Binance processed approximately $4.65 billion in withdrawals and received about $1 billion in deposits after reopening withdrawals, resulting in a reported net outflow of $3.64 billion. Founder Changpeng Zhao said the net outflow during the first 12 hours was 2.1%, adding that 98% of users had chosen to remain on the platform.
The exchange said roughly 95% of the stolen cryptocurrency had been replenished through corporate reserves, insurance and half of the funds in its Secure Asset Fund for Users. The theft, described in the report as the largest hack in crypto history, involved access to delegated wallet permissions through a compromised laptop. Binance co-CEO Richard Teng said the incident was not attributable to a single engineer or a one-click action.
The FBI attributed the attack to TraderTraitor, a North Korean group associated with the Lazarus Group. The agency released wallet addresses linked to the theft and urged THORNode operators, RPC providers, instant exchanges, decentralized finance services, blockchain analytics companies and other digital-asset firms to block transactions involving the addresses or funds derived from them.
The Secret Service helped track and freeze some of the stolen assets. Elliptic estimated that approximately $2.84 billion, mainly in USDC and USDT, had been frozen on-chain. The attackers reportedly borrowed about $44.6 million in Ether against stablecoins on Aave while attempting to move funds before further freezes took effect.
The incident renewed debate over THORChain’s response. The attackers used the protocol to swap cryptocurrencies, contributing to a 13% rise in the price of its RUNE token as traders anticipated increased fees. Nine chains connected to THORChain, including Bitcoin, Ethereum and Tron, were already halted by automated systems for unrelated reasons after the hack.
THORChain co-founder JP Thor, who says he is no longer involved with the project, argued that THORNode operators should not take the protocol offline or block specific addresses. He said doing so would undermine the network’s decentralization and permissionless design. Operators can vote by a two-thirds majority to halt the network, leave if they do not want to process the funds, or continue operating under the protocol’s rules. THORChain can function with as few as four nodes processing transactions.
Lookonchain also reported that the attackers used the cross-chain platform Relay to convert $95.9 million in stolen Solana into Bitcoin. The report said the wallets associated with the attackers contained at least 18,000 Bitcoin and 430,000 Ether, although other estimates based on addresses identified by the FBI were higher.
The hack pressured crypto-related stocks and broader digital-asset markets. Bitcoin was reported at $77,745, down 3% for the week, while Ether stood at $2,260, down 3.5%, and XRP at $1.02, down 3.9%. The total cryptocurrency market capitalization was listed at $2.21 trillion.
The report also noted that Nasdaq-listed Next Technology Holding had approved the sale of its 5,833-bitcoin treasury, valued at approximately $450 million. Senator Cynthia Lummis and The Digital Chamber used the incident to renew calls for cryptocurrency legislation aimed at preventing and mitigating future attacks.
Sources: Cointelegraph.