One week after the Binance hack, the exchange says it has replaced 98% of what was taken, blockchain analysts have frozen about $2.8 billion, and the proof that was supposed to settle the matter is still unfinished. The FBI has named a North Korean group, and North Korea has denied it.
What follows is the tally as it stands on Thursday, with each figure dated, because almost every number attached to the Binance hack has moved during the week. Four questions remain open, and they are the ones that decide whether the recovery holds.
The pieces that investigators have placed publicly leave roughly $1.84 billion of the Binance hack with no stated location. Source: Chainalysis, FBI address list via The Block, SomaXBT · Chart: FinanceFeedsThe Binance Hack Scorecard One Week On
Three different totals are circulating for the Binance hack, and all three are defensible. Binance’s own incident report puts the theft at approximately $6.34 billion, Chainalysis puts the unauthorized transfers at about $6.4 billion, and $6.3 billion remains the figure most outlets use.
Chainalysis recorded about $2.8 billion frozen as of 11:30 a.m. ET on 3 November, with freezes beginning at 5:14 p.m. ET on 29 October. Reuters reported Binance had located roughly $3 billion, which is a different claim from frozen and a recurring source of confusion in Binance hack coverage. Tether froze nearly $1.57 billion and Circle more than $800 million, so the two stablecoin issuers account for $2.37 billion of it.
Users voted with their balances the moment Binance reopened the doors to withdrawals. Binance recorded $3.64 billion of net outflows on the first day back, which Changpeng Zhao framed as 98% of customers choosing to stay despite the Binance hack.
The reach of the Binance hack now extends past crypto and into bank supervision. Federal Reserve and OCC supervisors began calling US banks on Monday to check their systems, according to Reuters, which is the first sign the event is being treated as a banking-system question rather than a crypto one.
Replenishment Has Climbed From 90% to 98%
Binance’s replenishment claim has risen at every telling since the first weekend after the Binance hack. Reuters carried 90% on 31 October, The Block reported about 95% on 2 November, and The Defiant put it at about 98% on 4 November.
At 98% of $6.34 billion the unreplaced remainder is roughly $127 million, which Binance describes as less liquid tokens it is still sourcing. The exchange set aside around $6.34 billion of company funds internally and made a partial deployment of its $1 billion Secure Asset Fund for Users.
Each step up was announced by Binance rather than confirmed by an outside auditor, which is the gap the Binance hack proof of reserves was meant to close. Source: Reuters, The Block, The Defiant · Chart: FinanceFeedsThe $5 Billion CertiK Could Not Verify
A Binance spokesperson told Cointelegraph on 30 October that “the $5 billion is held in the exact token assets that are required” and that “these assets are in Binance custody.” The company declined to disclose wallet addresses, citing security concerns in the wake of the Binance hack.
CertiK told the same outlet it needed more information from Binance before it could determine whether that $5 billion could be independently verified on-chain. CertiK chief executive Ronghui Gu had earlier estimated a gap of roughly $2.1 billion.
The proof itself has grown considerably in scope since that first snapshot was taken. Binance ran a zero-knowledge proof-of-reserves snapshot across 10 assets on 2 November, with co-founder Yi He estimating 40 to 50 hours to generate the full proof, then expanded the snapshot to 44 tokens by 4 November. Checking Binance’s public proof-of-reserves page on Thursday, the audit time and verification mechanism fields were both blank.
Investor Takeaway
The Binance hack recovery rests on claims the exchange has made about its own books, so the completed 44-token proof is the thing to wait for rather than the rising percentage.
18,270 Bitcoin Have Not Moved
The FBI issued an alert on 31 October naming TraderTraitor, a North Korean operation, and listing wallet addresses it asked services to block. Kim Yo Jong rejected the accusation in a statement carried by KCNA on 3 November, saying the FBI was trying to brand her country a cyber criminal state.
Chainalysis reached the same attribution independently for the Binance hack, citing stolen funds commingling with proceeds from last month’s Bitget exploit. North Korea’s denial ran on FinanceFeeds, alongside Binance’s claim that it had blocked 57 suspected North Korea-linked attacks before this one succeeded.
Most of the stolen bitcoin is still sitting exactly where the FBI said it was. All 18,270 BTC remain in the 19 addresses on the FBI list according to mempool.space data cited by The Block, worth about $1.47 billion at Thursday’s price, though Elliptic counts 18,327 and the discrepancy is unresolved. About 466,700 SOL sits in the attacker’s Solana wallet, and FinanceFeeds has tracked the conversion of stolen Solana into bitcoin through THORChain.
Moving money in a hurry has been expensive for whoever is holding the proceeds. Chainalysis describes $500 million of stablecoins going to a wallet that swapped $325 million into $285 million of ether across about 20 minutes, a haircut of 12.3%. Onchain analyst SomaXBT put $242 million through Tron over two days, a figure The Block did not independently verify.
The Binance Hack Began With a Tampered Homebrew Install
The chain started in June, when a wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool. Binance replaced the device, but the attackers already had details of the engineer’s colleagues and responsibilities.
In September they posed as a fictitious company on a recruitment platform and sent a coding assignment carrying malware that evaded endpoint security. By 20 October they were using an internal AI tool to reach two more engineers’ machines, where they found a credential with container deployment permissions. On 29 October a malicious script reached an internal wallet-signing service and authorized transfers outside the normal withdrawal process. One fake interview opened $6.34 billion, and the attackers used Ethereum’s EIP-7702 to hold control after withdrawals were suspended, which Binance cleared at 00:10 UTC on 30 October.
Four Questions Binance Still Has Not Answered
Four questions decide whether the Binance hack recovery holds, and none has a published answer.
Can the $5 billion be verified? CertiK says not without more information, and Binance will not publish the wallet addresses.
Is the proof finished? The 44-token snapshot was described as unfinished on 4 November, and the public page carries no audit time.
Are withdrawals fully open? Binance said on 3 November that withdrawals had normalized, while The Defiant reported the following day that they were not fully reopened.
Who gets the frozen $2.8 billion? Freezing is not returning, and no issuer has said when or whether those assets reach Binance or its users.
Investor Takeaway
The gap between the $6.4 billion taken and the roughly $4.6 billion publicly located is the open exposure in the Binance hack, and the completed proof of reserves is what closes it.
