Binance says it has begun restoring withdrawals in phases after the theft of cryptoassets. Its November 1 update puts replenishment at approximately 95% of affected assets. That is a statement about replacing losses, not recovering 95% of the stolen funds from attackers.
The start of recovery was announced by an official Binance account. A detailed update describes the staged reopening of networks and assets. Availability must be checked for the specific transfer; FinFly has not conducted a test withdrawal.
Account backing and access are separate conditions
Sufficient assets behind an account balance do not by themselves execute a payment. The exchange must also accept the request safely, sign the transaction and transmit it to the relevant network. An aggregate replenishment percentage therefore does not describe the performance of every withdrawal route.
A business using cryptoassets for settlement faces another constraint: a payment obligation may fall due before its preferred route becomes available. That timing mismatch should be assessed separately from the market value of the portfolio.
What the FBI has attributed
In its October 31 statement, the FBI attributed the theft of more than $6 billion to North Korean activity it calls TraderTraitor. It reported conversion of stolen assets primarily into ETH and urged market participants to block related transactions.
This is a formal law-enforcement attribution. It does not replace a technical account of the initial intrusion or validate every breach theory circulating on social media. That distinction matters when assessing the cause of the incident.
| Question | Evidence to examine |
|---|---|
| Are balances backed? | Assets and liabilities measured at the same date |
| Can customers access funds? | Network availability and actual request execution |
| Has the cause been addressed? | Technical findings and access-control changes |
FinFly analytical framework, not the results of an independent Binance audit.
Replacing losses is not recovering stolen funds
Buying replacement tokens with company resources restores assets on the platform’s balance sheet. Tracing and recovering funds from attackers is a different process, with different timing and legal requirements. Treating the two as identical overstates what an investigation has achieved.
Similarly, freezing an address does not mean funds have been finally returned to the affected party. Discovery, restrictions on movement and restitution can involve separate technical and legal steps.
The next test is execution
After a reopening announcement, the key operational test is reliable processing, rather than simply the presence of an enabled withdrawal button. Financial assessment requires matching assets against liabilities; technical assessment requires understanding which permissions and procedures have changed.
Our earlier Binance analysis separated the financial, operational and security conditions for restoring confidence. The new update changes the information available, but does not make those tests interchangeable.
