Binance THORChain Clash Erupts After $6.3B Hack and Withdrawals Resume

The aftermath of the largest cryptocurrency theft in history has triggered a high-stakes binance thorchain conflict across decentralized finance, following the reopening of withdrawals on the compromised exchange. Binance resumed customer transfers across 15 blockchain networks after North Korean cybercriminals linked to the TraderTraitor group looted $6.3 billion from hot wallets. After resuming operations, Binance processed approximately $4.65 billion in withdrawals alongside $1 billion in incoming deposits, resulting in roughly $3.65 billion in net outflows. Founder Changpeng Zhao stated that net outflows reached just 2.1 percent during the initial 12 hours, asserting that 98 percent of users chose to keep their assets on the exchange.

Binance restored withdrawals after a record $6.3 billion hack as decentralized node operators resisted transaction freezes.

Exchange leadership confirmed that about 95 percent of the missing digital assets have already been replaced through a combination of corporate balance sheets, insurance cover, and half of the Secure Asset Fund for Users. The massive breach occurred when attackers compromised delegated wallet permissions. While external security researchers suggested that account abstraction features under EIP-7702 may have facilitated the rapid asset drain, Binance co-chief executive Richard Teng disputed claims that a single compromised device was responsible. Teng maintained that the breach was not an isolated one-click event involving one engineer, emphasizing that internal reviews have not pinned liability on any single individual. Zhao extended gratitude to the United States Secret Service for rapid interventions that helped freeze stolen funds within minutes.

Binance THORChain tensions amid FBI freeze demands

According to analytics firm Elliptic, around $2.84 billion of the stolen funds—predominantly Tether and USD Coin—were swiftly frozen on-chain, leaving perpetrators with approximately $3.33 billion. In response to blacklist efforts, the hackers rushed to borrow $44.6 million worth of Ether against stablecoins on Aave and converted part of a $95.9 million Solana cache into Bitcoin using the Relay cross-chain bridge. The Federal Bureau of Investigation, which formally attributed the incident to North Korea's TraderTraitor collective, published designated wallet addresses and explicitly urged THORnode operators, digital asset intermediaries, and decentralized protocols to halt transactions interacting with the illicit proceeds. President Donald Trump indicated that the United States would address the incident directly with North Korea.

However, the enforcement directive has exposed deep ideological fractures. THORChain founder JP Thor insisted that node operators should ignore requests to freeze funds, warning that taking the network offline to comply with law enforcement would destroy the core experiment of permissionless finance. Developer Chad Barraford warned that the roughly 50 individuals running the network's 100 validator nodes could risk legal prosecution if they decline to intervene. Currently, nine chains on THORChain remain paused due to unrelated automated network triggers, temporarily impeding the hackers from swapping their stolen assets.

Why it matters The crisis highlights the growing regulatory and operational vulnerabilities bridging centralized exchanges and decentralized protocols. If decentralized node operators face criminal exposure for maintaining protocol neutrality during state-sponsored hacks, it could permanently alter how cross-chain infrastructure operates globally. For cryptocurrency users worldwide, the incident underscores the persistent risks facing custodial hot wallets and demonstrates how rapid blacklisting and treasury liquidations can trigger wider market volatility.