Binance has reopened withdrawals for 15 blockchain networks after a massive security breach that saw roughly $6.3 billion stolen from its hot wallets, according to the exchange. The decision has not fully ended the fallout, but it has helped stabilize user confidence by allowing funds to move again while investigations and on-chain freezing efforts continue.
In a statement accompanying the restart, Binance said it processed about $4.65 billion in withdrawals after withdrawals reopened and also received $1 billion in deposits. Founder Changpeng Zhao added that early withdrawals showed only a small net outflowโaround 2.1% in the first 12 hoursโsuggesting most customers were choosing to stay.
Key takeaways
- Binance reopened withdrawals for 15 networks after a $6.3 billion hot-wallet theft attributed to North Korean-linked hackers.
- Binance reported about $4.65 billion in withdrawals and $1 billion in deposits post-reopening, implying a limited early net outflow of roughly 2.1%.
- Binance said around 95% of the stolen crypto has already been replenished using a mix of corporate reserves, insurance, and SAFU.
- Regulators and law enforcementโincluding the FBI and Secret Serviceโwere reported to be actively involved in tracking and freezing stolen funds on-chain.
- Other industry knock-on effects include increased attention to DEX usage, plus separate warnings about hardware-wallet implants tied to certain retail channels.
Withdrawals restart as Binance quantifies early flows
Binance reopened withdrawals for 15 blockchain networks after hackers stole funds from its hot wallets late last week. The exchangeโs update followed a period of disruption across the impacted networks, during which users could not withdraw assets normally.
Binance said it had processed approximately $4.65 billion in withdrawals after reopening while receiving around $1 billion in deposits. Zhao also said that, within the first 12 hours, the platform saw only about a 2.1% net outflow and that โ98% choose to stay,โ implying customers were largely not rushing to exit.
Binance further claimed that about 95% of the stolen crypto had already been replenished. The exchange said it funded the recovery through โa mixtureโ of its corporate reserves, insurance, and 50% of funds from the Secure Asset Fund for Users (SAFU), a key part of its capital protection framework.
How the breach happenedโand why details matter
The breach, one of the largest ever reported in crypto, occurred after attackers gained access to delegated wallet permissions through a compromised laptop, according to coverage cited by Cointelegraph. Blockaid CEO Ido Ben-Natan told Cointelegraph that the attackers could potentially have stolen funds without relying on EIP-7702 (account abstraction), but that it may have helped them bypass safeguards and drain assets in a more coordinated way.
Binance co-CEO Richard Teng rejected the idea that the incident could be explained by a single compromised engineerโs permissions. In the exchangeโs account of its investigation, Teng said the action was not a one-click scenario and that responsibility had not been attributed to any individual.
That distinction has practical implications for users and the broader industry: when breaches are framed as systemic authorization failures rather than isolated device compromises, investors tend to look harder at exchange security models, internal permissioning controls, and incident response readinessโnot just endpoint hygiene.
Law enforcement and on-chain freezing efforts continue
Zhao publicly thanked the Secret Service, saying it acted โwithin minutesโ to help track and freeze stolen fundsโefforts aimed at limiting the attackersโ ability to convert and cash out.
Elliptic estimated that about $2.84 billion of the stolen assets, mostly USDC and USDT, had been frozen on-chain, leaving hackers with an estimated $3.33 billion. The attacker reportedly raced against time to beat stablecoin freezing windows by borrowing about $44.6 million in ETH against stablecoins on Aave, illustrating how quickly stolen liquidity can be rerouted when freeze controls lag issuance-level or issuer-level actions.
The FBI attributed the hack to the TraderTraitor group, associated with North Koreaโs Lazarus Group. The FBI also released a set of addresses linked to the theft and singled out various infrastructure categoriesโsuch as THORnode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other digital asset service providersโurging them to block transactions involving addresses connected to the stolen funds.
THORChain controversy: freeze requests rejected amid halted chains
The breach has also intersected with THORChain, where North Korean-linked actors reportedly used permissionless swapping after previous attacks. In the period following the hack, the price of THORChainโs native token, RUNE, jumped on anticipation of fee generation from the attackersโ activity.
However, the protocolโs status created friction for the attackers. Cointelegraph reported that nine chains on THORChain, including Bitcoin, Ethereum, and Tron via THORChain, were halted by automated systems for unrelated reasons shortly after the hack.
Cointelegraph also cited discussion on the Unchained podcast in which THORChain developer Chad Barraford said only around 50 individuals operate the networkโs roughly 100 nodes. That smaller operator set raises a governance and enforcement question: whether node operators will refuse to process or route funds connected to the theft when regulators and law enforcement ask for targeted blocking.
THORChain founder JP Thor, who said he is no longer involved with the protocol, argued against cooperating with requests to take the network offline. He said, in essence, that if THORNodes decided to halt activity next week, the experiment would be overโframing the situation as a test of decentralization and permissionlessness. Technically, THORChain can halt activity if more than one-third plus one node operators vote in favor. Node operators can also leave the network if they do not want to process transactions, and the protocol can theoretically run with as few as four nodes processing transactions.
Separate reporting referenced by Cointelegraph via Lookonchain said the attackers used Relay to swap about half of approximately $95.9 million in stolen SOL into Bitcoin. This matters because it points to multi-step conversion behavior designed to move stolen assets across liquidity venues faster than targeted controls can fully contain them.
Broader market effects and follow-on push for policy
Beyond Binance, the hack triggered sharp moves in crypto-related equities and renewed focus on market vulnerabilities. Cointelegraph reported that crypto stocks including Coinbase, Circle, and Strategy sold off following the breach, while some executives argued that Bitcoin held up relatively better than expected.
In parallel, Next Technology Holdingโlisted on Nasdaqโannounced its board approved selling off its 5,833 Bitcoin treasury, reportedly worth around $450 million. The scale of potential selling is relevant for liquidity and volatility considerations, especially given concerns (raised in the reporting) that swift conversion by attackers could add downward pressure to Bitcoin and Ether.
The reporting also notes that lawmakers used the incident to press for additional crypto legislation aimed at improving safeguards and mitigation capabilities. Senator Cynthia Lummis and The Digital Chamber were cited as advocating for policy changes in the wake of the theft.
Hardware wallet warning adds a separate layer of risk
Alongside the Binance breach, Trezor issued a customer warning for users who purchased certain hardware wallets from former authorized reseller CryptoBilis since March. Trezor said a customer report from Indonesia described an unauthorized circuit board inside a Trezor Safe 5 device bought on Tokopedia in August. Trezor stated it had not yet examined the device and had not received reports of related losses.
The warning followed earlier reporting, cited by Cointelegraph, about crypto losses involving Ledger wallets sold through CryptoBilis. Ledger had confirmed an unauthorized implant in one device, underscoring that supply-chain and retail-channel compromises can become a parallel threat even when the focus elsewhere is exchange security.
What to watch next
As Binance continues to process withdrawals and replenishes remaining stolen funds, the key signals for users will be whether withdrawals remain stable across the reopened networks, how quickly law enforcement-linked blocking efforts reduce attacker liquidity, and whether THORChain node operators ultimately align withโor resistโcalls to neutralize specific stolen-fund routes. Separately, hardware-wallet warnings tied to resellers highlight that incident risk in crypto is not confined to exchanges.
