$3.64B flees Binance on reopen, THORChain co-founder opposes coin freeze: Hodler’s Digest

Binance reopened withdrawals across 15 blockchain networks after North Korean hackers stole $6.3 billion from its hot wallets. The reopening tested whether users would quickly remove their funds or keep them on the exchange. It also showed how confidence can shift immediately after a major security breach.

Binance reported roughly $4.65 billion in withdrawals and $1 billion in deposits. Changpeng Zhao said the first 12 hours brought only a 2.1% net outflow, adding that 98% chose to stay. DeFi Helix recorded $4.54 billion in outflows over 24 hours, though that figure might include internal transfers or new hot-wallet movements.

Binance said it had replenished about 95% of the stolen crypto using corporate reserves, insurance, and half of its SAFU fund. The different tracking figures show why exchange flows can be difficult to measure precisely. Still, the reopening produced a large withdrawal wave without an immediate collapse in user balances.

The reopening produced a dramatic imbalance: Binance reported about $4.65 billion in withdrawals against $1 billion in deposits. That means withdrawals exceeded deposits by roughly $3.65 billion, close to the $3.64 billion net outflow highlighted in the article. The figures capture the immediate pressure on the exchange after the hack.

Binance said about 95% of the stolen crypto had already been replenished. It used corporate reserves, insurance, and 50% of the funds in its Secure Asset Fund for Users. Separately, Elliptic estimated that around $2.84 billion of stolen assets, mostly USDC and USDT, had been frozen on-chain.

These figures measure different things. Replenishment concerns Binance replacing stolen assets, while freezing concerns stopping access to specific stolen tokens. The attacker still held about $3.33 billion after the freezes, according to Elliptic. DeFi Helix’s $4.54 billion outflow estimate may include internal transfers.

A hot wallet is a cryptocurrency wallet connected to the internet or routinely accessible through online systems. Exchanges use hot wallets to process withdrawals and other transactions quickly. That accessibility also creates a security risk, because an attacker who gains the right permissions may reach many assets without physically controlling the underlying devices.

The article says North Korea’s TraderTraitor group gained access to delegated wallet permissions through a compromised laptop. Delegated permissions allow approved software or accounts to act for a wallet within defined limits. Blockaid’s CEO said the funds could have been stolen without EIP-7702, but the feature may have helped attackers bypass safeguards and drain assets in one sweep.

Binance co-CEO Richard Teng rejected the idea that one laptop or one engineer caused the hack. He said the attacker did not simply use one person’s permissions and that it was not a single one-click action. Binance’s investigation had not assigned responsibility to any individual.

Some stablecoins include issuer-controlled controls that can prevent tokens linked to flagged addresses from moving. Authorities can identify suspect wallets, share their addresses, and ask issuers or service providers to block transactions involving them. The article describes unprecedented stablecoin blocks involving stolen USDC and USDT, supported by the FBI and Secret Service.

Elliptic estimated that roughly $2.84 billion of stolen assets had been frozen on-chain. The FBI released addresses connected to the hack and urged THORnode operators, RPC operators, instant exchanges, DeFi services, analytics firms, and other providers to block transactions with those addresses or funds derived from them. Zhao credited the Secret Service with helping track and freeze the funds.

The freezes sharply reduced what the attackers could freely move. Elliptic estimated they still had about $3.33 billion. Before more blocks took effect, the attackers borrowed about $44.6 million of ETH against stablecoins on Aave, racing to convert or relocate value before controls spread.

THORChain is a cross-chain protocol that allows cryptocurrency swaps between different blockchain networks. Its permissionless design aims to let transactions proceed without a central authority deciding which users or assets may move. That feature matters because it can keep a market open even when traditional exchanges or issuers block particular addresses.

The article says North Korean hackers used THORChain to permissionlessly swap cryptocurrencies after previous attacks. The protocol’s RUNE token rose 13% as traders anticipated fees from the expected activity. The attackers’ access was limited, however, because nine chains on THORChain, including Bitcoin, Ethereum, and Tron, had been halted by automated systems for unrelated reasons.

The FBI specifically urged THORnode operators and other crypto services to block transactions linked to the hack. If THORChain remains open, it may provide a route around centralized freezes. If operators halt it, they may help contain the theft but risk undermining the protocol’s stated permissionless model.

After the hack, the attackers used several routes besides direct transfers. Their goal was to exchange or reposition assets before stablecoin issuers and other services could block them. Cross-chain services and lending platforms gave them different ways to change the form or location of the stolen value.

The attackers borrowed about $44.6 million of ETH against stablecoins on Aave. They also used the cross-chain platform Relay to swap about half of $95.9 million in stolen SOL into Bitcoin, according to Lookonchain. THORChain was another route for permissionless cryptocurrency swaps, although nine of its chains were halted by automated systems.

These moves show the race between laundering attempts and intervention. Borrowing against stablecoins could provide immediately movable ETH, while cross-chain swaps could shift assets into another network. The FBI responded by publishing connected addresses and calling on node operators, exchanges, DeFi services, and analytics firms to block related transactions.

Decentralization means a network’s decisions and operation are distributed among multiple participants rather than controlled by one central authority. In cryptocurrency, that structure can support censorship resistance and permissionless settlement. It can also make emergency intervention harder when assets are linked to a major theft.

THORChain developer Chad Barraford said about 50 individuals operate its 100 nodes. More than one third plus one of the node operators can vote to halt activity. Operators can also leave if they do not want to process the funds, while the network can function with as few as four nodes. These controls give a small group substantial influence.

That creates a direct conflict. Operators may face prosecution if they refuse requests from the FBI and Secret Service, yet JP Thor argued that cooperation would destroy the protocol’s neutral, permissionless purpose. Halting could block stolen funds, but doing so could also show that the network is not truly censorship resistant.