Chandra Wibowo
Binance, the world’s largest cryptocurrency exchange, has resumed withdrawal services across 15 blockchain networks following a colossal $6.3 billion hack that targeted its hot wallets late last week. The breach, attributed to North Korean hackers, sent shockwaves through the digital asset industry, prompting swift action from the exchange and international law enforcement agencies. In the immediate aftermath of the hack and the subsequent reopening of withdrawals, Binance reported processing approximately $4.65 billion in outgoing transactions, while simultaneously receiving $1 billion in new deposits.
Founder Changpeng Zhao, widely known as CZ, provided an initial assessment of user sentiment, stating that in the first 12 hours post-reopening, there was a mere 2.1% net outflow. He emphasized this by noting that "98% choose to stay!" However, independent data from DeFi Llama’s Binance wallet tracker presented a slightly different picture, indicating outflows of $4.54 billion over a 24-hour period. It is important to note that these figures may encompass internal transfers or movements of funds into new hot wallets, making a direct comparison with Binance’s reported net outflow challenging.
The exchange has moved rapidly to address the financial fallout of the hack. Approximately 95% of the stolen cryptocurrency has reportedly been replenished. This recovery effort has been funded through a combination of Binance’s corporate reserves, its insurance pool, and a significant contribution from the Secure Asset Fund for Users (SAFU).
The breach, which occurred on Thursday, has been labeled the largest in history. Investigations suggest that the North Korean hacking group, TraderTraitor, gained unauthorized access to delegated wallet permissions through a compromised laptop. Ido Ben-Natan, CEO of cybersecurity firm Blockaid, commented that while the attackers might have been able to steal the funds without leveraging EIP-7702 (account abstraction), its utilization could have facilitated a more efficient bypass of security safeguards, enabling a swift drain of assets.
However, Binance co-CEO Richard Teng has publicly refuted the notion that the hack was attributable to a single compromised engineer’s credentials. Teng stated in a previous report, "To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. Our investigation has not attributed responsibility to any individual." This assertion suggests a more sophisticated and coordinated attack vector.
Law Enforcement Intervention and Asset Recovery Efforts
The swiftness of the response from international law enforcement agencies has been a critical factor in mitigating the full impact of the hack. CZ expressed his gratitude to the U.S. Secret Service for their rapid intervention, stating, "The Secret Service acted within minutes to help track and freeze stolen funds… your speed, expertise and dedication helped contain the damage." This collaboration highlights the growing importance of inter-agency cooperation in combating sophisticated cybercrimes within the cryptocurrency ecosystem.
Elliptic, a blockchain analytics firm, estimated that approximately $2.84 billion of the stolen assets, primarily composed of USDC and USDT stablecoins, were successfully frozen on-chain. This left the hackers with an estimated $3.33 billion in accessible funds. In a desperate attempt to circumvent these freeze efforts, the attackers reportedly borrowed around $44.6 million worth of Ether (ETH) against stablecoins on the Aave lending protocol, aiming to move the assets before they could be immobilized.
The FBI has officially attributed the attack to the TraderTraitor hackers, a group with known ties to North Korea’s Lazarus Group, infamous for orchestrating previous large-scale hacks, including those targeting Bybit and Bitget. The U.S. government’s response has been firm, with President Donald Trump indicating that "we’ll talk to North Korea about it." The FBI has also proactively released a list of addresses connected to the hack and has specifically alerted various digital asset service providers, including THORnode operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics firms, to block any transactions originating from or linked to these addresses.
THORChain’s Role and Decentralization Debate
The attackers have reportedly utilized THORChain, a cross-chain liquidity protocol, to swap cryptocurrencies in the wake of previous attacks. This has led to a notable surge in the price of THORChain’s native token, RUNE, with a reported 13% increase driven by anticipation of transaction fees generated from these illicit swaps.
However, the hackers’ efforts to launder the stolen funds through THORChain may have been inadvertently hampered. Nine of THORChain’s integrated blockchains, including Bitcoin, Ethereum, and Tron, were temporarily halted shortly after the hack occurred due to unrelated automated system pauses.
Chad Barraford, a THORChain developer, elaborated on the protocol’s operational dynamics during an appearance on the Unchained podcast. He noted that approximately 50 individuals manage the 100 THORChain nodes. Barraford highlighted that if node operators refuse to halt the protocol or block specific addresses, they could face legal repercussions, especially given the magnitude of the theft and the involvement of the FBI and Secret Service.
In a stark display of the ongoing tension between decentralized principles and regulatory pressures, THORChain founder JP Thor, who claims to have stepped away from active involvement, strongly advocated against any cooperation with law enforcement. He argued that THORNode operators should remain steadfast in their commitment to decentralization and permissionless transactions. Thor articulated his stance by stating, "IMO if THORNodes decided to take the protocol offline next week then the experiment is over. The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed."
The THORChain protocol can be halted if a supermajority of node operators (one-third plus one) vote to do so. Alternatively, individual nodes can opt out of processing transactions. The network is designed to remain operational with as few as four nodes processing transactions, underscoring its resilience and decentralized architecture.
Further complicating the attackers’ movements, Lookonchain reported that the hackers have also employed the cross-chain platform Relay to swap approximately half of the $95.9 million in stolen SOL (Solana) into Bitcoin.
Broader Ramifications and Market Reactions
The immediate aftermath of the Binance hack saw a significant downturn in the broader cryptocurrency market. Crypto-related stocks, including those of Coinbase, Circle, and Strategy, experienced sharp declines. Despite the overall market dip, Strive CEO Matt Cole observed that Bitcoin demonstrated resilience, holding up better than expected. Cole expressed his conviction that "over any reasonable time frame, this does not change the investment thesis on Bitcoin." At the time of reporting, Bitcoin had recovered from a low of around $76.5K to trade at $77,745.
In a notable development, Nasdaq-listed firm Next Technology Holding announced its board had approved the divestment of its 5,833 Bitcoin treasury, valued at approximately $450 million, in the wake of the hack.
Concerns remain regarding the potential market impact of the stolen funds. Reports suggest the attackers may have amassed over 18,000 Bitcoin and 430,000 Ether. However, analyses of the addresses identified by the FBI suggest these figures could be significantly higher, potentially reaching 551,612 ETH and 18,270 BTC. A rapid sell-off of these substantial holdings could exert considerable downward pressure on the prices of both Bitcoin and Ether.
The incident has also reignited calls for enhanced regulatory oversight. Senator Cynthia Lummis and The Digital Chamber have both leveraged the hack as a catalyst to push for the implementation of comprehensive cryptocurrency legislation, aiming to prevent and mitigate the impact of future security breaches.
Security Alerts and Legal Developments
Beyond the Binance incident, the cryptocurrency security landscape has seen further alerts. Trezor, a prominent hardware wallet manufacturer, has issued a warning to its customers. They have urged individuals who purchased Trezor hardware wallets from former authorized reseller CryptoBilis since March to move their funds immediately. This advisory follows reports of a suspected implant within a Trezor Safe 5 device. Trezor confirmed receiving a report from a customer in Indonesia who discovered an unauthorized circuit board inside a device purchased in August. While Trezor has not yet examined the device and has received no reports of related financial losses, this situation echoes similar concerns previously raised about Ledger wallets sold through CryptoBilis, where an unauthorized hardware implant was confirmed.
In a separate legal development, two brothers from Texas, Raymond Christian Garcia and Isiah Angelo Garcia, have been sentenced to substantial prison terms for their involvement in an armed cryptocurrency robbery and kidnapping. They received 180 months and 186 months, respectively, for their roles in the September 2025 incident in Grant, Minnesota, where they held a family at gunpoint and demanded access to their crypto accounts. The brothers had previously pleaded guilty to the charges in June.
Market Performance and Analysis
At the close of the week, the cryptocurrency market exhibited mixed performance. Bitcoin (BTC) experienced a 3% decline, trading at $77,745. Ethereum (ETH) saw a 3.5% drop to $2,260, and XRP (XRP) was down 3.9% to $1.02. The total cryptocurrency market capitalization stood at $2.21 trillion, according to CoinMarketCap.
Among the top 100 cryptocurrencies, notable gainers for the week included Hyperliquid (HYPE) with a 13.7% increase, Midnight (NIGHT) at 12.6%, and Pepe (PEPE) also at 12.6%. Conversely, the most significant decliners were Curve DAO (CRV), down 18.6%, VeChain (VET) at 15.9%, and Worldcoin, which saw a 13.8% decrease.
Industry Predictions and Concerns
Standard Chartered’s Geoffrey Kendrick has posited that the Binance hack could serve as a catalyst for a significant shift towards decentralized exchanges (DEXs). Kendrick reiterated his confidence in Uniswap and its native token, UNI, noting that DEXs have remained impervious to exploits. He anticipates that the hack of Binance, the largest centralized exchange, will further accelerate the trend of increasing trading volume on DEXs relative to centralized exchanges (CEXs). Currently, this ratio stands around 23.5%. Kendrick maintains a $100 price target for UNI in 2030 and suggests that the Binance incident may even render this forecast conservative.
On the regulatory front, CFTC Chair Mike Selig has voiced concerns about the potential implications of autonomous AI agents in financial markets. Selig highlighted that such agents could challenge existing financial regulations designed for human traders and necessitate a proactive adaptation by regulators. He acknowledged that advanced AI could democratize access to sophisticated risk management tools for smaller traders and businesses. However, he cautioned that increased autonomy also introduces new risks, including unpredictable agent behavior, correlated trading patterns among similar AI models, and complications in market surveillance and risk management due to the speed of autonomous transactions.
In a separate cybersecurity incident, blockchain analytics firm Chainalysis reported being targeted in a security breach. While initial investigations indicated no unauthorized access to sensitive investigation content or authentication credentials, some non-sensitive customer data, including user IDs, names, and email addresses, was exposed. Chainalysis stated that the incident was not related to the Binance hack and that they are leveraging large language models to enhance their security review processes.
Top Magazine Features and Editorials
This week’s Cointelegraph Magazine features delved into several critical topics shaping the cryptocurrency landscape. An article titled "Bitcoin turns 18: Has the original rebel grown up?" explored the cryptocurrency’s evolution amidst contemporary challenges like AI-driven security threats, quantum computing fears, and major exchange hacks. Another piece, "Binance hackers raced to move billions before it could be frozen," provided an in-depth look at the attackers’ strategy to convert stolen stablecoins into less controllable cryptocurrencies. The magazine also featured an article questioning whether gold’s potential "infinite mint bug" could bolster Bitcoin’s position as digital gold.
The "Prediction of the Week" section highlighted Standard Chartered’s analysis suggesting the Binance hack could accelerate the shift to DEXs, with a strong endorsement of Uniswap. Conversely, the "Top FUD of the Week" focused on CFTC Chair Mike Selig’s warnings regarding the potential dangers of AI agents in financial markets.
