Crypto news, hardwired.

Blog

  • Binance Reports $3.64 Billion Net Outflow as First Withdrawal Phase Completes

    Binance Reports $3.64 Billion Net Outflow as First Withdrawal Phase Completes

    Binance said Sunday that it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 1:00 AM and 10:30 AM ET, leaving a net outflow of about $3.64 billion in the first hours after it reopened withdrawals following last week’s hack.

    In a post late Sunday morning, the exchange said that figure equals 2.1% of its $171 billion in total assets under management, based on its latest published proof-of-reserves data, dated Oct. 28. It said withdrawal volumes spiked at first, then declined and were stabilizing, while deposits stayed “substantial.”

    All 15 networks in the first phase were live by 7:36 AM ET, Binance said, covering assets including BTC, ETH, BNB, XRP, SOL, USDT and USDC. Remaining networks are still being tested, and the exchange said it would share details of the next phase when ready. Its help desk said prediction-market withdrawals and new VIP and flexible-rate loan borrowing remain paused.

    On reserves, Binance said the new snapshot was taken at 8:00 PM ET Friday and that the updated report is expected on its proof-of-reserves website on Monday. That is earlier than Saturday’s estimate, which pointed to Tuesday.

    The core figures are unchanged. Binance puts the theft at about $6.3 billion, says more than $6.34 billion has been set aside, and reported coverage of about 95% in its latest recovery update. Roughly $3 billion is frozen on-chain. The FBI attributed the theft to North Korea on Saturday.

    There is still no post-incident report, no regulator action and no new freeze figure. On-chain trackers report the hacker moving stolen SOL into bitcoin; Hardwire has not independently confirmed those flows.

    Prices were steady. As of 11:54 AM ET, CoinGecko showed BTC at $78,043 (+0.7% over 24 hours), ETH at $2,267 (+0.8%) and BNB at $711.61 (+0.9%).

    Sources: Binance, Binance Customer Support, FBI, CoinGecko

  • Binance Reopens Withdrawals in Phases, Says 95% of Hack Losses Now Covered

    Binance Reopens Withdrawals in Phases, Says 95% of Hack Losses Now Covered

    Update, Nov. 1: Binance now says the updated proof-of-reserves report is expected Monday, Nov. 2, not Tuesday. Read the latest.

    Binance began reopening crypto withdrawals early Sunday, about three days after the Oct. 29 breach that the exchange puts at roughly $6.3 billion.

    In its Recovery Update #4, posted just after midnight ET, Binance said phase one would roll out between 1 AM and 4 AM ET, with networks prioritized by the past week’s user demand. The Bitcoin network opened first, at about 1:20 AM ET. Ethereum and BNB Smart Chain (ETH, BNB, USDT and USDC) followed before 3 AM, then XRP and Base. By 7:36 AM ET, Binance listed 15 networks as live, also including Dogecoin, Optimism, Arbitrum, Tron, Solana, Polygon, Avalanche C-Chain, ZEC, TON and Sui. More assets will be added “in phases as security checks are completed,” it said, and users may see delays during the initial rollout.

    The exchange also said it has now covered about 95% of the impacted amount, up from about 90% on Saturday. The remaining 5% is in less-liquid tokens outside its top ten, which it is still buying through market and OTC channels. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, it said. Deposits were not affected.

    Withdrawals now come from newly generated hot wallets, which Binance said it has added to its proof-of-reserves page. That explains Sunday’s large on-chain transfers to unfamiliar addresses, which the company described as internal.

    What is still pending: the full zero-knowledge proof for the Oct. 31 reserves snapshot, which Binance expects around Tuesday, and a post-incident report once the investigation ends. The FBI attributed the theft to North Korea’s TraderTraitor group on Saturday. Binance has not changed its figures of more than $6.34 billion set aside and about $3 billion frozen. It has said users will not bear the loss.

    Markets were steady. At 7:47 AM ET, CoinGecko showed Bitcoin at $77,821 (+0.4% over 24 hours), Ether at $2,261 (+0.5%) and BNB at $712 (+1.0%).

    Sources: Binance, FBI, CoinGecko

  • FBI Names North Korea’s TraderTraitor in Binance Hack

    FBI Names North Korea’s TraderTraitor in Binance Hack

    The FBI said Saturday evening that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct. 29. The statement, posted by the FBI’s Cyber Branch at about 6:37 PM ET and shared by the bureau’s main account, is the first official government attribution of the attack.

    Per Reuters and the AP, the FBI tied the theft to TraderTraitor, the North Korean state-sponsored group it previously linked to the roughly $1.5 billion Bybit hack. The bureau said it had observed the group converting stolen assets into Ether and expects further laundering. That matches the private-sector read: Chainalysis and TRM had already attributed the hack to TraderTraitor, but until now there was no government confirmation.

    On-chain tracing continues. Elliptic said Saturday that the main Tron distribution wallet linked to the stolen funds has paid out roughly every hour for 31 hours, with repeated swap amounts into THORChain, a pattern it described as automated laundering.

    Binance’s own figures are unchanged since Update #3 on Saturday morning: about $6.3 billion affected, more than $6.34 billion set aside, about 90% of stolen assets replenished, and about $3 billion frozen on-chain. Crypto withdrawals are still paused. Binance’s support account said Saturday evening that security checks are being completed, with P2P and fiat withdrawals available where supported. The company has said it is on track to restart withdrawals Sunday, Nov. 1, but has not confirmed a time.

    Still pending: a confirmed withdrawal restart, the zero-knowledge proof-of-reserves results (estimated by Tuesday, Nov. 3, UTC), and Binance’s technical findings and post-mortem. No regulator action has been announced.

    Markets were steady. At 7:47 PM ET, CoinGecko showed Bitcoin at $77,433 (+0.3% over 24 hours), Ether at $2,253 (+0.5%) and BNB at $702.60 (−0.2%).

    Sources: FBI, Reuters, AP, Binance, Elliptic, Chainalysis, CoinGecko

  • Binance Says 90% of Stolen Assets Replaced, Posts New Reserves Snapshot

    Binance Says 90% of Stolen Assets Replaced, Posts New Reserves Snapshot

    Update, Nov. 1: Binance now says the updated proof-of-reserves report is expected Monday, Nov. 2, not Tuesday. Read the latest.

    Binance said Saturday morning that it has now replaced about 90% of the assets stolen in Thursday’s hack, up from roughly 80% in its previous update on Friday afternoon.

    In “Security Incident Update #3,” posted on X at 10:30 AM ET, the exchange said user balances in ten tokens are fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% is in less liquid tokens outside that list, which Binance said it is still buying through market and over-the-counter channels and “may take longer to source.”

    Binance said the money came from three places: a partial draw on its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund, and its own corporate treasury. It said it will refill SAFU to about $1 billion, and that the insurance fund remains above the level its risk framework requires.

    The headline figures did not change. Binance still puts the loss at about $6.3 billion and says it has set aside more than $6.34 billion in company funds. About $3 billion remains frozen on-chain; co-founder Yi He wrote on X that recovering it will take a formal process.

    The exchange also said it took a new proof-of-reserves snapshot at 00:00 UTC on Oct. 31 (8 PM ET Friday) and posted it to its reserves page. The zero-knowledge proof that lets users check their own balances will take 40 to 50 hours to generate, with completion estimated by Tuesday, Nov. 3 (UTC). Friday’s update had pointed to results by Monday.

    Crypto withdrawals remain paused. Binance said it is “on track” to reopen them on Sunday, Nov. 1, and will confirm details later. Co-CEO Richard Teng wrote that users “will not bear the financial impact.”

    Still pending: the actual reopening, technical findings and a post-mortem, and any official government attribution. Blockchain analytics firms Chainalysis and TRM attribute the attack to North Korea’s TraderTraitor group; no government has said so.

    At 11:47 AM ET, CoinGecko showed BTC at $77,483 (+0.2% over 24 hours), ETH at $2,249 (+1.2%) and BNB at $706 (+1.2%).

    Sources: Binance, Binance co-CEO Richard Teng (X), Binance co-founder Yi He (X), CoinGecko

  • Walmart’s Bank App Now Takes Stablecoins. Read the Fine Print.

    Walmart’s Bank App Now Takes Stablecoins. Read the Fine Print.

    Opinion. Easton writes Hardwire’s opinion column. Where this piece speculates, it says so.

    On Friday, while everyone was watching Binance, Walmart-backed OnePay quietly opened a new door. Select U.S. customers can now send USDC, the dollar stablecoin issued by Circle, into their OnePay Checking account. It gets turned into regular dollars “within moments,” with no conversion fee at launch. OnePay supports 12 blockchains, including Base, Solana, Ethereum and Tempo, the payments chain backed by Stripe.

    I’ll give credit where it’s due. For a gig worker or freelancer paid in stablecoins, this beats the old routine of an exchange account, a sell order and a bank transfer that takes days. Circle’s CEO, Jeremy Allaire, cheered it as a step toward getting USDC into everyday finance apps. Fair enough.

    But read the fine print, because that’s where the story is.

    Who’s in the middle. OnePay doesn’t do the hard part itself. Bridge, Stripe’s stablecoin platform, creates the deposit address, “runs the necessary compliance checks,” and converts the coins to dollars. The banking is done by Coastal Community Bank or Lead Bank. So a dollar coin issued by Circle travels through Stripe’s pipes into a Walmart-backed app at a partner bank. That’s four big companies between you and your paycheck. Crypto was supposed to cut out middlemen. This adds them back in, with nicer branding.

    What the fine print says. OnePay’s own disclosure says stablecoins aren’t FDIC-insured, “may lose value,” and that the dollars you get “may be less than you sent.” It also says “no conversion fees at launch.” Those two words, “at launch,” do a lot of work. Free is how you get people in the door. It isn’t a promise about next year.

    The timing. This launched the same week stablecoin issuers showed how fast they can freeze money. Chainalysis says Circle and Tether helped freeze $2.8 billion of the Binance hackers’ loot. Good. I want North Korea’s thieves stopped. But the same machinery that freezes a hacker can screen a waitress’s tips, and every deposit into this product passes through a compliance gate first.

    My speculation, clearly labeled. I think the real prize here isn’t convenience. It’s the rails. Whoever controls the on-ramp between stablecoins and checking accounts gets to see the money, set the fees once the “launch” period ends, and decide whose deposits clear. I’m not saying anyone plans to abuse that. I’m saying that’s a lot of power to hand a retail giant and a payments giant without much public debate. And Washington likes stablecoins for its own reasons: under the GENIUS Act, issuers have to back them one-for-one with safe assets like cash, bank deposits and short-term Treasury bills. As stablecoins grow, so does a steady new buyer of government debt. That’s my read, not a fact anyone has admitted to.

    None of this means don’t use it. It means know what you’re using. A stablecoin that lands in a bank app isn’t freedom money. It’s a faster deposit, run by the same kind of institutions crypto was built to route around.

    Use it if it saves you time. Just don’t confuse a convenient deposit with control of your own money.

    Sources: OnePay, Tempo, Jeremy Allaire on X, Chainalysis on X, Congress.gov (GENIUS Act).

  • Binance Hackers Race to Outrun Stablecoin Freezes as Withdrawal Restart Nears

    Binance Hackers Race to Outrun Stablecoin Freezes as Withdrawal Restart Nears

    The hackers who took about $6.3 billion from Binance on Thursday are now in a race against the companies that can freeze stolen money, according to blockchain tracking firm Chainalysis.

    Some stolen coins are easy to freeze. Stablecoins like USDT and USDC are issued by companies, Tether and Circle, which can lock tokens at a flagged address. Bitcoin and ether have no company in charge, so no one can freeze them that way. That difference is shaping how the attackers move the money.

    What Chainalysis says the hackers are doing. In a post on X Saturday morning, Chainalysis said the attackers have been parking stablecoins on the Tron blockchain in DeFi lending apps. In return they get a “receipt” token, a claim on the coins in the pool. Unlike the stablecoins themselves, those receipt tokens can’t be frozen. The attackers send the receipts to fresh wallets with no link to the hack, trade them back for stablecoins, and then bridge the money to Ethereum as ether. Chainalysis walked through one $500,000 example step by step. It said Circle and Tether have contributed to $2.8 billion in freezes so far.

    In its write-up of the hack, Chainalysis also said the attackers swapped $325 million in stablecoins for $285 million in ether in about 20 minutes on Thursday, before freezes started at 5:14 p.m. ET. It said the laundering shows signs of automation, with thousands of transactions in a short time. Chainalysis attributes the theft to North Korea’s TraderTraitor group, and TRM Labs and Elliptic have also pointed to North Korea. No government agency has made an official attribution, and Binance has not named a culprit.

    Tools for everyone else. Elliptic said Saturday that its public blocklist of addresses tied to the hack now holds more than 2,800 addresses and is free to check. It warned that the attacker is still moving funds.

    Where Binance stands. Withdrawals are still paused. Binance’s second incident update, posted Friday afternoon, said it has set aside more than $6.34 billion and already holds about $5 billion of it in the same tokens that were taken, roughly 80% of the loss. It is buying the rest. About $3 billion has been frozen on-chain with partners, Binance said. The exchange is targeting a phased restart of withdrawals in about 34 hours from that update, which works out to the early hours of Sunday, ET, subject to security checks. It also planned a first proof-of-reserves snapshot within 12 hours, with results due by Monday, Nov. 2. As of Saturday morning, Binance had not said publicly whether that snapshot was taken. Its support account is still telling customers that withdrawals will resume “as soon as the security issue is fully resolved.”

    Market check. U.S. spot bitcoin ETFs saw a net $643.2 million in outflows on Friday, the first full trading day after the hack, according to Farside Investors. BlackRock’s IBIT lost $233.7 million and Fidelity’s FBTC lost $201 million. Prices were calm Saturday morning. At about 8:20 a.m. ET, CoinGecko showed bitcoin near $77,500, ether near $2,246, XRP near $1.25 and BNB near $704, each within about 1% of where they were a day earlier.

    The next checks are clear: whether withdrawals actually reopen this weekend, what the reserve report shows on Monday, and when Binance publishes its technical post-mortem.

    Sources: Chainalysis on X, Chainalysis, Elliptic on X, Binance, Binance on X, CoinDesk, Farside Investors, CoinGecko.

  • Binance Says 80% of Hack Losses Covered, Sets Phased Withdrawal Restart

    Binance Says 80% of Hack Losses Covered, Sets Phased Withdrawal Restart

    Update, Oct. 31: Binance now says the full proof-of-reserves results are expected by Tuesday, Nov. 3, not Monday, and that about 90% of stolen assets have been replaced. Read the latest.

    Binance said Friday afternoon it has already covered about 80% of the roughly $6.3 billion lost in Thursday’s hot-wallet compromise, and set out a timetable for reopening withdrawals in stages.

    In “Security Incident Update #2,” posted at about 4 PM ET and signed by co-CEOs Yi He and Richard Teng, the exchange said it has set aside more than $6.34 billion in company funds, including $5 billion held in the exact tokens that were taken, such as USDC, USDT, BTC, ETH and BNB. It is buying the remaining assets through market and OTC channels. The loss estimate is unchanged, and about $3 billion has been frozen on-chain with partners.

    The update dates the compromise to about 20:05 UTC on Oct. 29, or 4:05 PM ET.

    Key timelines Binance gave:

    • Withdrawals: a phased restart targeted to begin within about 34 hours, which would be early Sunday ET, subject to security checks.
    • Proof of reserves: an initial snapshot in about 12 hours, with results ready by Monday, Nov. 2.
    • Technical findings: further detail expected within about 48 hours, with a full post-mortem to follow.

    Binance repeated that early findings pointed to a compromised laptop but said later work had “uncovered additional points of breach.” It said it has found no evidence that wallet private keys were leaked.

    Binance still hasn’t named the attacker. Chainalysis has attributed the theft to North Korea’s TraderTraitor, but no government agency has made an official attribution.

    Washington is also weighing in. CFTC Chairman Michael Selig said Friday on CNBC’s “Squawk on the Street” that the hack “proves our exact point” and that he wants a voluntary federal registration option for offshore exchanges, with U.S.-style cybersecurity safeguards; making it mandatory would require Congress. He said the CFTC will assist law enforcement. His remarks were commentary on the agency’s Oct. 5 advance notice of proposed rulemaking, which has a Dec. 14 comment deadline, not action against Binance.

    Markets were steady into the evening. At about 5:50 PM ET CoinGecko showed BTC at $76,725 (down 3.1% over 24 hours), ETH at $2,237 (down 1.7%) and BNB at $697 (down 1.2%).

    All of these are company targets, not confirmed outcomes. Binance’s own support account says withdrawals resume only “as soon as the security issue is fully resolved.”

    Sources: Binance, Binance co-CEO Richard Teng (X), Chainalysis, CNBC, CFTC, Federal Register, CoinGecko

  • Binance Aims to Reopen Withdrawals by Sunday, Reserve Report Due Monday

    Binance Aims to Reopen Withdrawals by Sunday, Reserve Report Due Monday

    Binance co-CEO Richard Teng said Friday the exchange hopes to resume customer withdrawals by Sunday, Nov. 1, and will publish a full proof-of-reserves report by Monday, Nov. 2, with an initial view possibly sooner.

    In a video statement posted on X at about 10:30 a.m. ET, Teng said the withdrawal service is being rebuilt and will not be switched back on until it “passes rigorous testing,” which he said is on track to finish within about 40 hours. That is a target, not a confirmed reopening time. Deposits are operating normally, according to Binance’s updated incident notice.

    Teng also gave new detail on how the attack worked. He said the attacker used Ethereum’s EIP-7702 account-delegation feature to gain execution approval over a Binance hot wallet without going through the company’s normal approval controls, and used a “self-destruct” mechanism to erase tools and traces. He said more than one person was involved and that investigators have found additional points of breach but have not yet pieced together the full sequence. A formal technical post-mortem has not been published.

    The headline figures are unchanged. Binance says it has reserved more than $6.34 billion of company funds, $5 billion of it already in the same tokens that were taken, and is buying the rest through market and over-the-counter channels. About $3 billion has been frozen on-chain, and Binance said it has “begun recovering” assets.

    U.S. authorities are now involved. The FBI said it is “aware of the incident,” and the Secret Service said it is working with the U.S. Attorney’s Office for the District of Columbia to trace and recover funds, BBC News reported. No agency has publicly named a culprit; Chainalysis has attributed the attack to North Korea’s TraderTraitor group.

    Bitcoin was near $77,180 at 1:53 p.m. ET, down about 4% over 24 hours, per CoinGecko. Ether was near $2,240, and BNB near $701, down about 6%.

    Sources: Binance, BBC News, CoinDesk, Chainalysis, CoinGecko

  • Tether Froze $1.5 Billion in an Hour. Who Else Gets the Freeze Button?

    Tether Froze $1.5 Billion in an Hour. Who Else Gets the Freeze Button?

    The Binance hack proved crypto’s “unstoppable” money can be stopped, fast, by a handful of companies. Good news this week. Worth remembering next week.

    Thursday afternoon, someone walked out of Binance with about $6.3 billion in crypto. Chainalysis says it was North Korea’s TraderTraitor crew. Binance says it will cover every dollar, and withdrawals stay paused for roughly another 45 hours.

    That’s the headline. Here’s the part I can’t stop thinking about.

    Chainalysis says the money started leaving Binance around 4:20 p.m. ET. About an hour later, Tether CEO Paolo Ardoino posted that Tether had frozen more than 1.567 billion USDT tied to the hack. By Friday morning, Binance said about $3 billion had been frozen with help from stablecoin issuers and other partners.

    Let’s be clear: stopping a North Korean heist is a win. Nobody should cry for Pyongyang.

    But for a decade, crypto was sold as money nobody can freeze. This week showed a few private companies can freeze billions of it in an afternoon. No judge. No hearing. No vote. That isn’t a bug report. It’s a feature description.

    The freeze button is real. Big dollar stablecoins are built so the issuer can lock tokens at a specific address. Tether has used that power before at law enforcement’s request. What’s new is the size and the speed. A billion and a half dollars, locked before most of America had finished dinner.

    The exchange is the bank. Binance customers can put money in today but can’t take it out. Binance says that’s for security, and that’s reasonable. But “money goes in, can’t come out” is exactly what people feared about banks in 2008 and exchanges in 2022. Binance’s promise to cover losses is a company promise, not an FDIC guarantee. The proof comes when withdrawals reopen and fresh reserve numbers post.

    Speculation, labeled: This is my opinion, not reporting. Washington spent this year trying to write crypto’s rules, and after this week the pitch writes itself: if issuers can freeze hackers in an hour, why not freeze anyone a regulator flags? Sanctions lists today. Whoever is out of favor tomorrow. I’m not saying anyone is planning that. I’m saying the tool now works at scale, and tools that work get used.

    What to watch. Whether Binance’s promised post-mortem is real detail or PR. Whether the frozen $3 billion actually comes back, and who decides where it goes. And whether lawmakers or agencies use this hack to argue for more control over everyone’s wallets, not just hackers’.

    The good guys won round one. Just notice who was holding the off switch.

    This is opinion, not investment advice.

    Sources: Chainalysis, Paolo Ardoino on X, Binance, Binance on X, BBC News.

  • Binance Says It Will Cover a $6.3 Billion Hack. Withdrawals Are Still Paused.

    Binance Says It Will Cover a $6.3 Billion Hack. Withdrawals Are Still Paused.

    Binance, the world’s biggest crypto exchange, says it was hit by a security breach on Thursday afternoon and has set aside more than $6.3 billion to cover it. If that figure holds, it would be the largest crypto theft on record, roughly four times the $1.5 billion taken from Bybit in February 2025.

    According to Binance’s incident notice, the attack may have started with a compromised laptop belonging to a DevOps engineer. That access let the attacker reach an internal service and submit withdrawals Binance did not authorize. The exchange said it found no evidence that wallet private keys leaked. In an update early Friday, it said further investigation had “uncovered additional points of breach,” without giving details.

    What Binance has committed to. Binance says it will cover all losses from its SAFU emergency fund and company money, and that user funds are safe. In a post on X Friday morning, it said it has reserved more than $6.34 billion for the incident. About $5 billion of that is already held in the same tokens that were taken, and it is buying the rest through market and over-the-counter channels. Binance also says about $3 billion has been frozen with help from stablecoin issuers and other partners. Tether’s chief executive, Paolo Ardoino, said Tether alone froze more than 1.567 billion USDT.

    What customers can do now. Withdrawals are suspended. Binance said Friday it is on track to resume them in about 45 hours. Deposits remain unaffected, the company said, though an earlier Binance post had said both deposits and withdrawals were paused. Binance has promised a technical post-mortem and an updated proof of reserves once the fix is done. Neither has been published yet.

    Who is behind it. Chainalysis puts the theft at about $6.4 billion and attributes it to TraderTraitor, a North Korean hacking group. Binance dates the start of the compromise to about 4:05 p.m. ET Thursday. TRM Labs said the attack resembles past North Korea-linked incidents. Binance has not named a culprit.

    Market reaction. Bitcoin traded near $77,450 at 8:15 a.m. ET Friday, down about 3% over 24 hours, according to CoinGecko. Ether was near $2,238, down about 3.6%, and Binance’s own BNB token was near $700, down about 5%. U.S. spot bitcoin ETFs took in a net $17.2 million on Thursday, while ether ETFs lost $105.5 million, according to Farside Investors. That trading closed before the breach began.

    For cautious holders, the practical points are simple. Binance’s pledge is a company promise, not an insured guarantee, and the proof will come when withdrawals reopen and new reserve data is posted. Use only official Binance channels, since fake “refund” and support accounts often follow incidents like this.

    Sources: Binance, Binance on X, Paolo Ardoino on X, Chainalysis, BBC News, CoinGecko, Farside Investors.