Binance Says It Recovered All $6.3 Billion Stolen in Record Hack

Binance has announced the full recovery of the $6.3 billion in digital assets stolen in the largest hack in crypto history, even as U.S. federal authorities and private-sector partners have frozen more than $2.7 billion of the same stolen funds and the Department of Justice secured court authorization to seize or restrain an additional $1.2 billion.

The recovery closes a chapter that began with one of the most operationally complex exploits the industry has recorded. According to blockchain analytics firm Elliptic, the attackers moved the loot across more than 20,000 wallets in at least 65,000 transactions within a single week — a laundering footprint that, measured per day, averaged well over 9,000 transactions. Binance initially covered most of the losses within days using company profits and emergency reserves, while the remaining 10 percent required additional time to restore.

The trail also branched into corners of the market rarely associated with large-scale laundering. Roughly $430,000 of the stolen funds moved through memecoins, and Chainalysis identified Chinese money-laundering networks as part of the cash-conversion process.

What does the full recovery change for users?

Binance paired the recovery announcement with a refreshed Proof of Reserves snapshot dated November 12. The figures, according to reports, show the following movements in user holdings:

• BTC holdings rose 0.35 percent to 687,900 BTC.
• ETH reserves increased 1.04 percent to 3.48 million ETH.
• BNB holdings climbed 1.03 percent to 42.95 million tokens.
• USDT reserves declined 3.68 percent to 24.3 billion tokens.

The exchange framed the snapshot as more than a quarterly formality. In a post on X, Binance stated: "Once the zero-knowledge proof is generated, users can independently verify that their assets are backed at a minimum of 1:1." The mechanism matters for practitioners: a zk-proof-based reserve attestation lets clients verify backing without trusting a third-party auditor's spreadsheet, a meaningful shift from the opaque attestations that preceded the collapse of several exchanges in prior cycles.

Binance also addressed its client base directly, writing: "To our users and community: thank you for your patience and understanding." Whether the technical guarantee and the restored balances rebuild durable confidence is the open question the snapshot alone cannot answer. The modest growth in BTC, ETH and BNB balances suggests users did not stage a broad exodus; the 3.68 percent drawdown in USDT reserves points to some rotation out of stablecoins on the platform.

Enforcement keeps tightening around the stolen funds

While Binance closes its internal ledger, U.S. authorities are still working the criminal side. The DOJ obtained court authorization to seize or restrain more than $1.2 billion in stolen assets as tracing continues, and the freeze of $2.7 billion by federal agencies and private-sector partners remains in force.

The actions sit within a broader campaign. The DOJ announced coordinated measures against North Korean cybercriminal operations responsible for cryptocurrency thefts worth billions of dollars. One identified operation, known as FaceStealer, has reportedly stolen more than $400 million in cryptocurrency over the past 18 months — an average of more than $22 million per month. The FBI also seized the cloud infrastructure used in that campaign, along with more than 900 webcam videos of victims.

For compliance teams, the combination is instructive. The recovery illustrates how quickly an exchange can plug a balance-sheet hole with reserves; the enforcement track shows that frozen and seized funds can remain locked in legal process long after an exchange declares itself whole. The two timelines do not move together, and the gap between them is where recovered claims often stall.

The practical question now is sequencing: when the DOJ's seizure authorizations convert into forfeitures, distribution to harmed parties will follow a court-controlled timetable rather than Binance's recovery schedule, and practitioners should watch the DOJ's next filing window for clarity on claims.