Binance Says 95% of Stolen Assets Are Covered as FBI Names North Korea and Seoul Moves on Exchange Security

Binance said on Monday that it has replenished about 95% of the roughly $6.3 billion stolen from its hot wallets on October 29, up from 90% on Saturday. The exchange said it paid for the replacements with company funds, including corporate money, part of its futures insurance fund and a partial deployment of its Secure Asset Fund for Users. Co-CEO Richard Teng has said "our users will not bear the financial impact."

The update comes five days after Blockhead reported that Binance had halted withdrawals after a multibillion-dollar hot wallet drain . At that point, estimates of the loss ranged from about $3.3 billion to nearly $6 billion, and Binance had given no figure of its own. The exchange has since put the total at $6.3 billion, which makes it the largest crypto theft on record and more than four times the $1.5 billion taken from Bybit in 2025.

Binance restored withdrawals in phases on Sunday across 15 blockchain networks. By 10:30 a.m. ET it had processed about $4.6 billion in withdrawals and $1 billion in deposits, according to CNN. Bloomberg reported a net outflow of $3.6 billion, which it described as a relatively soft blow, and Binance said today that the flight of funds eased after an initial spike.

In its fifth recovery update on Monday, Binance said the cryptographic proof for its October 31 reserve snapshot is now available. The snapshot covers 10 tokens, including bitcoin, ether, USDT, BNB, Solana, USDC and XRP, and Binance says users can verify at least 1:1 backing.

On Saturday, the FBI attributed the theft to TraderTraitor, North Korea's state-sponsored hacking unit, which it also blamed for the Bybit theft. The agency said it had observed the group converting stolen funds mainly into ether and expects further laundering through DeFi and instant swap services. The investigation involves the FBI, IRS Criminal Investigation, the Secret Service, federal prosecutors in Washington and California, and Justice Department divisions. North Korean state media has rejected the attribution as "absurd rhetoric," Reuters reported.

Blockhead has followed the same group's earlier campaigns. When Bybit lost $1.5 billion, Blockhead covered the heist as it happened , and in August it reported that Bybit sued North Korea and won an asset freeze in a civil case that treats stolen funds as a continuing crime scene.

The FBI, Secret Service and IRS Criminal Investigation asked THORChain node operators, swap platforms and other providers on Saturday to block addresses linked to the theft. The same day, THORChain paused swaps on multiple networks after an Ethereum reorganization triggered a duplicate 10 ETH refund. Chainalysis said on Sunday that the pause "inadvertently delayed" the laundering of a significant amount of the stolen funds. THORChain has defended its policy of processing transactions without screening users, a position an opinion piece on Blockhead examined in THORChain's Critics Live in Delusional Glass Houses .

The haste has cost the attackers too. Bitquery estimates they lost about $119 million through poor execution while converting funds, Bloomberg reported, handing quick traders an opportunity.

Still unanswered

Binance's account of the entry point has stayed narrow. Teng said the attack was complex and involved a compromised laptop and malware designed to delete evidence. The company has described a DevOps engineer's laptop that gave attackers access to a service container used to submit withdrawals, and says later work found additional points of compromise it has not detailed. It says it has found no evidence that wallet private keys leaked.

The security firm Blockaid had flagged Ethereum's EIP-7702 delegation feature in the on-chain data on October 29. Binance's public updates have not explained how that fits its account, and a security review published over the weekend noted that the technical post-mortem it promised had not yet appeared. About 5% of the stolen assets also remain to be covered, from a remainder Binance earlier described as less liquid tokens.

The fallout is reaching Asia. South Korea's Financial Services Commission held an emergency meeting on Monday with Upbit, Bithumb, Coinone and other providers, together with the Financial Supervisory Service, the Financial Security Institute and the exchange alliance DAXA. The regulator urged exchanges to review system access, hot-wallet withdrawal approvals, signing procedures and administrator permissions. It asked them to raise cold-wallet holdings above the 80% that Korean law already requires, to monitor deposits and withdrawals continuously, to add incident response staff and to share unusual access attempts faster.

Exchanges told the regulator it is unclear whether they may restrict withdrawals when a hack hits another platform, and the FSC said it will review that question. It plans a wider meeting with banks on November 5. The meeting follows a run of attacks on Korean institutions that includes Shinhan Bank and KB Kookmin Bank, according to Korea Pro, and Blockhead reported last year that Upbit lost $32 million in a hack suspected to be Lazarus-linked . It also lands as Seoul weighs rules for exchanges, with Blockhead having reported on October 20 that the government was meeting top exchanges as a ruling-party bill sought to delay the crypto tax.

The next markers are the post-mortem, the last 5% of replacements, and where the stolen ether goes. Blockhead's market desk has tracked the early damage, with spot bitcoin ETFs posting $643.3 million of net outflows on Friday and the question being whether customers run. The Korean meeting on November 5 will show whether regulators turn requests into rules.