Binance after the attack: FBI points to North Korea. Proof of reserves announced for Tuesday

The FBI attributed the theft from Binance to North Korea and published addresses associated with an activity it calls TraderTraitor.

According to a summary quoted by bitcoin.com, after the resumption of withdrawals, the net outflow amounted to approximately $3.6 billion. in less than 10 hours. However, data from wallets does not allow identifying each transfer with a client’s payment.

Binance announces full crypto proof of reserves on Tuesday, November 3. The previously published reserve status refers to October 31, not the date the proof was made available.

The FBI attributed the October 29 attack on Binance to North Korea. The FBI alert indicated the theft of over $6 billion. and a business referred to as TraderTraitor. Binance, meanwhile, has resumed some withdrawals and announces full proof of reserves on Tuesday, November 3.

What the FBI found

The FBI, together with the Secret Service and IRS-CI, the criminal investigation department of the US Tax Administration, observed the conversion of stolen assets primarily into ETH. It appealed to cryptocurrency service operators to block transactions related to the indicated addresses.

According to the list quoted by BleepingComputer, the list includes 628 addresses, including 19 bitcoin addresses. TraderTraitor was also previously indicated by analytical companies TRM Labs and Chainalysis.

What happens to stolen funds

Lookonchain indicates the wallet that it associates with the attacker and from which the salt is exchanged for bitcoin via the Relay protocol. The value of the described transfers is approximately USD 46 million, according to crypto.news. The attribution for this portfolio comes from analysts, not a separate FBI confirmation.

The Secret Service says it and its partners have blocked a “significant portion” of assets, without specifying the amount. Binance’s industry estimates and previous announcements put it at around $3 billion. Freezing limits the possibility of further transfer of these funds, but does not mean that they will be returned to the exchange.

Are you reading us? Add bitcoin.pl to your preferred sources on Google

Outflow after resumption of withdrawals

Binance began restoring withdrawals on Sunday, November 1. First, it released Bitcoin, followed by other assets and networks. crypto.news lists USDT, USDC, ETH and BNB and supported connections on the Ethereum and BNB Smart Chain networks. Availability must be checked separately for a specific token and network.

The first stage includes 15 networks, including Ethereum, BNB Smart Chain, Tron, Solana and XRP Ledger. Binance also states that it has replaced 95% of the lost assets, and the balances include: BTC, ETH, USDT, BNB, SOL and USDC are fully covered according to the exchange, as reported by crypto.news. This is a declaration from the stock exchange that is to be verified by the announced proof of reserves.

According to the summary quoted by bitcoin.com, on November 1, between 6:00 a.m. and 3:30 p.m. UTC, approximately $4.65 billion was withdrawn from the exchange and approximately $1.01 billion was deposited. The net outflow amounted to approximately USD 3.6 billion, or approximately 2.1% of the exchange’s assets estimated at USD 171 billion. According to DefiLlama data, cited by the same website, Binance’s tracked assets dropped by nearly 12% from October 29 to the beginning of November 2.

This combination requires caution. Some transfers between wallets may be internal operations, and the result depends on which addresses analysts have assigned to the exchange. This is not automatically the amount that customers have withdrawn from the platform.

What is Tuesday’s reserve certificate supposed to show?

Binance released its reserve breakdown as of October 31 at 00:00 UTC. The stock exchange announced full zero-knowledge proof by November 3. It was originally supposed to be ready the day before, but it takes 40-50 hours to generate it. This is the date expected by Binance, not a confirmation that the proof is now available.

The proof is intended to enable verification of the inclusion of the balance in the statement and the coverage of liabilities to customers with assets in the scope of the indicated tokens and the adopted method. It is not a full audit of the company or a confirmation of all its obligations. Data from October 31 do not automatically show the situation after later payments.

Three things should be accounted for separately: assets frozen at the attacker’s addresses, funds actually recovered and purchases with which Binance replenishes its reserves. When an exchange finances missing assets from its own resources or protection funds, it does not mean recovering the same coins from the perpetrator.

Which VPN to choose? VPN Ranking 2026: Speed Test, Audits and Ratings

What does this mean to you

If you use Binance, check the payout status for your assets and selected network in the app. The reissue of one token does not mean that all the others can also be withdrawn.

Do not follow links to alleged “Binance compensation” sent in private messages. Check information about withdrawals and reserves in the official application or via the exchange website you open yourself.

Accounts in Binance Poland have been operating in a mode limited to withdrawals and closing positions since July 1, as described in the text that Binance is suspending services in Poland. The general message about the resumption of withdrawals does not determine when a given function will return on such an account, so check the scope of available operations in the account settings and in the messages sent by the exchange.

This case also shows the risk of keeping funds on the exchange: access to them is determined by the operator’s security and decisions. How to transfer part of the funds to your own wallet is described in the guide on which cryptocurrency wallet to choose.

What is not known yet

There is no confirmed final amount of recovered assets. Binance’s full technical report on the causes of the attack remains pending, and the result of the proof of reserves will only be known after its publication.