Hackers emptied roughly $6.3 billion from Binance’s online wallets, and the FBI now blames North Korea’s TraderTraitor operation. Binance says the exchange will absorb the financial loss. The hard part is understanding what all the recovery numbers actually mean.

Binance says it has replaced 90% of the stolen assets using its own treasury, part of its futures insurance fund and part of SAFU, the emergency reserve it maintains for users. Bitcoin, ether and eight other major assets were fully backed again by October 31, the exchange said. It plans to keep buying the remaining, less-liquid tokens until every affected asset is covered.

Now the trick: three large numbers describe three different jobs. Binance says partners froze about $3 billion on public blockchains, meaning those tokens are blocked in place. Its $6.34 billion company reserve is money set aside to absorb the loss. Replenishment is Binance’s replacement of the missing asset backing. Recovery begins when stolen value returns under Binance’s control.

For customers, deposits were operating normally at the latest October 31 update. Withdrawals remained paused, and Binance said it was on track to begin a phased reopening on November 1 after final security checks. The company had taken a new reserve snapshot and was generating its updated cryptographic Proof of Reserves.

The investigation also moved beyond Binance’s first explanation. The exchange initially pointed to a compromised DevOps engineer’s laptop that gave an attacker access to a service used to submit withdrawals. It later said investigators had found additional breach points. Binance’s promised full technical postmortem is the next formal account of how those routes worked.

The FBI says TraderTraitor actors were converting much of the stolen value into ether before further laundering. TRM Labs and Chainalysis independently reached similar North Korea-linked assessments. Their estimates—about $6.36 billion and $6.4 billion—measure the same attack at slightly different cutoffs. Binance uses the rounded $6.3 billion figure.

Customers should ignore anyone claiming to be a support agent who asks for a password, seed phrase or ‘recovery fee.’ Confirmed withdrawal notices and the promised postmortem will appear on Binance’s own channels.

Sources and evidence for this report

· Financial Integrity Watch