Three days after approximately $6.3 billion left Binance-controlled wallets, the exchange is reopening withdrawals, rebuilding asset coverage, and pointing users to a new proof-of-reserves snapshot. The FBI has now attributed the theft to North Korea’s TraderTraitor activity. Token issuers and blockchain operators have frozen billions.

That is a remarkably fast financial and operational response. It is not the same thing as proving the intrusion is understood or the original path is closed.

The distinction matters well beyond cryptocurrency. Incident response often produces several reassuring numbers at once: systems restored, funds replaced, indicators blocked, and an attacker named. Each answers a different question. A platform can be solvent while its root cause remains under investigation, and it can block known attacker infrastructure without knowing whether the attacker retained another route in.

TL;DR

  • The FBI formally attributes the October 29 theft of more than $6 billion to North Korea’s TraderTraitor activity and says the actors are converting assets primarily into ETH before further laundering.
  • Binance began a phased withdrawal restart on November 1 and says it has replenished about 95% of the affected assets. Ten major assets are reported as fully backed.
  • Binance’s October 31 proof-of-reserves snapshot is useful evidence about asset backing, but the full zero-knowledge proof was not expected until November 3. Proof of reserves does not validate withdrawal security or the remediation of the breach path.
  • Binance’s initial explanation still points to a compromised DevOps laptop, a service container, and unauthorized withdrawal requests. It has not yet published the promised technical post-mortem.
  • Defenders should track five separate states: attribution, stolen-asset containment, customer-liability coverage, service recovery, and root-cause remediation.

What Changed Since the First Disclosure

The incident began on October 29. Binance’s initial investigation said a compromised DevOps engineer’s laptop may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The exchange reported no evidence of a wallet private-key leak, revoked an affected address authorization, suspended withdrawals, and estimated the impact at about $6.3 billion.

Since then, the public record has changed quickly:

  • Attribution became official. On October 31, the FBI said North Korea was responsible and identified the activity as TraderTraitor. The bureau published laundering addresses and asked virtual-asset businesses, DeFi services, instant exchanges, THORNode operators, and RPC node operators to block transactions involving or derived from them.
  • The stolen assets began moving and being converted. The FBI, US Secret Service, and IRS Criminal Investigation observed the actors converting assets primarily into ETH and expect further laundering through DeFi and instant-swap services.
  • Asset issuers and operators intervened. Binance says partners froze roughly $3 billion on-chain. Bitquery’s chain-by-chain analysis counted about $2.7 billion frozen or rescued as of October 31, while approximately $3.1 billion remained with the attacker. The figures use different cutoffs and categories, so they should not be treated as contradictory without reconciling methodology.
  • Binance replenished most affected assets. Its November 1 update says approximately 95% of the impacted amount had been covered through corporate funds, part of its futures insurance fund, and a partial deployment of the Secure Asset Fund for Users. The remaining 5% consisted of less-liquid assets outside the ten largest affected assets.
  • Withdrawals started returning. Binance scheduled phase one for 06:00–09:00 UTC on November 1 across selected assets and networks, with additional combinations to follow after readiness checks.

These developments justify a new assessment. The story is no longer only about how an engineer’s endpoint may have reached a signing path. It is now also about how to measure recovery without confusing liquidity, availability, containment, and security assurance.

Five Claims That Must Not Be Collapsed Into One

1. Attribution: Who Operated the Attack?

The FBI’s statement moves the North Korea link beyond a private-sector assessment. It says TraderTraitor was responsible for the theft and publishes addresses the bureau associates with the laundering operation.

That attribution is operationally useful. Screening systems can ingest the address set, investigators can trace direct and indirect exposure, and service providers can preserve evidence before rejecting or freezing activity.

Attribution does not reveal the complete intrusion chain. The FBI alert describes the theft and laundering activity, not the malware, stolen identity, container access, approval logic, or signing-policy failure inside Binance.

2. Containment: How Much Stolen Property Can No Longer Move?

Frozen stablecoins and restricted blockchain assets are a major disruption to the attacker, but “frozen” is not synonymous with “returned.” A freeze may depend on an issuer’s administrative controls, a chain’s governance process, or a service provider’s continued enforcement. Legal recovery and redistribution are separate steps.

It is also an uneven control. Centrally issued stablecoins may be frozen quickly; native BTC and ETH cannot be disabled by an issuer. Bitquery reported that the attacker still controlled large BTC and ETH holdings on October 31, while the FBI warned that conversion and laundering were already underway.

3. Coverage: Can Binance Meet Its Liabilities to Users?

Binance reports that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed and that about 95% of all affected assets have been replenished. That addresses whether the exchange has replaced what was taken from its controlled wallets.

Coverage is not recovery from the attacker. Purchasing replacement tokens through market and over-the-counter channels moves the loss to Binance’s corporate treasury and protection funds. It protects users from bearing the immediate shortfall, but it does not reduce the original attacker’s holdings unless frozen assets are later recovered.

4. Verification: What Does Proof of Reserves Actually Prove?

Binance took a new proof-of-reserves snapshot at 00:00 UTC on October 31. It said the complete zero-knowledge proof would take 40–50 hours and was expected by November 3.

Once complete, the proof can help users verify that included balances are backed at least 1:1 at the snapshot point. It does not answer whether all liabilities are included, whether assets were temporarily sourced, or whether Binance’s internal withdrawal controls are secure. Those questions require additional evidence, including liability-scope assurance, wallet-control validation, audit evidence, and the technical post-mortem.

Proof of reserves is therefore a financial control, not a penetration test.

5. Remediation: Is the Original Attack Path Closed?

This is the least-developed part of the public record. Binance says it conducted enhanced security reviews, assessed withdrawal infrastructure, monitored residual risk, and verified readiness before the phased restart. It has not yet published the detailed post-incident report it promised.

The original explanation remains preliminary: a laptop may have been compromised, an attacker reached a service container, and Binance’s systems signed unauthorized withdrawals without a known private-key leak. Blockchain evidence supports the conclusion that valid Binance signatures authorized the transfers. It cannot determine which internal identity, session, workload, or policy decision produced them.

Until the post-mortem arrives, key questions remain unanswered:

  • How was the laptop compromised, and what persisted on it?
  • Which credential or session crossed from the workstation to the service container?
  • What role did the container have in transaction preparation, approval, or signing?
  • Why could unusual withdrawals span multiple chains and wallets before an independent control stopped them?
  • Which additional breach points did Binance find?
  • Were credentials rotated and workloads rebuilt, or were only known authorizations revoked?
  • What new control prevents the same class of request from reaching the signing layer again?

Restoring withdrawals is a business milestone. Closing those questions is the security milestone.

The Technical Signal Defenders Should Keep

Bitquery traced valid transfers from 17 Binance hot wallets across nine chains. Its analysis found ordinary signed transfers on 16 wallets, while the main Ethereum wallet used EIP-7702 authorizations that allowed attacker-controlled code to execute in the wallet’s context. Binance says no private key leaked.

Together, those facts point defenders toward the transaction-request and authorization path rather than only key custody. A signing system can keep private-key material inside protected infrastructure and still authorize attacker-chosen transactions if the upstream request, policy, or authenticated workload is compromised.

The control objective is not merely “protect the key.” It is “make unauthorized intent impossible to turn into a valid signature at this scale.”

That requires independent transaction policy after the potentially compromised service: destination controls, per-chain velocity limits, value thresholds, anomaly scoring, quorum approval, and a pause mechanism that the submitting identity cannot modify. Cross-chain bursts and first-seen destinations should be evaluated as a single incident sequence, not as unrelated wallet events.

What You Can Do Today

If You Operate a Virtual-Asset Service

  1. Ingest the FBI address set as a versioned intelligence source. Screen direct and derived exposure, preserve the matched transactions and customer context, and route decisions through legal and compliance procedures. Do not silently discard the evidence.

  2. Detect conversion sequences, not only listed addresses. The FBI expects ETH conversion followed by DeFi and instant-swap laundering. Alert on rapid asset consolidation, chain hopping, newly created counterparties, and flows derived from the published set.

  3. Separate freeze, recovery, and customer-credit metrics. Report how much is immobilized, how much has legally returned, and how much the organization replaced from its own balance sheet. Combining them overstates recovery.

  4. Test the signing boundary from the request backward. Identify every user, workload, container, queue, and API able to submit or approve withdrawals. Verify that compromising one component cannot authorize a high-value, multi-chain burst or weaken the policy that should stop it.

  5. Treat service restoration as a monitored experiment. Use staged network enablement, lower temporary limits, heightened review for new destinations, rollback criteria, and live correlation between application requests and on-chain outcomes.

If You Use Binance

Check the exchange’s network-status page before attempting a withdrawal because restoration is phased by asset and network. Expect delays during the initial rollout, but use only the official application and support domain for status information.

The public disclosures do not say that Binance customer passwords, seed phrases, or personal wallets were stolen. Do not interpret the incident as proof that your account was individually compromised. Still review active sessions, login history, API keys, withdrawal addresses, and recent transactions; revoke anything unfamiliar and use phishing-resistant MFA where available.

Expect recovery-themed phishing. No legitimate investigator or support agent needs your seed phrase, private key, one-time code, or remote access to “release” funds.

If You Are Evaluating the Recovery

Ask for evidence against each claim separately:

ClaimEvidence to look for
Attacker identifiedGovernment attribution, supporting intelligence, published indicators
Stolen assets containedOn-chain state, issuer actions, chain governance actions
User liabilities coveredComplete reserve and liability evidence, not a percentage alone
Service safely restoredStaged availability, monitoring results, residual-risk criteria
Root cause remediatedTechnical timeline, control failures, credential scope, corrective controls, independent validation

Binance has made measurable progress on the first four rows, although some verification is still incomplete. The fifth awaits the promised post-mortem.

That is the sober reading of the incident on November 1: the platform is recovering quickly, the attacker is now officially attributed, and billions have been disrupted. The most important technical question remains open—how a compromised identity or workload reached transaction authority, and what now makes that path fail closed.

Sources