Binance reopens withdrawals, sees net outflow of $3.64B
Binance has reopened withdrawals for 15 blockchain networks, after $6.3 billion was stolen by North Korean hackers from its hot wallets late last week.
Binance said today it had processed around $4.65 billion in withdrawals after reopening and received $1 billion in deposits. Founder Changpeng Zhao said that in the first 12 hours there had only been a 2.1% net outflow and that “98% choose to stay!”
About 95% of the stolen crypto has already been replenished, using a mixture of Binance’s corporate reserves, insurance and 50% of the funds in the Secure Asset Fund for Users (SAFU).
The biggest hack in history happened on Thursday, when North Korea’s TraderTraitor group gained access to delegated wallet permissions via a compromised laptop. Blockaid CEO Ido Ben-Natan told Cointelegraph that attackers could have stolen the funds without using EIP-7702 (account abstraction), but it may have helped them bypass safeguards and drain assets in one sweep.
Binance co-CEO Richard Teng rejected the idea the hack could be attributed to a single compromised laptop.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” he said. “Our investigation has not attributed responsibility to any individual.”
FBI and Secret Service swoop in to help save billions
Zhao thanked the Secret Service today for “acting within minutes to help track and freeze stolen funds... your speed, expertise and dedication helped contain the damage.”
Elliptic estimated that about $2.84 billion of the stolen assets, mostly USDC and USDT, had been frozen on chain leaving the hackers with $3.33 billion. The attacker raced against time to beat the unprecedented stablecoin blocks by borrowing about $44.6 million of ETH against stablecoins on Aave.
The FBI attributed blame for the attack to the TraderTraitor hackers, which is associated with North Korea’s Lazarus Group and were also blamed for multibillion hacks of Bybit and Bitget. President Donald Trump indicated “we’ll talk to North Korea about it.” The FBI also released a list of addresses connected to the hack and pointedly singled out THORnode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset service providers to block transactions with or derived from addresses.
Source: CZ
THORChain founder rejects freeze request
The North Korean hackers have used THORChain to permissionlessly swap cryptocurrencies following previous attacks, and the price of the protocol’s native token RUNE jumped 13% in expectation of all those fees.
Unfortunately for TraderTraitor, nine chains on THORChain, including Bitcoin, Ethereum and Tron on THORChain, are currently halted after automated systems paused the protocol for unrelated reasons shortly after the hack occurred.
According to THORChain developer Chad Barraford on the Unchained podcast, only around 50 or so individuals operate the 100 THORChain nodes. If the node operators refuse to halt the protocol or block addresses, as seems likely based on past incidents and public statements, they could face prosecution given the scale of the thefts and the involvement of the FBI and Secret Service.
THORChain founder JP Thor (who claims he is no longer involved) argued strongly that THORNode operators should not cooperate and should remain true to the ideals of decentralization and permissionlessness. “IMO if THORNodes decided to take the protocol offline next week then the experiment is over,” he said.
“The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.”
If one third plus one of THORnode operators vote in favor they can halt activity. Nodes can also leave the network if they do not wish to process the funds. THORChain can operate with as few as four nodes processing transactions.
Lookonchain reports the attackers have also been using cross chain platform Relay to swap about half of $95.9 million of stolen SOL into Bitcoin.
Source: JP Thor
Ramifications of the hack
Crypto related stocks including Coinbase, Circle and Strategy sold off sharply following the hack, and crypto markets took a dive. But Strive CEO Matt Cole commented on Friday that Bitcoin had held up better than expected.
“I do have conviction that over any reasonable time frame, this does not change the investment thesis on Bitcoin,” Cole said. Bitcoin bottomed out around $76.5K and had recovered to 77,745 at the time of writing. In the wake of the attack, Nasdaq-listed firm Next Technology Holding announced its board has approved selling off its 5833 Bitcoin Treasury worth around $450 million.
The attackers have reportedly amassed at least 18,000 stolen Bitcoin and 430,000 Ether (, although some tallies of the funds in the addresses identified by the FBI put the tally much higher at 551,612 ETH and 18,270 BTC. There are concerns that if those currencies are sold off quickly, that it would put downward pressure on BTC and ETH prices.
Meanwhile, Senator Cynthia Lummis and The Digital Chamber both used the hack to again push for crypto legislation to help prevent and mitigate the effects of future attacks.
Tampered Trezor linked to CryptoBilis reseller
Trezor has urged customers who bought its hardware wallets from former authorized reseller CryptoBilis since March to move their funds after a report of a suspected implant in a Safe 5 device.
Trezor said Friday that a customer in Indonesia reported an unauthorized circuit board inside a Trezor Safe 5 bought on Tokopedia in August. Trezor said it had not yet examined the device and had received no reports of related losses.
The warning follows reports of crypto losses involving Ledger wallets sold through CryptoBilis that surfaced on Oct. 9. Ledger confirmed an unauthorized hardware implant in one device.
Winners and Losers
At the end of the week, Bitcoin (BTC) is down 3% to trade at $77,745, Ethereum (ETH) is down 3.5% to trade at $2,260 and XRP (XRP) is down 3.9% to $1.02. The total market cap is at $2.21 trillion according to CoinMarketCap.
Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are Hyperliquid (HYPE) with a 13.7% gain, Midnight (NIGHT) on 12.6%, and Pepe (PEPE) on 12.6%.
The top three altcoin losers of the week are Curve DAO (CRV) which was down 18.6%, VeChain (VET) down 15.9% and Worldcoin down 13.8%.
Prediction of the Week
Binance hack could accelerate shift to DEXs: Standard Chartered
Standard Chartered’s Geoffrey Kendrick said one big winner from the hack was likely to be decentralized exchanges and reaffirmed his conviction in Uniswap and the UNI token.
“The decentralized exchange [Uniswap] has never had any exploits, and the hack of the largest centralized exchange, in Binance, should see the ratio of DEX to CEX trading continue to increase.”
The ratio is currently around 23.5%. Kendrick said he retains his $100 price target for Uniswap (UNI) for 2030. He said the Binance hack is “another reason why that forecast may end up being too low.”
Top FUD of the Week
CFTC chair warns of AI Agents dangers
CFTC chair Mike Selig says autonomous AI agents could challenge financial rules built around human traders, and regulators need to adapt. Selig said Super Intelligence (SI) could give smaller traders and businesses access to risk-management that was once reserved for larger institutions.
“SI can help process the vast amount of information significantly faster than human brain power and with greater accuracy,” he said.
But greater autonomy also comes with new risks. Agents could react unexpectedly to market conditions, while those using similar models could generate correlated trading behavior. The speed of autonomous transactions could also complicate market surveillance and risk management, he said.
Blockchain investigator Chainalysis hit by cybersecurity incident
Blockchain analytics company Chainalysis said it was targeted in a cybersecurity incident, similar to those suffered recently by other platforms.
“Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens,” it said in a blog post on Friday. Some non-sensitive customer data was exposed, including user IDs, names and email addresses.
Chainalysis said it was using large language models to review its security and added the incident was not related to the recent crypto theft at Binance.
Texas brothers sentenced to 15 years in prison for armed crypto robbery
Raymond Christian Garcia and Isiah Angelo Garcia, both of Waller, Texas, were sentenced to 180 months and 186 months in prison, respectively, for their armed robbery of cryptocurrency and kidnapping of a family in Grant, Minnesota.
The brothers were sentenced on Thursday before US District Judge Donovan W. Frank, according to a Friday news release. They had pleaded guilty in June.
On Sept. 19, 2025, the brothers, who had traveled from Texas to Minnesota, kidnapped Victim 1 and his family in their home at gunpoint, court documents said. They zip‑tied the family at gunpoint and held them for more than nine hours, demanding access to Victim 1’s cryptocurrency accounts.
Top Magazine Features of the Week
Bitcoin turns 18: Has the original rebel grown up?
In typical Bitcoin style, the number one cryptocurrency turns 18 amid AI-driven security threats, quantum fears and the biggest exchange hack in crypto history.
Binance hackers raced to move billions before it could be frozen
Attackers raced to convert stolen stablecoins into crypto that issuers could not freeze as industry players like Tether and Circle moved to immobilize billions of dollars in assets.
Will gold’s ‘infinite mint bug’ make Bitcoin more valuable?
A US fusion startup says it has turned mercury into gold. Could a potential increase in the gold supply strengthen Bitcoin’s claim to be a better form of digital gold?
