The massive $6.3 billion cyberattack against Binance, officially attributed by the FBI to the North Korean hacking group known as "TraderTraitor" (linked to Lazarus Group), entered a key stabilization phase this Monday, November 2, 2026. After temporarily suspending operations last Thursday, October 29, the world’s largest cryptocurrency exchange has managed to restore market confidence by guaranteeing and replenishing almost all of the affected funds.

Below are the latest findings, the status of the funds, and the global impact of this historic cyberattack.

Anatomy of the attack: Artificial intelligence and surgical precision

According to reports published by blockchain intelligence firms TRM Labs and Elliptic, the attack was carried out with unprecedented speed and technical sophistication:

Modus Operandi: Investigators say the North Korean unit used artificial intelligence tools as part of a “big game hunting” strategy to identify vulnerabilities. They initially managed to compromise the laptop of a DevOps engineer at the company.

Access breach: Using the EIP-7702 technical standard, the attackers obtained signing authorization that allowed them to bypass standard security checks and drain the platform’s hot wallets.

Binance’s current status and users’ fund withdrawals

Following the announcement of a phased reopening of withdrawal services, which began on Sunday, November 1, the financial situation of the crypto giant is showing signs of resilience:

• Asset replenishment: Binance confirmed that it has already replenished 95% of the affected assets using its own corporate funds and the Secure Asset Fund for Users (SAFU). The remaining 5% consists of low-liquidity tokens that the company is still acquiring to cover all losses without affecting customers’ balances.

• Controlled capital outflow: The platform’s customers withdrew a net amount of between $3.6 billion and $4.72 billion after services resumed. Despite the impressive figure, this volume represents just 2% of Binance’s total assets under management, and the pace of outflows has already stabilized.

• Proof of reserves: The company’s co-CEO, Richard Teng, published a new “Proof of Reserves” report using zero-knowledge technology so users can independently verify that their funds are backed 1:1.

The counteroffensive: $3 billion frozen

The crypto ecosystem reacted quickly to choke off the laundering routes for the stolen money, which was being converted primarily into Ethereum (ETH):

• Stablecoin freeze: In a coordinated emergency action, Tether froze more than $1.5 billion in USDT linked to the hack. Circle, for its part, blocked more than $1.1 billion in USDC.

• Funds immobilized: Thanks to these interventions and the assistance of other token issuers, an estimated $3 billion is now completely frozen and beyond Pyongyang’s reach. The criminals still retain control of approximately $3.28 billion in crypto assets that are not centrally regulated.

Market impact and geopolitical reactions

Despite the initial panic, which drove the native BNB coin down by as much as 10% and caused significant declines in Bitcoin (BTC) and Ether (ETH) by the end of last week, the market has seen a notable recovery this Monday. Bitcoin is once again trading above $77,000, showing that Binance’s swift guarantee of reimbursement prevented a systemic collapse like FTX’s in the past.

Meanwhile, government agencies in the United States, Japan, and South Korea have reiterated their concerns, as this haul far exceeds North Korea’s legitimate annual exports. Authorities say cyber theft has become the Kim Jong-un regime’s primary source of income, enabling it to evade international sanctions and directly fund its weapons development and weapons of mass destruction programs.