Binance Replaced 95% of Assets After $6.3B North Korea-Linked Hack

Binance had reported replacing approximately 95% of the assets affected by an October 29 hack involving $6.3 billion in stolen assets, and the exchange updated its proof of reserves as recovery continued.

Binance committed company funds, including its Secure Asset Fund for Users (SAFU), to cover customer losses. That decision put Binance’s own resources behind replacement while recovery continued, separating customer reimbursement from recovery of the underlying stolen assets.

The October 29 attack targeted Binance hot wallets across multiple blockchain networks. The FBI later attributed the breach to North Korea’s TraderTraitor hacking group. Binance initially attributed the compromise to a compromised employee laptop, then identified additional entry points after its first account of the intrusion.

That revision matters because it moved the explanation beyond one compromised device. For an exchange, the operational consequence extends to wallet access, internal security and the ability to honor balances across several networks at once.

How did the attackers launder the stolen funds?

Blockchain analytics firm Elliptic identified a laundering technique in a November 9 report. Attackers created new meme tokens on the NEAR blockchain, paired tokens with little or no market value with legitimate assets in liquidity pools, and used the pools to exchange stolen cryptocurrency and move funds between wallets.

Elliptic characterized the newly created tokens as having little or no market value. The technique worked in three steps:

• Attackers create new meme tokens on the NEAR blockchain.
• They pair the tokens with legitimate assets in liquidity pools.
• They use the pools to exchange stolen cryptocurrency and transfer funds between wallets.

What does the Bybit comparison establish?\n

Elliptic said similar methods appeared during the Bybit hack. That activity involved Tron, followed by Binance-related transactions on Solana. The sequence shows how investigators can connect an earlier compromise to later movement through several chains without assuming the funds stayed on the network where the theft began.

For Binance, the laundering pattern broadens the monitoring problem. The trail described by Elliptic spans wallet activity, token creation, liquidity-pool deployment and cross-chain transfers on NEAR, Tron and Solana, rather than only withdrawals from a compromised hot wallet.

What does “replaced” mean?\n

Replacing approximately 95% of affected assets is not the same as recovering approximately 95% of the stolen crypto. The report says Binance replaced the assets; it does not say it recovered the same share of the theft. Corporate reimbursement and on-chain recovery remain separate measures.

The proof-of-reserves update carries direct business significance after a multi-network breach. Customers and counterparties need to distinguish the assets used to make customers whole from the assets recovered through tracing. The available material did not disclose a post-hack reserve ratio, reserve snapshot or audit method, so the update does not establish a new numerical solvency threshold.

What other security developments were reported?\n

Two related security and enforcement developments also appeared alongside the main report:

• Trezor reduced its reseller network by 80% after detecting implants in wallet hardware.
• TRON, Tether and Chainalysis launched a task force to freeze illicit USDT before it moved.

What changes next?\n

The Binance case points to two operational controls: detecting unauthorized access before it reaches hot wallets, and tracing newly issued tokens through liquidity pools and across chains. The combination of new meme-token creation, minimal value and immediate asset pairing gives analytics firms a specific pattern to flag, while the multi-network transfers require exchanges to preserve evidence on each chain.

With no recovery deadline or enforcement timetable disclosed, the next material checkpoint will be whether cross-chain tracing produces further recoveries and whether Binance’s updated reserve disclosures quantify the gap left after the roughly 95% replacement.