Binance reopens withdrawals, sees net outflow of $3.64B
Binance has reopened withdrawals for 15 blockchain networks, after $6.3 billion was stolen by North Korean hackers from its hot wallets late last week.
Binance said today it had processed around $4.65 billion in withdrawals after reopening and received $1 billion in deposits. Founder Changpeng Zhao said that in the first 12 hours there had only been a 2.1% net outflow and that “98% choose to stay!”
About 95% of the stolen crypto has already been replenished, using a mixture of Binance’s corporate reserves, insurance and 50% of the funds in the Secure Asset Fund for Users (SAFU).
The biggest hack in history happened on Thursday, when North Korea’s TraderTraitor group gained access to delegated wallet permissions via a compromised laptop. Blockaid CEO Ido Ben-Natan told Cointelegraph that attackers could have stolen the funds without using EIP-7702 (account abstraction), but it may have helped them bypass safeguards and drain assets in one sweep.
Binance co-CEO Richard Teng rejected the idea the hack could be attributed to a single compromised laptop.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” he said. “Our investigation has not attributed responsibility to any individual.”
FBI and Secret Service swoop in to help save billions
Zhao thanked the Secret Service today for “acting within minutes to help track and freeze stolen funds… your speed, expertise and dedication helped contain the damage.”
Elliptic estimated that about $2.84 billion of the stolen assets, mostly USDC and USDT, had been frozen on chain. The attacker raced against time to beat the unprecedented stablecoin blocks by borrowing about $44.6 million of ETH against stablecoins on Aave.
The FBI attributed blame for the attack to the TraderTraitor hackers, which are part of North Korea’s Lazarus Group and were also blamed for multibillion hacks of Bybit and Bitget. President Donald Trump indicated “we’ll talk to North Korea about it.” The FBI also released a list of addresses connected to the hack and pointedly singled out THORnode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset service providers to block transactions with or derived from addresses.
Source: CZ
THORChain founder rejects freeze request
The North Korean hackers have used THORChain to permissionlessly swap cryptocurrencies following previous attacks, and the price of the protocol’s native token RUNE jumped 13% in expectation of all those fees.
Unfortunately for TraderTraitor, nine chains on THORChain, including Bitcoin, Ethereum and Tron on THORChain, are currently halted after automated systems paused the protocol for unrelated reasons shortly after the hack occurred.
According to THORChain developer Chad Barraford on the Unchained podcast, only around 50 or so individuals operate the 100 THORChain nodes. If the node operators refuse to halt the protocol or block addresses, as seems likely based on past incidents and public statements, they could face prosecution given the scale of the thefts and the involvement of the FBI and Secret Service.
THORChain founder JP Thor (who claims he is no longer involved) argued strongly that THORNode operators should not cooperate and should remain true to the ideals of decentralization and permissionlessness. “IMO if THORNodes decided to take the protocol offline next week then the experiment is over,” he said.
“The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.”
THORnode operators are able to vote with a two thirds majority to halt the network, and they can also leave the network if they do not wish to process the funds. THORChain can operate with as few as four nodes processing transactions.
Lookonchain reports the attackers have also been using cross chain platform Relay to swap $95.9 million of stolen SOL into Bitcoin.
Source: JP Thor
Ramifications of the hack
Crypto related stocks including Coinbase, Circle and Strategy sold off sharply following the hack, and crypto markets took a dive. But Strive CEO Matt Cole commented on Friday that Bitcoin had held up better than expected.
“I do have conviction that over any reasonable time frame, this does not change the investment thesis on Bitcoin,” Cole said. Bitcoin bottomed out around $76.5K and had recovered to 77,745 at the time of writing.
In the wake of the attack, Nasdaq-listed firm Next Technology Holding announced its board has approved selling off its 5833 Bitcoin Treasury worth around $450 million.
The attackers have amassed at least 18,000 stolen Bitcoin and 430,000 Ether, although some tallies of the funds in the addresses identified by the FBI put the tally much higher. There are concerns that if those currencies are sold off quickly, that it would put downward…
cointelegraph.com