The phase that began at 04:00 UTC on November 3 restored 31 assets on Ethereum and 20 on Solana, and Binance says it has replenished about 95% of what was taken on October 29. Seven networks, among them BNB Smart Chain, Tron and Base, still have no restoration date.
Binance restored withdrawals for 51 more tokens early on November 3, in a phase that opened at 04:00 UTC and covered 31 assets on Ethereum and 20 on Solana, according to crypto.news. Five Ethereum stablecoins, RLUSD, USD1, TUSD, FDUSD and XUSD, had been reopened earlier the same day, which brought the number of Ethereum assets restored that day to 36.
Seven networks are still waiting. BNB Smart Chain, Tron and Base are among them, and Binance has not given a completion time for the assets that remain. The exchange is reopening each asset and network as it passes its security checks, and deposits have stayed open throughout. "Deposit services remain open and are not affected by the incident," it said in a statement reported by The Hacker News.
Withdrawals had been suspended since early on October 30, the day after about $6.3 billion was drained from the exchange's hot wallets. When co-CEO Richard Teng said that day that investigators had found breach points beyond the employee laptop Binance first suspected, he named Sunday as the target for restarting the service. Withdrawals reopened on November 1 at 06:00 UTC, initially across 15 blockchain networks.
Customers moved quickly once they could. Between 06:00 and 15:30 UTC on November 1, Binance said it processed $4.649 billion in withdrawals against $1.01 billion in deposits, a net outflow of about $3.64 billion. The exchange put that at around 2.1% of its reported assets, The Register reported.
Binance has been buying back what was taken rather than waiting to recover it. It had replenished about 95% of the affected assets by November 1, up from 90% on October 31 and 80% on October 30. The remaining share is the harder part, because those assets are less liquid and buying them in the quantities needed takes longer. Teng has reserved more than $6.34 billion of company funds against the losses, about $5 billion of which Binance already held in the tokens that were taken, and the exchange has pledged to restore its SAFU emergency reserve to about $1 billion. Its next proof-of-reserves snapshot is planned for November 4, with the proof itself expected to take 40 to 50 hours to generate.
The other development since Binance's own account of the attack is an attribution. The FBI published an alert on October 31, with the US Secret Service and IRS Criminal Investigation, naming TraderTraitor, an operation it describes as North Korean, as responsible for the October 29 theft. As reported by The Register and The Hacker News, which both read the alert, it said the actors had begun converting the stolen assets primarily into Ether. "It is expected these assets will then be further laundered by converting them using DeFi and instant swap services," the FBI said. It also published a list of wallet addresses tied to the theft and asked virtual-asset providers to block them. The alert itself could not be opened from here, so this account rests on those two reports rather than on the document.
How much left the exchange is still being counted, and the three published estimates do not agree. The FBI and Binance put it at roughly $6.3 billion. TRM Labs estimates $6.36 billion and found that most of it moved in about 20 minutes. Elliptic puts the total at about $6.43 billion and says $2.85 billion of it has been verified as frozen or seized. The funds moved across 11 blockchains, with 82% of the value on Ethereum and Bitcoin.
Elliptic's own comparison gives the sum its scale. The firm says this single incident almost doubles the total value of crypto assets stolen by the North Korean regime, which it had put at more than $6.5 billion across recent years. None of that makes the money recovered. An attribution is not a charge or a conviction, frozen assets are not returned ones, and what Binance has put back into customer balances it has bought or supplied itself.
It has not been the only exchange suspension this week. Mercado Bitcoin paused deposits and withdrawals on November 2 after what it called a security incident in one of its systems, with the blockchain security firm Hypernative tracing more than $40 million out of wallets it attributes to the Brazilian exchange. Binance, separately and on a schedule set before the attack, is still due to close Binance Pool and its cloud mining service on November 10.
