Binance Reopens Withdrawals After $6.3B Hack as THORChain Founder Resists FBI Freeze

Binance has reopened withdrawals across 15 blockchain networks after North Korea's TraderTraitor group stole $6.3 billion from its hot wallets last Thursday, and the exchange has already processed roughly $4.65 billion in withdrawals against $1 billion in deposits, according to figures released by the company. The gap produces a net outflow of $3.64 billion — but founder Changpeng Zhao framed the number as a vote of confidence, saying that in the first 12 hours after reopening there was only a 2.1% net outflow and that "98% choose to stay!"

The exchange said it has replenished about 95% of the stolen crypto through a mix of corporate reserves, insurance and 50% of the assets held in the Secure Asset Fund for Users (SAFU). For a platform of Binance's scale, that replenishment pace matters: it determines whether withdrawal queues stay solvent while investigators chase the funds.

What actually happened in the hack?

The breach occurred Thursday when TraderTraitor — the cluster the FBI links to North Korea's Lazarus Group, also blamed for the multibillion-dollar hacks of Bybit and Bitget — gained access to delegated wallet permissions via a compromised laptop. Blockaid CEO Ido Ben-Natan told Cointelegraph the attackers could have executed the theft without EIP-7702 account abstraction, but the standard may have helped them bypass safeguards and drain assets in a single sweep.

Binance co-CEO Richard Teng pushed back on the single-laptop narrative. "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," he said. "Our investigation has not attributed responsibility to any individual."

Federal response and frozen funds

Zhao publicly thanked the US Secret Service for "acting within minutes to help track and freeze stolen funds." Blockchain analytics firm Elliptic estimates that about $2.84 billion of the stolen assets — mostly USDC and USDT — has been frozen on chain, leaving the attackers with roughly $3.33 billion. To outrun the stablecoin freezes, the attacker borrowed about $44.6 million of ETH against stablecoins on Aave. The FBI has published a list of hack-linked addresses and specifically instructed THORNode operators, RPC node operators, instant exchanges, DeFi services and analytics firms to block transactions with or derived from those addresses.

What does the freeze request mean for THORChain?

THORChain founder JP Thor — who says he is no longer involved with the protocol — argued forcefully that operators should not comply. "IMO if THORNodes decided to take the protocol offline next week then the experiment is over," he said, adding: "The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed."

The practical stakes are concentrated: developer Chad Barraford told the Unchained podcast that roughly 50 individuals operate the protocol's 100 nodes. A halt requires a vote by one third of operators plus one, and nodes can exit rather than process the funds — THORChain can run on as few as four nodes. Nine chains on THORChain, including its Bitcoin, Ethereum and Tron implementations, are currently halted after automated systems paused the protocol for unrelated reasons shortly after the hack. Separately, Lookonchain reports the attackers used cross-chain platform Relay to swap about half of $95.9 million in stolen SOL into Bitcoin.

Wider market and policy fallout

Crypto-linked equities including Coinbase, Circle and Strategy sold off sharply. Bitcoin bottomed near $76,500 and recovered to $77,745. Strive CEO Matt Cole said Friday: "I do have conviction that over any reasonable time frame, this does not change the investment thesis on Bitcoin."

Nasdaq-listed Next Technology Holding said its board approved selling its entire 5,833-Bitcoin treasury, worth around $450 million. Tallies of attacker-held funds vary widely — from at least 18,000 BTC and 430,000 ETH to FBI-address-based counts of 18,270 BTC and 551,612 ETH — and rapid liquidation of those holdings could pressure BTC and ETH prices. Senator Cynthia Lummis and The Digital Chamber renewed calls for crypto legislation.

Standard Chartered's Geoffrey Kendrick said the hack should accelerate the shift to decentralized exchanges. "The decentralized exchange [Uniswap] has never had any exploits, and the hack of the largest centralized exchange, in Binance, should see the ratio of DEX to CEX trading continue to increase," he said, noting the DEX/CEX ratio currently sits around 23.5% and that the hack is "another reason why that forecast may end up being too low" for his $100 UNI target for 2030.

Also this week

• Trezor urged customers who bought hardware wallets from former authorized reseller CryptoBilis since March to move their funds, after an Indonesian customer found an unauthorized circuit board in a Safe 5 device bought on Tokopedia in August.
• Chainalysis disclosed a cybersecurity incident that exposed some non-sensitive customer data including user IDs, names and email addresses, and said it found no evidence of access to investigation content or credentials.
• Texas brothers Raymond Christian Garcia and Isiah Angelo Garcia received 180 and 186 months in prison respectively for the September 19, 2025 armed robbery and kidnapping of a Minnesota family over cryptocurrency access.

With the FBI address list now public and node operators facing an explicit compliance demand, the coming weeks will test whether permissionless infrastructure can withstand direct law-enforcement pressure.