Binance Replenishes $6.3B in Stolen Assets as FBI Links Hack to North Korea
Binance is buying back stolen altcoins in matching quantities and has begun reopening withdrawals in phases after a $6.3 billion breach. The FBI has attributed the attack to North Korean actors, and the exchange says 95% of the affected amount has been replenished.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Recovery Efforts Under Way
Binance has begun repurchasing the tokens taken in its $6.3 billion security breach, using reserves and market purchases to restore affected balances in matching amounts. In an October 30 company update, the exchange said it had reserved more than $6.34 billion for the incident, including $5 billion already held in the same cryptocurrencies the attackers moved out of its wallets.
Binance said the remaining tokens are being bought through exchanges and over-the-counter desks, and that less liquid assets may take longer to source. Co-founder Yi He said the exchange's Secure Asset Fund for Users (SAFU) and its existing BTC and ETH holdings are being used to rebuild balances. The company has not disclosed how much BTC or ETH it will sell to fund the purchases, nor individual repurchase amounts or execution prices.
The figures are not interchangeable. The $6.34 billion is the reserved total, and the $5 billion is the portion of affected assets already on hand. Neither number shows how much new buying must happen on the open market. Binance also said $3 billion has been frozen through cooperation with token issuers, investigators and law enforcement, and that frozen or protected assets are excluded from its purchase calculations.
Withdrawals Reopen in Phases
Binance said withdrawals would resume progressively between 06:00 and 09:00 UTC, beginning with 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP, Dogecoin, Polygon, Arbitrum, Base, Optimism and Sui. Additional networks and tokens are to be added once the exchange considers them ready, and users may see temporary delays as traffic returns.
In its latest update at press time, Binance said 95% of the impacted amount had been replenished, up from 90% in its Saturday update. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed, while the remaining 5%, made up of less liquid tokens, is still being sourced. The company has said it will absorb the losses itself rather than pass them to users, and it plans to publish a full post-incident report after the investigation concludes.
Attribution and Laundering Activity
The FBI formally attributed the attack to the Democratic People's Republic of Korea, identifying the operation as part of a cyber campaign it calls "TraderTraitor." The agency said the attackers have been converting much of the stolen assets into Ethereum and expect to keep laundering funds through decentralized finance platforms and instant-swap services. The FBI, Secret Service and IRS Criminal Investigations urged exchanges, DeFi operators and analytics firms to block transactions tied to identified attacker addresses.
Chainalysis separately attributed the breach to TraderTraitor in an October 30 investigation, linking funds from the Binance hack to assets taken in September's Bitget exploit through shared wallets. According to Chainalysis, the attackers first moved $500 million in stablecoins into a wallet designed to swap assets issuers could freeze. Lookonchain has tracked large sales of stolen altcoins into Ethereum, including 7.02 million UNI ($39.63 million), 7.77 trillion PEPE ($31.66 million), 217.5 million ENA ($33.93 million) and 2.57 million LINK ($26.05 million), with the seven reported sales generating 70,480 ETH worth $158.25 million at the time. US President Donald Trump said he would look into the hack and would speak with North Korea if it is confirmed to be responsible.
Market Implications
Binance's decision to replace stolen tokens in their original denominations could create buying demand for individual altcoins, though OTC trades may match counterparties without placing equivalent orders on public venues. The exchange has not published enough detail to measure that effect. The attribution and laundering reports leave open how much of the stolen value can be recovered, since frozen funds remain subject to ongoing checks.
Why It Matters
For Traders
Binance's undisclosed open-market buying of less liquid altcoins could add temporary demand for those tokens, but the exact size and timing remain unknown.
For Investors
The breach and its handling show how exchange reserves and state-linked laundering can shape confidence in centralized custody over a multi-month horizon.
For Builders
Attackers routing funds through DeFi and instant-swap services means protocols should expect and screen for flagged-address transactions and freeze requests.
This article is for information only and is not financial advice. Read the full disclaimer.
