced to 180 and 186 months in prison respectively for the armed robbery of cryptocurrency and kidnapping of a family in Grant, Minnesota. The brothers had pleaded guilty in June after traveling from Texas to Minnesota on September 19, 2025, where they held the family at gunpoint for over nine hours while demanding access to the victim's crypto accounts.
