Two days after the largest crypto theft on record, the story has moved from shock to attribution — and, unusually fast, to recovery. On Saturday 1 November, the FBI formally blamed North Korea for the theft of more than $6 billion in virtual assets from Binance, while Binance said it had already replenished 90% of what was stolen from its own funds and remained on track to reopen customer withdrawals on Sunday.
For ordinary holders, the weekend’s news answers two different questions: who the authorities believe did it, and whether users will be left out of pocket. On the second point, Binance’s message is unambiguous — users will not bear the loss. On the first, the FBI’s attribution carries a warning of its own: the stolen funds are already being moved, converted mainly into Ethereum, ahead of further laundering attempts.
THE FBI’S ATTRIBUTION: TRADERTRAITOR
The FBI said on Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October 2026. It named the activity “TraderTraitor”, the same North Korea-affiliated group behind last year’s $1.5 billion Bybit hack, according to reporting of the FBI statement.
The bureau said that, together with partners at the US Secret Service and IRS Criminal Investigation, it had observed TraderTraitor actors converting stolen assets primarily into Ethereum. It expects those assets to then be further laundered through decentralised finance (DeFi) protocols and instant swap services. The FBI also shared a list of Bitcoin, Ethereum and Solana addresses holding or having held assets from the theft, and asked exchanges, blockchain analytics firms and others to block transactions linked to them.
That laundering path matters because it explains part of the market’s anxiety. Stablecoins such as USDT and USDC can be frozen by their issuers at specific addresses — around $3 billion of the Binance haul was reportedly frozen in the first hours — but Ethereum moves differently, and DeFi swaps can obscure the trail far faster than Bitcoin’s transparent ledger allows.
BINANCE’S RECOVERY: 90% REPLENISHED, WITHDRAWALS DUE SUNDAY
Binance said on Saturday that it had replaced 90% of the stolen assets, up from about 80% in its previous update, and that it was committed to covering the remaining 10%. Co-CEO Richard Teng said on X: “We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%. Our users will not bear the financial impact of this incident.”
The exchange said it had set aside more than $6.34 billion in company funds to cover the losses, including $5 billion held in the exact tokens that were stolen. The replacement purchases are being funded from three pools: the company’s corporate treasury, a partial draw on its Secure Asset Fund for Users (SAFU) — the emergency reserve built from trading fees — and its Futures Insurance Fund. Binance has committed to restoring SAFU to about $1 billion after the draw.
The remaining 10% consists of less liquid tokens that may take longer to source in the required amounts, Binance said, and it is buying those through public markets and over-the-counter trades rather than moving spot prices sharply. Customer holdings of the ten listed tokens — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC — are now fully backed, according to the exchange, which also posted a new snapshot of platform assets as of 00:00 GMT on 31 October as part of its proof-of-reserves process. Full cryptographic proof is expected by 3 November.
One honest caveat, flagged by security firm CertiK in reporting on Friday: the $5 billion replacement figure could not yet be independently confirmed, because Binance had not supplied enough detail, and the exchange itself says the full zero-knowledge proof takes 40 to 50 hours to generate. Until that proof lands on 3 November, the 90% figure is Binance’s own report — encouraging, but not yet independently verified.
Binance suspended customer withdrawals after the hack, and said on Saturday it remained on track to reopen them on Sunday, subject to security checks. Investigators have also found additional breach points beyond an initially suspected compromised employee laptop, according to the exchange — a reminder that the security investigation is still open.
THE MARKET’S VERDICT: ETFS SOLD, SPOT HELD
While the recovery news was breaking, Friday’s fund-flow data told a harsher story about institutional sentiment. US spot Bitcoin ETFs recorded $643.2 million of net outflows on 30 October, wiping out October’s gains in a single session and flipping the month to roughly negative $515 million. BlackRock’s IBIT led with $233.7 million of outflows, followed by Fidelity’s FBTC at $201 million and ARK’s ARKB at $129.5 million — ending a four-day run of inflows.
Spot Ethereum ETFs lost a further $155.7 million on Friday, their fifth straight day of outflows, with BlackRock’s ETHA accounting for $76.6 million. Combined, about $799 million left US spot Bitcoin and Ethereum ETFs in one session.
Crucially, those ETF investors were not forced sellers: their coins were not on Binance and no margin call applied to them. They sold because the headline said “biggest hack in history”. That distinction matters for what comes next — the first daily flow print after the weekend will show whether institutions treat the FBI attribution and the 90% recovery as a reason to return, or whether caution lingers.
Spot prices, meanwhile, steadied. Bitcoin closed 31 October at $77,435, up 0.4% on the day after a $76,974–$77,608 range, and Ethereum ended at $2,253, up 0.5%. Total market capitalisation stood at about $2.58 trillion, and the Crypto Fear & Greed Index ticked up from 30 to 34 — still in “fear” territory, but no longer falling. Derivatives told a calmer story too: crypto-wide liquidations dropped to about $427 million on Saturday from $1.53 billion on 30 October, when 84% of forced closures were long positions.
Breadth was still negative — only 14 of the 50 largest assets rose while 30 fell — but the standout was TON, up 51.7% to $1.78 in Basis Desk’s close, rebounding from its 34% plunge the day before. Whale flows were roughly balanced, with $888.6 million deposited to exchanges against $982.6 million withdrawn.
WHAT TO WATCH NEXT
Three dates and numbers will decide whether this weekend marks a turning point or just a pause:
Sunday’s withdrawal reopening. If withdrawals resume smoothly, it will be the strongest practical signal yet that Binance’s operations are back to normal. Any delay or fresh restriction would say the opposite.
3 November’s proof of reserves. Binance’s full cryptographic proof is the independent check on its 90% claim. Watch whether it confirms 1:1 backing for the ten listed tokens.
The next ETF flow print. Friday’s $643 million Bitcoin outflow was a sentiment vote, not a forced sale. A return to inflows would suggest institutions have shrugged off the hack; continued outflows would suggest the damage to confidence runs deeper.
For individual holders, the practical advice from Friday still stands: beware of phishing — scammers surge exactly when users are anxious — use only Binance’s official app, website and announcements, never share passwords, codes or seed phrases with anyone claiming to be support, and consider a hardware wallet for crypto you plan to hold long-term rather than leaving everything on any single exchange.
THE BOTTOM LINE
Saturday brought the two things the market most needed after Thursday’s shock: a named culprit and a funded recovery plan. The FBI’s TraderTraitor attribution puts the hack in a long, state-sponsored pattern rather than a one-off insider failure, and Binance’s 90% replenishment — if its proof of reserves confirms it on 3 November — would make this the fastest large-scale customer make-whole in crypto history.
Neither fact erases the hack itself. Around $3.3 billion remains unrecovered, the stolen Ethereum is already moving toward DeFi laundering routes, and nearly $800 million fled ETFs in a day. But the weekend’s arc — attribution, replenishment, steadying prices — is a long way from the panic of Friday morning. Crypto’s biggest heist may yet become its fastest recovery.
This post is for information only and is not financial advice. Figures are as reported on 1 November 2026 by the FBI, Binance, Reuters, Farside Investors, Basis Desk and other outlets, and are subject to revision as the investigation and recovery continue. Cryptocurrency markets are volatile — do your own research before making investment decisions.
