The Binance hack has become a two-part story: who investigators say stole the money, and what the exchange has actually restored. On October 31, the FBI attributed the theft of more than $6 billion in virtual assets to North Korea-linked actors it calls TraderTraitor. Binance separately said it had replenished 90% of the assets taken in the October 29 attack. These are important developments, but neither is a final accounting of recovered funds or a completed forensic investigation.
The distinction matters for customers. A government attribution identifies alleged perpetrators; a company replenishment figure describes its effort to replace missing assets. Neither alone proves that stolen cryptocurrency has been returned to Binance, that every affected token is backed, or that withdrawals have resumed. The latest statements from the FBI and Binance have to be read together, not merged into one reassuring percentage.
What changed in the Binance hack investigation
The FBI's October 31 alert says the theft occurred on or about October 29 and names TraderTraitor as the North Korean malicious cyber activity responsible. It says investigators working with the Secret Service and IRS Criminal Investigation observed actors converting stolen assets primarily into ether. The agencies expect further laundering through decentralized-finance and instant-swap services and urged industry participants to block transactions associated with identified addresses.
That is an official law-enforcement attribution, not a public reconstruction of every step used to penetrate Binance. The FBI alert does not disclose a complete intrusion timeline, the number of affected accounts or the final amount recoverable. The Associated Press also reported the attribution, while noting the investigation and political disagreement over responsibility. Those limits should stay visible in coverage of a theft this large.
Binance's own October 30 statement places the compromise of its hot wallets at about 20:05 UTC on October 29 and estimates stolen assets at $6.3 billion. The company said an initial suspicion involving a compromised laptop had expanded to additional breach points, and that investigators had found no evidence at that stage of leaked wallet private keys. The absence of such evidence is not a final technical finding: Binance said its investigation was ongoing.
Why 90% replenished is not 90% recovered
On October 30, Binance said it had set aside more than $6.34 billion of company funds and had covered approximately 80% of the affected amount in the relevant assets. Its October 31 recovery update raised that figure to 90%. It said ten named tokens—including bitcoin, ether, USDT and BNB—were fully backed at that point, while the outstanding portion involved less-liquid assets that could take longer to buy.
The company said replenishment drew on its corporate treasury, part of its futures insurance fund and a planned partial deployment of its Secure Asset Fund for Users, or SAFU. These are sources for replacing missing balances. They are not, by themselves, proof that attackers surrendered the stolen tokens or that law enforcement seized equivalent assets. The remaining 10% is a company-reported measure at a particular update, not a fixed dollar loss that can safely be calculated from the original $6.3 billion estimate without token-by-token valuation details.
Frozen assets are a separate recovery measure
In its October 30 incident update, Binance said approximately $3 billion had been frozen on-chain through work with partners. That figure describes assets reportedly restricted from moving, not assets already returned to the exchange. Frozen funds may still require legal, technical or administrative steps before any transfer or recovery. They also must not be added to the more than $6.34 billion Binance says it set aside: one is a status of suspected stolen funds, the other a company financing response.
This is the same accounting discipline that matters in Unhyd's comparison of FTC and FBI fraud-loss figures: numbers with different scopes cannot be combined merely because they concern the same problem. Here, stolen value, frozen value, replacement funding and customer reserve coverage answer four different questions.
What the proof-of-reserves update can establish
Binance said it took a new proof-of-reserves snapshot at 00:00 UTC on October 31. The company expects the full zero-knowledge proof for the ten named assets to become available by November 3, after a stated 40-to-50-hour generation process. A snapshot can help customers assess whether specified assets back reported liabilities at a point in time once the proof is published and independently checked. It cannot, by itself, explain how an intrusion happened or guarantee that future withdrawals will always be available.
The company said on October 31 that it remained on track to reopen withdrawals on Sunday, November 1. That is a target, not confirmation that services were restored by the time of this article. Readers should check the exchange's current official status notices rather than treat a projected reopening as a completed event.
What customers should verify before taking action
First, distinguish a security notice from a phishing message exploiting the incident. Navigate directly to Binance's official support and account pages; do not enter credentials or recovery phrases through links received in unsolicited messages. Second, verify the actual withdrawal status for the relevant asset and network. Third, when the complete proof-of-reserves material is available, examine what it covers and whether the claimed backing is supported by the published verification method.
These steps do not make a centralized exchange risk-free. They help separate customer account access, asset backing and the platform's operational ability to process withdrawals. Unhyd's earlier coverage of a separate security incident illustrates why a company's immediate containment claims and its eventual technical findings should not be treated as identical.
The next evidence that matters
The meaningful next updates are a verified reopening of withdrawals, the complete reserves proof, a token-by-token replenishment status and a technical account of the attack that can be checked against independent evidence. Law-enforcement actions involving identified wallets could change the recovery picture, but the FBI's attribution is not the same as a court judgment or a recovered-funds announcement.
For now, the clearest reading is that the FBI has named North Korean actors in a major theft and Binance says it is using its own resources to replace customers' missing assets. The 90% figure describes reported replenishment, not 90% of stolen cryptocurrency retrieved. Keeping those facts separate is more useful than either a claim of total recovery or a suggestion that nothing has been done.
