Binance reopens withdrawals after record hack

Binance has reopened withdrawals across 15 blockchain networks after North Korean hackers stole $6.3 billion from its hot wallets late last week.

The exchange said it had processed approximately $4.65 billion in withdrawals and received $1 billion in deposits after reopening. Binance founder Changpeng Zhao said the platform recorded a net outflow of only 2.1% during the first 12 hours, adding that “98% choose to stay!”

However, DeFi Llama’s Binance wallet tracker showed $5.8 billion in outflows over 24 hours. The figures may include internal transfers or transfers into new hot wallets. Binance has replenished about 95% of the stolen cryptocurrency using corporate reserves, insurance and 50% of the funds held in its Secure Asset Fund for Users (SAFU).

The attack, described as the biggest hack in history, occurred on Thursday when North Korea’s TraderTraitor group obtained access to delegated wallet permissions through a compromised laptop. Blockaid CEO Ido Ben-Natan told Cointelegraph that the attackers could have stolen the funds without using EIP-7702, also known as account abstraction, although the technology may have helped them bypass safeguards and drain assets in a single operation.

Binance co-CEO Richard Teng rejected the suggestion that the incident resulted from one compromised laptop.

“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” Teng said. “Our investigation has not attributed responsibility to any individual.”

FBI and Secret Service help freeze billions

Zhao thanked the US Secret Service for “acting within minutes to help track and freeze stolen funds... your speed, expertise and dedication helped contain the damage.”

Elliptic estimated that approximately $2.84 billion of the stolen assets, primarily USDC and USDT, had been frozen on-chain, leaving the attackers with $3.33 billion. In an attempt to move funds before stablecoin issuers could block them, the attackers borrowed approximately $44.6 million worth of Ether against stablecoins on Aave.

The FBI attributed the attack to the TraderTraitor hackers, who are associated with North Korea’s Lazarus Group. The group has also been blamed for multibillion-dollar hacks involving Bybit and Bitget. President Donald Trump said, “we’ll talk to North Korea about it.”

The FBI released a list of addresses connected with the attack and specifically urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics companies and other digital-asset service providers to block transactions involving those addresses or funds derived from them.

Zhao’s post: X

THORChain founder rejects request to freeze funds

Following previous attacks, North Korean hackers have used THORChain to swap cryptocurrencies without permission. The protocol’s native token, RUNE, rose 13% as traders anticipated the fees that could result from such activity. However, nine chains on THORChain, including Bitcoin, Ethereum and Tron, were halted after automated systems paused the protocol for unrelated reasons on October 31.

According to THORChain developer Chad Barraford, speaking on the Unchained podcast, approximately 50 individuals operate the network’s 100 nodes. If node operators refuse to halt the protocol or block addresses, as appears likely based on past incidents and public statements, there is speculation that they could face prosecution because of the scale of the theft and the involvement of the FBI and Secret Service.

THORChain founder JP Thor, who says he is no longer involved with the project, argued that THORNode operators should not cooperate with such requests and should remain committed to decentralization and permissionlessness.

“IMO if THORNodes decided to take the protocol offline next week then the experiment is over,” he said. “The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.”

If at least one-third plus one of the THORNode operators vote in favor, they can halt activity. Nodes can also leave the network if they do not want to process the funds. THORChain can continue operating with as few as four nodes processing transactions. These voting and participation rules will determine whether the network responds to requests to halt activity or block addresses.

Blockchain analytics firm Lookonchain reported that the attackers also used the cross-chain platform Relay to convert approximately half of $95.9 million in stolen SOL into Bitcoin. JP Thor’s post is available on X.

Market and corporate fallout

Cryptocurrency-related stocks, including Coinbase, Circle and Strategy, sold off sharply after the hack, while crypto markets also declined. Strive CEO Matt Cole said Friday that Bitcoin had performed better than expected.

“I do have conviction that over any reasonable time frame, this does not change the investment thesis on Bitcoin,” Cole said. Bitcoin fell to approximately $76,500 before recovering to $77,745 at the time of writing.

After the attack, Nasdaq-listed Next Technology Holding announced that its board had approved the sale of its 5,833-Bitcoin treasury, valued at approximately $450 million.

The attackers reportedly accumulated at least 18,000 BTC and 430,000 ETH through the theft and subsequent swaps. Other estimates based on funds in addresses identified by the FBI put the totals considerably higher, at 551,612 ETH and 18,270 BTC. A rapid sale of those assets could put downward pressure on the prices of Bitcoin and Ether.

Senator Cynthia Lummis and The Digital Chamber used the incident to renew calls for cryptocurrency legislation intended to prevent future attacks and reduce their effects.

Tampered Trezor device linked to CryptoBilis reseller

Trezor has urged customers who purchased its hardware wallets from former authorized reseller CryptoBilis since March to move their funds after a suspected implant was reported in a Trezor Safe 5 device.

The company said Friday that a customer in Indonesia had reported finding an unauthorized circuit board inside a Trezor Safe 5 purchased on Tokopedia in August. Trezor said it had not yet examined the device and had received no reports of related losses. Its warning followed reports of cryptocurrency losses involving Ledger wallets sold through CryptoBilis that emerged on Oct. 9. Ledger confirmed that one device contained an unauthorized hardware implant.

Trezor’s notice is available at Trezor.

Weekly winners and losers

At the end of the week, Bitcoin (BTC) was down 3% at $77,745. Ethereum (ETH) was down 3.5% at $2,260, while XRP (XRP) fell 3.9% to $1.02. CoinMarketCap put the total cryptocurrency market capitalization at $2.21 trillion.

Among the 100 largest cryptocurrencies, the three biggest altcoin gainers for the week were Hyperliquid (HYPE), up 13.7%; Midnight (NIGHT), up 12.6%; and Pepe (PEPE), also up 12.6%.

The biggest altcoin decliners were Curve DAO (CRV), down 18.6%; VeChain (VET), down 15.9%; and Worldcoin, down 13.8%.

Prediction of the week: Binance hack could accelerate shift to DEXs

Standard Chartered analyst Geoffrey Kendrick said decentralized exchanges could be one major beneficiary of the Binance hack and reaffirmed his conviction in Uniswap and its UNI token.

“The decentralized exchange [Uniswap] has never had any exploits, and the hack of the largest centralized exchange, in Binance, should see the ratio of DEX to CEX trading continue to increase,” Kendrick said.

The ratio was approximately 23.5% at the time. Kendrick said he continued to maintain a $100 price target for Uniswap (UNI) in 2030 and that the Binance hack was “another reason why that forecast may end up being too low.”

Top FUD of the week

CFTC chair warns about autonomous AI agents

CFTC Chair Mike Selig warned that autonomous artificial-intelligence agents could challenge financial regulations designed around human traders and said regulators must adapt. He said superintelligence, or “SI,” could give smaller traders and businesses access to risk-management capabilities that were previously available mainly to larger institutions.

“SI can help process the vast amount of information significantly faster than human brain power and with greater accuracy,” Selig said.

Greater autonomy also creates new risks. Agents could respond unpredictably to market conditions, while multiple users relying on similar models could produce correlated trading behavior. The speed of autonomous transactions could further complicate market surveillance and risk management, he said.

Chainalysis reports cybersecurity incident

Blockchain analytics company Chainalysis said it had been targeted in a cybersecurity incident similar to those recently affecting other platforms.

“Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens,” the company said in a Friday blog post. Some non-sensitive customer data, including user IDs, names and email addresses, was exposed.

Chainalysis said it was using large language models to review its security and added that the incident was unrelated to the recent cryptocurrency theft at Binance. The company’s statement is available on its website.

Texas brothers sentenced for armed crypto robbery

Raymond Christian Garcia and Isiah Angelo Garcia, both of Waller, Texas, were sentenced to 180 months and 186 months in prison, respectively, for robbing cryptocurrency at gunpoint and kidnapping a family in Grant, Minnesota.

The brothers were sentenced Thursday before US District Judge Donovan W. Frank, according to a Friday news release. They had pleaded guilty in June.

On Sept. 19, 2025, the brothers traveled from Texas to Minnesota and kidnapped Victim 1 and the victim’s family at gunpoint in their home, according to court documents. They restrained the family with zip ties and held them for more than nine hours while demanding access to Victim 1’s cryptocurrency accounts.

The US Department of Justice published the sentencing announcement.

Top magazine features of the week

Bitcoin turns 18: Has the original rebel grown up?

Bitcoin, the largest cryptocurrency, turned 18 amid AI-driven security threats, concerns about quantum computing and the biggest exchange hack in crypto history.

Binance hackers raced to move billions before funds could be frozen

The attackers rushed to convert stolen stablecoins into cryptocurrencies that issuers could not freeze, as industry participants including Tether and Circle moved to immobilize billions of dollars in assets.

Will gold’s “infinite mint bug” make Bitcoin more valuable?

A US fusion startup said it had turned mercury into gold. The feature examined whether a potential increase in the gold supply could strengthen Bitcoin’s claim to be a superior form of digital gold.

Source: Cointelegraph