Binance says it has replaced 95% of the assets stolen in the October 29 attack, which the exchange initially estimated at around $6.3 billion. The November 1 update raised the figure from the 90% reported the previous day, alongside an announcement of phased withdrawal resumption. Binance's hack coverage comes from purchasing substitute tokens with corporate funds and internal reserves, not from recovering any assets from the attackers themselves.
This report draws on Binance's official updates of October 30, 31, and November 1, plus the FBI advisory attributing the attack to TraderTraitor, a North Korean state-linked group. Reuters coverage is referenced through search results and republication on Euronext, as direct access was unavailable.
From 90% to 95%: What the Latest Update Actually Says
On October 31, Binance reported covering 90% of the value of affected assets. The company noted that Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD, and Zcash had each returned to 100% coverage. The remaining gap involved less liquid tokens outside the top ten, which the exchange was acquiring through open-market purchases and over-the-counter operations.
In its fourth update, published November 1, Binance raised the declared coverage to 95%. The announcement reiterated the earlier progression from 80% to 90%, then confirmed the move to 95%, with 5% still to be sourced. That 95% figure is the current operative number, though the full progression communicated by the company remains on the record.
The figure describes the quantity of substitute assets Binance claims to have procured, not a share of stolen funds traced or returned by the attackers. Per Binance's own statements, the coverage is financed through corporate funds, a portion of the SAFU user protection fund, and a portion of the Futures insurance fund. In its October 30 update, the exchange reported setting aside more than $6.34 billion, with roughly $5 billion already held in the affected token types.
“Covered” Does Not Mean “Recovered”
The distinction matters. Buying replacement assets on the market can restore the accounting match between what an exchange holds and what it owes clients, but it doesn't return control of the stolen tokens to anyone except the attackers. Binance has pledged to absorb the financial impact of the theft without passing losses to users. The stolen assets remain the subject of tracking and active investigation.
That's why the freezing figures deserve separate attention. In its October 30 update, Binance reported that roughly $3 billion had been frozen on-chain through cooperation with law enforcement, analytics firms, token issuers, and industry partners. Reuters, in a November 1 report, put the figure at approximately $3 billion “located” as of Friday. A located asset is not necessarily frozen, and neither term equals a completed recovery.
The broader context here is the ongoing debate over exchange custody models. SpazioCrypto has covered the initial Binance attack announcement and maintains a section tracking crypto hack cases. The difference between holding assets on an exchange versus managing your own wallet is covered in our crypto custody guide.
FBI Attributes the Attack to TraderTraitor
On October 31, the FBI formally attributed the theft of more than $6 billion in virtual assets from Binance, occurring around October 29, to North Korea. The agency identifies this specific cyber operation under the name TraderTraitor. This is an official FBI attribution, not a court finding or a complete technical account of the intrusion.
According to the FBI advisory, the bureau and its U.S. partner agencies observed the operators converting stolen assets primarily into Ethereum. The agency warned that further conversions through DeFi services and instant swap platforms were likely to follow, as part of a laundering effort. The advisory does not quantify how much had already been converted to ETH at time of publication. Binance, for its part, says it is cooperating with authorities and industry partners to track the funds.
The FBI also asked node operators, DeFi services, instant exchanges, and virtual asset service providers to block transactions associated with the addresses listed in the advisory. That measure is designed to obstruct subsequent fund movements. It does not, by itself, constitute evidence that the funds have been recovered. Details of how the compromise occurred remain incomplete: Binance has described multiple access points and an investigation still in progress.
The full record of security incidents can be followed in the SpazioCrypto Security archive. A recent case involving a declared loss and dormant addresses is CoinDCX. For wallet-specific security concerns, our analysis of hardware wallet data breaches covers the relevant exposure types.
Withdrawals: A Phased Restart Announced
Binance's fourth update set the opening of the first withdrawal phase between 06:00 and 09:00 UTC on November 1. The company listed 15 networks, including Bitcoin, Ethereum, BNB Chain, Tron, Solana, XRP, Dogecoin, Polygon, Avalanche, Arbitrum, Base, Optimism, and Sui. Availability varies by network and asset pair, with different reactivation windows for each.
Binance directed users to check the withdrawal page or individual network status pages to confirm actual availability. The announcement flagged possible delays during the initial phase and confirmed that remaining assets would be re-enabled progressively, following stability and security checks. That announced window has now passed, but the update reviewed here does not certify that every network has completed its reopening.
The suspension had been presented as a precautionary measure: to contain the incident, assess its full scope, and verify the withdrawal infrastructure. The gradual service return is an operational milestone separate from reserve restoration. A platform can resume some transfers while simultaneously buying missing assets and pursuing stolen ones.
Binance: Status Summary
What is confirmed, and what is not.
- Confirmed: Binance declares 95% coverage; the FBI attributes the attack to TraderTraitor.
- Not established: The 95% is not a share recovered from the attackers; the FBI advisory does not quantify how much ETH has been converted.
- To watch: Actual withdrawal availability by network, acquisition of the remaining 5%, and the post-incident technical report.
The Bigger Picture
Binance's response appears to be addressing two problems at once: keeping client balances whole and limiting the movement of stolen funds. The first depends on the exchange's financial capacity to purchase replacement assets. The second depends on coordination between authorities, token issuers, and operators who can flag or block suspicious transactions. Progress on the first does not automatically measure success on the second.
The concrete signals worth watching are: verifiable and updated proof-of-reserves disclosures, actual reopening of individual network-and-asset pairs, the share of tokens still to be purchased, and authority updates on funds traced or frozen. Binance has promised a post-incident report once the investigation concludes. Until that document is published, the 95% figure remains the exchange's own declaration of coverage level, and the TraderTraitor attribution remains that of the FBI.
