Binance completes its latest proof of reserves while gradually restoring withdrawals to customers, a critical step in recovering from the record $6.3 billion hack that compromised the exchange's hot wallet systems. The exchange announced Sunday it had begun restoring withdrawals, a process that follows Thursday's massive breach which remains the largest cryptocurrency theft in history.
Binance confirmed the attack originated from a hacked employee laptop before investigators identified additional breach points within the network's infrastructure. The company pledged to cover all losses and has been working closely with U.S. Authorities to trace and recover the stolen assets.
Sunday's proof of reserves represents a significant milestone in the exchange's recovery efforts and aims to restore customer confidence in the platform's security measures.
Chainalysis revealed Sunday that Binance hackers had begun converting stolen Solana tokens into Bitcoin, swapping 486,970 SOL tokens worth approximately $46.4 million through Relay. This marks a new phase in the laundering campaign as the attackers expand their activities onto Solana networks after largely emptying temporary holding wallets on Tron.
The stolen funds represent a portion of the estimated $3.5 billion still controlled by the North Korean TraderTraitor hackers, according to blockchain investigators.
THORChain's network status page confirmed Saturday that node operators paused swaps involving assets on 10 blockchain networks, including Bitcoin, Ethereum, Solana and Tron. The trading halt came after an Ethereum block reorganization exposed a critical refund vulnerability that could allow malicious actors to exploit the system.
The protocol's team discovered the bug when a one-block reorg removed a 10 ETH deposit that THORChain had already credited, triggering an automatic pause when the swap failed to meet price limits.
The emergency pause has significantly slowed the Binance hackers' fund movement, according to Chainalysis. The disruption prevents all users, including the North Korean launderers, from using cross-chain swaps through a majority of THORChain's bridges. U.S.
Authorities, including the FBI, U.S. Secret Service and IRS Criminal Investigation, urged THORChain node operators and DeFi services Saturday to block transactions associated with addresses used by TraderTraitor to launder proceeds from the Binance hack. The FBI published wallet addresses linked to the stolen assets and expects further laundering through DeFi and instant swap services.
Gate exchange froze two accounts linked to the theft but did not disclose the amount frozen. The FBI attributed Thursday's breach to North Korea's TraderTraitor hackers and published multiple wallet addresses associated with the stolen funds.
Investigators had observed the hackers converting stolen assets primarily into Ether and expected them to use DeFi and instant swap services for further laundering. Binance began restoring withdrawals Sunday and has pledged to cover all losses from the massive breach.