The FBI made a consequential move on Saturday: it formally attributed the theft of more than $6 billion in virtual assets from Binance, around October 29, to North Korea. At the same time, Binance said it had “reconstituted” about 90% of the stolen assets. Our judgment is that the recovery claim is encouraging, but it is not yet evidence that customer risk has been eliminated.
The reported facts change the nature of the story. This is no longer only an exceptionally large attack on a crypto exchange. The FBI describes it as an operation attributable to North Korea through TraderTraitor, a group reported to be connected to Lazarus. The agency published roughly 500 Ethereum addresses it says are being used to launder the assets and asked crypto platforms, DeFi services and blockchain-analysis companies to block associated transactions.
That attribution has a practical consequence. If funds are being moved through conversions and services without traditional intermediaries, rapid action across the crypto ecosystem matters more than broad assurances about security. Binance suspended withdrawals after the theft and said it was on track to reopen them on Sunday, November 1. It says it will absorb the financial impact and that customers will not bear losses. Those are company commitments, not independent confirmation that every balance is accessible again or that the assets are permanently secure.
The strongest counterargument is the 90% figure itself: if Binance has recovered or covered most assets, the immediate effect on customers may be contained. But “reconstituted” does not explain, in the available reporting, how much represents blockchain recovery and how much represents assets bought by the company. The materials also do not provide the FBI’s full technical evidence, final customer-return figures or a response from Pyongyang. President Donald Trump has also said he was not certain North Korea was responsible.
The concrete next test is whether withdrawals actually resume and whether Binance explains what its 90% figure means in terms of money and customer access.
Sources
Independent editorial content. WUA is not affiliated with any political party. 2026-11-01
Binance's $6.3bn breach shows compensation cannot fix centralised custody risk