Binance has fully replenished the approximately $6.34 billion in cryptocurrency stolen during its October 29 security breach, while U.S. authorities have secured court authorization to seize or restrain more than $1.2 billion of the stolen assets, which have been linked to North Korean hackers.

The exchange completed the replacement of affected customer assets on November 12, drawing on corporate funds, emergency reserves and insurance resources to cover the losses. A new Proof of Reserves snapshot spanning 198 cryptocurrencies has also been published, although its full cryptographic verification remains pending.

The replenishment arrives two weeks after attackers drained roughly $6.3 billion from Binance's hot wallets, prompting emergency withdrawal restrictions and one of the largest coordinated asset-freezing operations in cryptocurrency history. The response has run on two fronts—treasury-funded customer compensation and multi-agency asset freezing—a combination that has become common in how the industry and law enforcement handle the sector's largest thefts.

Binance Completes Asset Replenishment, Withdrawals Remain Limited

Binance financed the replacement of stolen assets through its Secure Asset Fund for Users (SAFU)—the emergency insurance fund it established in 2018—along with surplus capital from its futures insurance fund and its corporate treasury. Approximately 98% of the affected assets had already been restored earlier in the month, with the remaining portion consisting primarily of less liquid cryptocurrencies that required additional purchases through spot markets and over-the-counter transactions.

Proof-of-reserves disclosures became widespread industry practice after the collapse of FTX in late 2022, when major exchanges began publishing cryptographic attestations so customers could confirm their balances are backed. The November 12 reserve snapshot covers 198 tokens and is designed to allow customers to verify that their holdings are backed at least 1:1. However, the complete zero-knowledge proof was not available when Binance announced the replenishment. Its generation was expected to take another 40 to 50 hours, meaning independent verification of the latest snapshot remained outstanding.

Binance has also committed to restoring SAFU to approximately $1 billion after drawing on the emergency fund. Withdrawals continue to reopen in phases, rather than returning to full availability across every supported network. Remaining milestones in the recovery include publication of the completed zero-knowledge proof and the return to full withdrawal availability across all supported networks.

The exchange emphasized that replacing customer assets is separate from recovering the stolen cryptocurrency, which remains subject to ongoing blockchain tracing and law enforcement action.

U.S. Freezes $2.7 Billion Linked to North Korean Hackers

The U.S. Department of Justice secured court authorization to seize or restrain more than $1.2 billion in stolen Binance assets on November 12. That amount forms part of more than $2.7 billion frozen through coordinated efforts involving federal investigators, cryptocurrency exchanges and other private-sector partners. The court orders do not establish that any of the funds have already been returned to Binance. Freezing operations of this kind have become a routine first step in major crypto-theft cases, though converting court orders into returned assets can take years of legal proceedings.

The FBI previously attributed the attack to North Korea's TraderTraitor operation—a program U.S. agencies have tracked publicly since 2022—which exploited compromised internal systems to initiate unauthorized transfers across multiple blockchains. Binance's preliminary investigation traced the intrusion to compromised employee devices, stolen credentials and access to its wallet-signing infrastructure. The attackers also exploited Ethereum's EIP-7702 authorization mechanism, a feature introduced in the network's May 2025 Pectra upgrade that lets standard wallets temporarily act as smart contracts, to move funds independently of the exchange's normal withdrawal systems.

North Korean operators have continued attempting to launder the proceeds through cryptocurrency bridges, mixers and exchanges; U.S. and United Nations investigators have repeatedly tied such theft campaigns to state financing. Earlier recovery efforts included Arbitrum securing approximately $30 million in stolen Binance assets, subject to governance approval before any release.

DOJ Disrupts Separate $400 Million North Korean Scam

U.S. investigators also disrupted a separate North Korean social-engineering campaign known as FaceStealer, responsible for stealing more than $400 million in cryptocurrency over the preceding 18 months. The operation used compromised messaging accounts, fraudulent video meetings and AI-generated deepfakes to deceive cryptocurrency professionals into installing malware.

Attackers frequently impersonated trusted contacts before introducing fabricated technical problems during video calls, persuading victims to download malicious software that provided access to their computers and cryptocurrency holdings.

The FBI seized cloud infrastructure supporting the campaign and obtained more than 900 webcam videos of victims under a federal warrant, combining infrastructure seizure with the asset-restraint strategy applied in the main hack investigation. Investigators are also examining attempts to compromise developers who maintain open-source software, which could have given attackers access to widely used software repositories and their users.