Binance Witnesses $3.6B Withdrawal Wave After Resuming Services, THORChain Founder Rejects Asset Freezing: Hodler's Digest
Following the resumption of withdrawals, Binance experienced billions in outflows, though CZ notes "98% chose to stay." The co-founder of THORChain firmly rejects protocol suspension to meet FBI requirements.
Withdrawal services resume at Binance, resulting in $3.64B net capital flight
After North Korean threat actors exfiltrated $6.3 billion from its hot storage infrastructure late last week, Binance has restored withdrawal capabilities across 15 distinct blockchain networks.
The exchange disclosed today that it facilitated approximately $4.65 billion worth of withdrawal transactions since operations resumed while simultaneously recording $1 billion in incoming deposits. Changpeng Zhao, the platform's founder, revealed that during the initial 12-hour period, net capital outflow reached merely 2.1%, emphasizing that "98% choose to stay!"
Approximately 95% of the misappropriated digital assets have been restored through a combination of Binance's corporate treasury reserves, insurance coverage, and utilizing half of the capital held in the Secure Asset Fund for Users (SAFU).
Thursday witnessed the most significant cryptocurrency theft in recorded history when North Korea's TraderTraitor collective obtained access to delegated wallet authorization through a compromised portable computer. In an interview with Cointelegraph, Blockaid's CEO Ido Ben-Natan explained that while the perpetrators could have executed the theft without leveraging EIP-7702 (account abstraction), this technology may have facilitated their ability to circumvent security measures and extract assets in a single coordinated operation.
Richard Teng, Binance's co-CEO, dismissed suggestions that the security breach could be traced back to a solitary compromised laptop device.
"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," he said. "Our investigation has not attributed responsibility to any individual."
Federal authorities mobilize rapidly to assist in recovering billions
Zhao expressed gratitude to the Secret Service today for "acting within minutes to help track and freeze stolen funds... your speed, expertise and dedication helped contain the damage."
According to Elliptic's analysis, roughly $2.84 billion of the pilfered assets, predominantly consisting of USDC and USDT stablecoins, have been successfully frozen on-chain. The attackers engaged in a time-sensitive race to circumvent the unprecedented stablecoin blocking mechanisms by securing approximately $59.9 million worth of ETH through loans collateralized with stablecoins on the Aave platform.
The Federal Bureau of Investigation formally attributed responsibility for the intrusion to the TraderTraitor hacking group, which operates under North Korea's Lazarus Group umbrella and has also been implicated in multibillion-dollar breaches targeting Bybit and Bitget. President Donald Trump suggested "we'll talk to North Korea about it." The FBI additionally published a comprehensive list of wallet addresses associated with the attack and explicitly called upon THORnode operators, RPC node operators, instant exchange services, DeFi platforms, blockchain analytics companies and additional digital asset service providers to prevent transactions involving or originating from the specified addresses.
Co-founder of THORChain opposes compliance with freezing demands
Following earlier incidents, North Korean hackers have utilized THORChain for permissionless cryptocurrency exchange transactions, resulting in a 13% price surge for the protocol's native RUNE token driven by anticipated transaction fee revenue.
In an unfortunate development for TraderTraitor, nine blockchain networks on THORChain, encompassing Bitcoin, Ethereum and Tron, remain suspended after automated safeguard systems halted protocol operations for unrelated technical reasons shortly following the security breach.
Chad Barraford, a THORChain developer, explained on the Unchained podcast that approximately 50 individuals control the network's 100 THORChain nodes. Should these node operators decline to suspend protocol operations or implement address blacklisting, which appears probable based on historical precedents and public declarations, they may face potential prosecution considering the magnitude of the thefts and the direct involvement of federal law enforcement agencies including the FBI and Secret Service.
JP Thor, THORChain's founder (who maintains he is no longer actively involved), presented a forceful argument that THORNode operators must refuse cooperation and remain committed to the fundamental principles of decentralization and permissionless operation. "IMO if THORNodes decided to take the protocol offline next week then the experiment is over," he said.
"The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed."
THORnode operators possess the capability to suspend network operations through a two-thirds majority voting mechanism, and individual operators retain the option to exit the network should they prefer not to process the questionable funds. The THORChain protocol maintains operational functionality with as few as four active nodes processing transactions.
According to monitoring by Lookonchain, the threat actors have also been leveraging the cross-chain platform Relay to convert $95.9 million worth of stolen SOL tokens into Bitcoin.
Consequences and broader impact of the security breach
Equity securities of cryptocurrency-related companies including Coinbase, Circle and Strategy experienced significant sell-offs following the hack announcement, while cryptocurrency markets broadly declined in value. However, Strive's CEO Matt Cole observed on Friday that Bitcoin demonstrated greater resilience than market participants anticipated.
"I do have conviction that over any reasonable time frame, this does not change the investment thesis on Bitcoin," Cole said. Bitcoin established a local bottom near $76.5K before recovering to 77,745 at the time of writing. Following the attack incident, Next Technology Holding, a publicly-traded Nasdaq company, disclosed that its board of directors has authorized the liquidation of its 5833 Bitcoin Treasury holdings valued at approximately $450 million.
The perpetrators have accumulated no less than 18,000 stolen Bitcoin and 430,000 Ether tokens, though certain calculations of the funds held in wallet addresses identified by federal authorities suggest substantially higher totals. Market participants have expressed anxiety that rapid liquidation of these digital currencies could exert significant downward pressure on both BTC and ETH market valuations.
In the aftermath, Senator Cynthia Lummis and The Digital Chamber have both leveraged the security incident to renew advocacy efforts for comprehensive cryptocurrency legislation designed to help prevent similar attacks and mitigate the impact of future security breaches.
Compromised Trezor device traced to CryptoBilis distribution channel
Trezor has issued an urgent advisory for customers who acquired its hardware wallet devices from former authorized distribution partner CryptoBilis since March, recommending immediate fund transfers following a report identifying a suspected malicious implant discovered in a Safe 5 device.
The hardware wallet manufacturer announced Friday that a customer located in Indonesia documented the presence of an unauthorized circuit board component inside a Trezor Safe 5 unit purchased through the Tokopedia marketplace in August. Trezor clarified that it has not yet conducted a physical examination of the suspected device and has received no confirmed reports of associated financial losses.
This security alert follows earlier reports of cryptocurrency theft incidents involving Ledger wallet devices sold through CryptoBilis distribution channels that emerged on Oct. 9. Ledger subsequently verified the presence of an unauthorized hardware implant in one affected device.
Market Winners and Losers
As the week concludes, Bitcoin (BTC) has declined 3% and is trading at $77,745, Ethereum (ETH) has fallen 3.5% to trade at $2,260 and XRP (XRP) has decreased 3.9% to $1.02. According to CoinMarketCap data, the total cryptocurrency market capitalization stands at $2.21 trillion.
Within the top 100 cryptocurrencies by market capitalization, the three leading altcoin gainers for the week are Hyperliquid (HYPE) posting a 13.7% increase, Midnight (NIGHT) advancing 12.6%, and Pepe (PEPE) gaining 12.6%.
The three worst-performing altcoins for the week are Curve DAO (CRV) which declined 18.6%, VeChain (VET) falling 15.9% and Worldcoin decreasing 13.8%.
Weekly Prediction
Binance security incident may accelerate migration toward DEXs: Standard Chartered
Geoffrey Kendrick of Standard Chartered suggested that decentralized exchanges are positioned to emerge as significant beneficiaries of the hack and reiterated his bullish outlook on Uniswap and its native UNI token.
"The decentralized exchange [Uniswap] has never had any exploits, and the hack of the largest centralized exchange, in Binance, should see the ratio of DEX to CEX trading continue to increase."
Current measurements place the ratio at approximately 23.5%. Kendrick confirmed he maintains his $100 valuation target for Uniswap (UNI) by 2030. He suggested the Binance security breach represents "another reason why that forecast may end up being too low."
Leading FUD of the Week
CFTC chairman highlights concerns regarding autonomous AI Agents
Mike Selig, chairman of the CFTC, warns that autonomous artificial intelligence agents present challenges to financial regulatory frameworks constructed around human decision-makers, necessitating regulatory adaptation. Selig indicated that Super Intelligence (SI) could democratize access to sophisticated risk-management capabilities previously available exclusively to larger institutional participants, extending these tools to smaller traders and businesses.
"SI can help process the vast amount of information significantly faster than human brain power and with greater accuracy," he said.
However, increased autonomy introduces novel risk factors. Agents might respond unpredictably to evolving market dynamics, while those utilizing similar algorithmic models could produce correlated trading patterns. The velocity of autonomous transaction execution could additionally complicate market surveillance protocols and risk management frameworks, he said.
Blockchain intelligence firm Chainalysis reports cybersecurity breach
Chainalysis, a prominent blockchain analytics provider, disclosed it was the target of a cybersecurity incident, comparable to recent attacks affecting other technology platforms.
"Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens," it said in a blog post on Friday. Limited non-sensitive customer information was compromised, encompassing user identification numbers, account holder names and registered email addresses.
Chainalysis indicated it is employing large language model technology to conduct comprehensive security reviews and emphasized the incident bears no connection to the recent cryptocurrency theft perpetrated against Binance.
Texas siblings receive 15-year prison sentences for armed cryptocurrency robbery
Raymond Christian Garcia and Isiah Angelo Garcia, both residents of Waller, Texas, received prison sentences of 180 months and 186 months respectively, for their roles in the armed robbery of cryptocurrency holdings and kidnapping of a family in Grant, Minnesota.
The brothers received their sentences on Thursday before US District Judge Donovan W. Frank, as detailed in a Friday news release. Both defendants had entered guilty pleas in June.
On Sept. 19, 2025, the brothers, who had traveled from Texas to Minnesota, forcibly abducted Victim 1 and his family members at their residence using firearms, court documents said. They restrained the family members with zip-ties under armed threat and detained them for more than nine hours, coercively demanding access credentials to Victim 1's cryptocurrency account holdings.