Binance says it has now replaced about 95% of the crypto stolen from it on October 29, and on November 1 it began reopening withdrawals in phases. In the four days since the FBI named North Korea as the attacker, the trade and business press has told the recovery in four different ways, and the accounts do not agree on how much money left the exchange once the doors reopened.
What the primary records say
The FBI alert of October 31 attributes the “theft of more than $6 billion USD in virtual assets” from Binance to North Korea, under the name the bureau uses for this activity, TraderTraitor. The FBI says it has watched the stolen assets being converted primarily into Ether alongside the Secret Service and IRS Criminal Investigation, and expects them to be laundered further through DeFi and instant swap services. It asks node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions tied to a published list of attacker addresses.
Blockchain analytics firm Elliptic puts the theft at $6.43 billion across 11 blockchains, against Binance’s own estimate of around $6.3 billion. Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the total, almost all of it USDT and USDC. Its timeline shows how fast that happened: Tether froze the attacker’s main Ethereum wallet 37 minutes after the stolen USDT arrived, locking 1.18 billion USDT, and Circle froze 823 million USDC in the same wallet shortly afterwards.
Advertisement
Binance has published its side in numbered recovery notices. Recovery Update #3, dated October 31, said the exchange had set aside more than $6.34 billion in company funds and had covered 90% of the loss, drawing on three pools: a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund and its own corporate treasury. Recovery Update #4 set phase one of withdrawals for 06:00 to 09:00 UTC on November 1 across 15 networks, starting with the assets users had asked for most over the previous week. Recovery Update #5, dated November 2, put coverage at about 95%. The remaining 5% is in less liquid tokens outside the ten largest, which Binance says take longer to buy at the size it needs. Binance has said throughout that it will carry the loss itself and leave user balances whole.
How four outlets told the recovery
Cointelegraph followed the money inside Binance. Its November 2 report on the SAFU Bitcoin wallet found it holding about 7,500 BTC after a 7,499 BTC transfer the exchange linked to the hack, roughly half its earlier balance. Cointelegraph pointed out that the fund’s published policy sets a $1 billion target but gives no deadline for refilling it after a security incident. In a separate piece it reported net outflows from Binance of more than $7 billion, citing DefiLlama, while OKX drew $445 million in net inflows.
Bloomberg, in a report carried by Insurance Journal, gave a smaller figure from a Binance spokesperson: net withdrawals of $4.7 billion by Monday morning in London, which the spokesperson said was less than 3% of the $166 billion the exchange holds. The same report quoted traders and advisers who expected the outflows to settle, and noted that Bitcoin was little changed at around $77,700.
PYMNTS put the attacker at the centre. Its November 2 report carried TRM Labs’ description of the laundering as automated, with about 12,000 wallets used across 11 blockchains in under four days, and an ISACA strategist’s view that the exposure belongs in front of the board.
Help Net Security focused on the users left waiting. Its account reported fake posts promising a $150 compensation payment to users hit by the withdrawal pause, which Binance staff warned were false, and listed the fiat currencies Binance had restored for withdrawal by November 2.
Where the accounts disagree
The clearest split is the outflow number. Bloomberg’s $4.7 billion came from Binance and covers the period to Monday morning in London. Cointelegraph’s figure of more than $7 billion comes from DefiLlama’s tracking of exchange wallets. The Hacker News reported a third number from a Binance post on X: $4.649 billion of withdrawals and $1.01 billion of deposits between 06:00 and 15:30 UTC on November 1, a net outflow of about $3.64 billion. Part of the gap has an explanation in the Bloomberg report itself, where co-CEO Yi He is cited saying some of the withdrawals were transfers between Binance’s own wallets, which a wallet tracker counts as money leaving.
The emphasis differs too. Cointelegraph and Bloomberg wrote about the exchange’s balance sheet, PYMNTS about the attacker’s tools and Help Net Security about the fraud that grows around any frozen platform. None of the four disputes the FBI attribution or the 95% coverage figure, which both come from primary statements.
What the coverage adds up to
Read together, the four accounts describe a recovery that ran on two tracks. The first was the issuers. Stablecoins made up more than half the haul, and their issuers began freezing them within the first hour. Elliptic’s Dr. Tom Robinson, the firm’s co-founder and chief scientist, set out the limit of that track: “Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because native assets have no issuer that can freeze them.”
The second track was Binance’s own capital. Everything the issuers could not freeze had to be replaced from the exchange’s treasury and its two reserve funds, and the proof that this happened comes from Binance’s proof-of-reserves snapshot of October 31, which users could verify with a zero-knowledge proof from November 2. Robinson also wrote that the laundering of the Bybit funds “took months, and we expect the same here”, so recovery of the unfrozen assets from the attacker is a long process with no promised result.
In our reading, the outflow dispute shows that the numbers clients and analysts use to judge an exchange under stress depend on who is counting and which wallets they count. Binance’s own figures cover a short window, while DefiLlama’s include internal transfers. A finance team that wants a reliable view needs both, plus the exchange’s reserve proof.
The incident also fits a pattern this desk has tracked. We covered Bitget’s $387.5 million hot-wallet hack in September, and Elliptic now says funds from the two thefts are being laundered together. Regulators in the US and UK have been writing their crypto rules around custody, the part of the business this theft went through.
What it means for the finance leader
For treasurers, fund operators and fintechs that hold assets at an exchange or use one as a trading counterparty, the recovery gives a checklist that can be run before the next incident.
- Know which balances can be frozen. Stablecoins with an active issuer were recoverable within an hour. Native assets on Bitcoin, the XRP Ledger, Solana and NEAR were not. Concentration in native assets at one venue is the exposure to measure.
- Read the venue’s loss-absorption stack. Binance covered this loss from a user protection fund with a stated $1 billion target, part of a futures insurance fund whose remaining balance it describes as a regulatory requirement, and its corporate treasury. Ask any venue you use what its equivalents are and where they are held. Binance says its SAFU is held by Nest Clearing and Custody Limited, a clearing house regulated in Abu Dhabi Global Market.
- Plan for a withdrawal pause. Binance’s withdrawals were suspended from shortly after the theft until the phased restart on November 1, and the first phase covered 15 networks. Cash forecasts that assume same-day access to exchange balances should carry a buffer for that kind of stop.
- Load the FBI address list. Compliance teams at payment firms and exchanges can screen against the addresses in the FBI alert, which the bureau asks service providers to block.
- Warn customers about compensation scams. The fake $150 payout posts show how quickly fraud follows a frozen platform. Customer-facing teams at any firm with crypto users should expect copies.
Binance says its next reserve snapshot, covering more tokens, is planned for November 4, and that the next phase of withdrawals for additional networks is due on November 3. Those two notices will show whether the remaining 5% has been bought and whether the outflows have slowed.
Source: Binance, Security Incident Recovery Update #5, November 2, 2026
