After experiencing the largest hacker attack in its history, Binance has resumed withdrawals. However, one of the co-founders of THORChain believes that the protocol should not be paused to accommodate the requirements of FBI.
Binance resumes withdrawals, with a net outflow of $3.64 billion
After $6.3 billion was stolen by North Korean hackers from its hot wallets later last week, Binance has re-enabled withdrawals for 15 blockchain networks.
Binance stated today that since the resumption of withdrawals, the platform has processed approximately $4.65 billion in withdrawals and received $1 billion in deposits. Founder Zhao Changpeng mentioned that within the first 12 hours, the net outflow was only 2.1%, and said, "98% chose to stay!"
According to the Binance wallet tracker for DeFi Llama, funds amounting to 4.54 billion US dollars were withdrawn within 24 hours. However, this data may include internal transfers or deposits into new hot wallets.
Approximately 95% of the stolen encrypted assets have been replenished. The sources of funds include Binance's corporate reserves, insurance, as well as 50% of the funds from the user security asset fund ( SAFU ).
The largest hacker attack in history occurred on Thursday, when North Korea's TraderTraitor organization obtained access to entrusted wallets through an infected laptop. The CEO of Blockaid, Ido Ben - Natan, told Cointelegraph that the attackers could have stolen funds without using EIP-7702 (account abstraction), but this mechanism may have helped them bypass security measures and empty assets all at once.
Anbin's Co-CEO, Richard Teng, denied that this hacking incident could be attributed to a single compromised laptop.
He said, "It needs to be clear that the attacker did not simply use the privileges of one engineer, and this was not a single 'one-click' operation. Our investigation has not yet attributed responsibility to any individual."
FBI and the Secret Service intervened to assist in recovering billions of dollars
Zhao Changpeng today thanked the Secret Service for ‘taking action within minutes to help track down and freeze the stolen funds... Your speed, professionalism, and dedication have helped to control the losses.’
Elliptic It is estimated that approximately $2.84 billion in stolen assets have been frozen on the blockchain, with the majority being USDC and USDT. Hackers still hold about $3.33 billion remaining. In order to transfer the funds before the unprecedented freeze of stablecoins, the attackers borrowed about $44.6 million in ETH using stablecoins as collateral on Aave.
FBI attributed this attack to the hacker group TraderTraitor, which is associated with North Korea's Lazarus Group and has also been implicated in several billion-dollar hacker incidents involving Bybit and Bitget. U.S. President Donald Trump stated, "We will talk about this matter with North Korea." FBI also released a list of addresses related to this hacking incident, specifically naming the operators of THORnode, RPC node operators, instant exchange services, DeFi services, blockchain analysis companies, and other digital asset service providers, and demanded that transactions related to or derived from these addresses be halted.
THORChain Founder refuses freeze request
North Korean hackers previously used THORChain to exchange cryptocurrencies without permission, and the price of the protocol's native token RUNE also rose by 13% due to expectations of high transaction fees. However, unfavorable for TraderTraitor is that 9 chains including Bitcoin, Ethereum, and Tron on THORChain were automatically suspended by the system not long after the attack for reasons unrelated to the hacking incident.
According to Chad Barraford, the developer from THORChain, in a podcast on Unchained, there are only about 50 people operating 100 THORChain nodes. If the node operators refuse to pause the protocol or block the relevant addresses, considering the scale of the theft and the involvement of FBI and the Secret Service, they may face prosecution.
The founder, JP Thor (who stated that he is no longer involved), strongly advocates that the operators of THORNode should not cooperate and should adhere to the principles of decentralization and permissionlessness. He said, "In my opinion, if THORNodes decides to take the protocol offline next week, then this experiment will be over."
"The last unconstrained, neutral settlement position will no longer exist. By then, there will be no other venues left, and the agreement will have failed as well."
If one-third plus one THORnode operator votes in favor, the activity can be suspended. If nodes are unwilling to process these funds, they can also exit the network. THORChain only requires as few as 4 nodes to process transactions in order to function.
Lookonchain reports that attackers have continued to use the cross-chain platform Relay to exchange about half of the $95.9 million stolen from SOL into Bitcoin.
The Impact of Cybersecurity Incidents
Cole indicates: "I am certain that, within any reasonable time frame, this will not change my investment logic in Bitcoin." Bitcoin once fell to around $76,500, but as of the time of writing this article, it has rebounded to $77,745. Following the hack incident, Next Technology Holding, a NASDAQ-listed company, announced that its board of directors had approved the sale of its 5,833 Bitcoin assets, valued at approximately $450 million.
It is reported that the attackers have accumulated at least 18,000 Bitcoins and 430,000 Ether through theft and subsequent exchanges. However, some of the funds in the identified addresses FBI amount to a higher total, reaching 551,612 ETH and 18,270 BTC. There are concerns that if these cryptocurrencies are quickly sold off, it could put downward pressure on the prices of BTC and ETH.
At the same time, Senators Cynthia Lummis and The Digital Chamber are also taking this opportunity to push for cryptocurrency legislation again in order to help prevent and mitigate the impact of future attacks.
Trezor tampering incident related to CryptoBilis resellers
Trezor has urged customers who purchased their hardware wallets from the previously authorized reseller CryptoBilis since March to transfer their funds, as there are reports that 5 devices from Safe may contain implants.
Trezor On Friday, it was reported that a customer from Indonesia claimed to have discovered unauthorized circuit boards inside the Trezor Safe they purchased in Tokopedia in August. Trezor stated that the device has not yet been inspected, and no loss reports related to this issue have been received.
This warning follows closely on the report of encrypted asset losses related to the Ledger wallet that was disclosed on October 9th. At that time, Ledger confirmed the presence of unauthorized hardware implants in one device.
Weekly Winners and Losers
As of the end of this week, Bitcoin ( BTC ) has fallen by 3% to $77,745; Ethereum ( ETH ) has fallen by 3.5% to $2,260; XRP ( XRP ) has fallen by 3.9% to $1.02. According to CoinMarketCap data, the total market value is $2.21 trillion.
Among the top 100 cryptocurrencies by market capitalization, the top three altcoins with the highest gains this week are Hyperliquid ( HYPE ), which rose by 13.7%; Midnight ( NIGHT ), which rose by 12.6%; and Pepe ( PEPE ), which also rose by 12.6%.
The top three altcoins with the largest declines this week are Curve DAO ( CRV ), down 18.6%; VeChain ( VET ), down 15.9%; and Worldcoin, down 13.8%.
This Week's Forecast
Standard Chartered: The Binance hack incident may accelerate the DEX shift
Geoffrey Kendrick of Standard Chartered indicates that a major winner in this hacking incident is likely to be decentralized exchanges, and he reiterated his bullish views on Uniswap and UNI tokens.
He said, "Decentralized exchanges [Uniswap] have never experienced any vulnerabilities, while the world's largest centralized exchange, Binance, has been attacked by hackers, which should continue to increase the trading proportion of DEX and CEX. Currently, this proportion is around 23.5%." Kendrick stated that he still maintains a target price of $100 for Uniswap ($UNI) by 2030, and referred to the Binance hack as "another reason that indicates this prediction may ultimately be too low."
This week's biggest FUD
CFTC Chairman's Warning AI Intelligence Entity Risks
CFTC The chairman Mike Selig stated that autonomous AI intelligents may challenge the financial rules established around human traders, and regulatory authorities need to adapt. He said that super intelligence SI can enable small traders and enterprises to gain risk management capabilities that were previously only available to large institutions.
“SI can process massive amounts of information faster and more accurately than the human brain,” he said.
Blockchain research firm Chainalysis encounters a cybersecurity incident
Blockchain analysis firm Chainalysis stated that the company has encountered a cybersecurity incident, similar to attacks that other platforms have suffered recently.
In a blog post on Friday, the company stated: "Based on the investigations conducted so far, we have not found any evidence that investigation content, authentication credentials, or session tokens have been accessed without authorization." However, some non-sensitive customer data has been leaked, including user ID, names, and email addresses.
Two brothers from Dezhou sentenced to 15 years in prison for armed cryptocurrency robbery
Raymond Christian Garcia and Isiah Angelo Garcia from Waller, Texas, were sentenced to 180 months and 186 months of imprisonment respectively for robbing a cryptocurrency with a gun and kidnapping a family in Grant, Minnesota.
According to a press release issued on Friday, the two were sentenced on Thursday in front of U.S. Federal District Judge Donovan W . Frank. They had pleaded guilty in June.
Court documents state that on September 19, 2025, after traveling from Texas to Minnesota, the brothers kidnapped victim 1 and her family at their home armed with guns. They tied up the entire family with tape and held them hostage for over 9 hours under the threat of guns, demanding that victim 1 provide access to her cryptocurrency accounts.
This week's magazine featured articles
Bitcoin is 18 years old: Has the original rebel grown up?
In the typical Bitcoin style, this top-tier cryptocurrency celebrates its 18th birthday against the backdrop of security threats driven by AI, quantum computing concerns, and the largest exchange hacking incident in the history of cryptography.
Before their assets were frozen, Binance hackers transferred billions of dollars in a race against time.
As industry participants such as Tether and Circle begin to freeze billions of dollars in assets, attackers are also racing against time to convert the stolen stablecoins into cryptoassets that the issuers cannot freeze.
Will the "infinite minting loophole" of gold make Bitcoin more valuable?
A US fusion startup claims to have converted mercury into gold. Could this potential increase in gold supply strengthen the case for Bitcoin as a superior digital gold?
Binance
Hacker attack
North Korea
Bitcoin
