Binance has reopened withdrawals for 15 blockchain networks following a historic $6.3 billion theft from its hot wallets, attributed by the FBI to North Korea’s TraderTraitor group. The exchange processed approximately $4.65 billion in withdrawals and received $1 billion in deposits shortly after resuming operations, with founder Changpeng Zhao noting a net outflow of only 2.1% in the first 12 hours. About 95% of the stolen assets have been replenished using corporate reserves, insurance, and half of the Secure Asset Fund for Users (SAFU).
The attack involved compromised delegated wallet permissions, potentially utilizing EIP-7702 account abstraction to bypass safeguards. While Binance co-CEO Richard Teng rejected claims that a single compromised laptop was solely responsible, the incident triggered significant market volatility. Crypto stocks such as Coinbase and Strategy sold off sharply, though Bitcoin recovered to trade around $77,745 after bottoming near $76,500.
In response to the hack, law enforcement agencies including the Secret Service and FBI worked to freeze stolen funds, with Elliptic estimating $2.84 billion had been immobilized on-chain. However, tensions have emerged within the decentralized finance sector regarding compliance with these directives. THORChain founder JP Thor publicly opposed halting the protocol or blocking addresses, arguing it would undermine decentralization ideals. Meanwhile, nine chains on THORChain remain halted due to unrelated automated system pauses, preventing immediate swaps for the attackers who previously used the platform.
The rapid restoration of liquidity at Binance highlights the resilience of centralized exchanges backed by substantial reserves, yet it underscores the persistent vulnerability of hot wallet infrastructure to sophisticated state-sponsored attacks. The reliance on SAFU and corporate funds to cover losses demonstrates a proactive risk management strategy, but the scale of the theft raises questions about the adequacy of current security protocols against advanced threats like account abstraction exploits.
The conflict between regulatory enforcement and decentralized principles is starkly illustrated by the THORChain controversy. As authorities seek to freeze stolen assets, the refusal of some DeFi operators to comply creates a legal and ethical gray area. This tension may accelerate the bifurcation of the crypto market into compliant centralized entities and resistant decentralized protocols, potentially increasing regulatory scrutiny on node operators and developers who facilitate illicit flows despite official warnings.
