Binance Hack: FBI Blames North Korea as Exchange Says 90% Replenished

The FBI has attributed the Binance hack to North Korea, adding an official US law-enforcement finding to the investigation into the theft of more than $6 billion in cryptocurrency. Separately, Binance says it has replenished 90% of the affected assets and published a new reserve snapshot, with full cryptographic verification expected by November 3.

The Binance hack announcements mark two distinct developments: investigators are identifying those responsible and tracing stolen assets, while the exchange is replacing the missing tokens. Binance’s replenishment figure does not mean authorities have recovered 90% of the cryptocurrency from the attackers.

FBI attributes Binance hack to North Korea

In its October 31 notice, the FBI said North Korea was responsible for the theft from Binance on or around October 29. It identifies the malicious cyber activity as TraderTraitor.

The bureau said investigators working with the US Secret Service and IRS Criminal Investigation had observed stolen assets being converted primarily into Ethereum. It expects further laundering through decentralised-finance platforms and instant-swap services.

The agencies urged exchanges, blockchain analytics companies and other crypto-service operators to block transactions linked to addresses associated with the theft. The FBI published the addresses in its alert and requested information that could assist its investigation.

The attribution changes the status of earlier coverage that described responsibility as a security-researcher assessment. Readers can now refer directly to the FBI’s public finding, while the separate questions of tracing funds and establishing the complete technical attack sequence remain important.

Binance says replacement assets now cover 90%

In its third incident update, dated October 31, Binance said replenishment had risen from approximately 80% to 90%. The exchange previously said it had set aside more than $6.34 billion in company funds to address the financial impact.

Binance says holdings of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed. The outstanding portion consists of less-liquid tokens outside that list, which it continues to purchase through market and over-the-counter transactions.

The company says its response draws on corporate resources and part of its futures insurance reserves. It also described a partial deployment of its Secure Asset Fund for Users, or SAFU, as expected over the following 24 hours. Binance says it intends to restore SAFU to approximately $1 billion.

For customers following the Binance hack, the distinction is practical: asset replacement addresses the exchange’s backing of balances, while recovery concerns obtaining the stolen cryptocurrency from those controlling it. Progress on one does not establish an equivalent result on the other.

Reserve snapshot published, full proof expected November 3

Binance says it took a new Proof of Reserves snapshot at 00:00 UTC on October 31 and updated its reserve website. The exchange described the snapshot as a view of the assets accounted for at that point.

The full zero-knowledge proof is a separate step. Binance estimates generation will take 40 to 50 hours and expects it by Tuesday, November 3, UTC. It says holders of the ten named assets should then be able to verify that their assets are backed at least one-to-one.

Withdrawal reopening remains a stated target

Binance’s update gives Sunday, November 1, as its withdrawal-reopening target and promises further confirmation of the arrangements. The announcement itself does not establish that withdrawals have resumed across all assets and networks.

The next milestones in the Binance hack response are confirmation of withdrawal availability, completion of the remaining token purchases and publication of the promised cryptographic proof. Customers should check Binance’s official service notices for the asset and network they intend to use.