Secure

Million

insurance

SAFU

Billion

Binance has fully replenished approximately $6.34 billion in cryptocurrency stolen during its October 29 security breach, while U.S. authorities have secured court authorization to seize or restrain more than $1.2 billion of the stolen assets linked to North Korean hackers.
The exchange <a href="https://www.binance.com/en/support/announcement/detail/0729ad59cde74700b4eaa96c33441e71" rel="noopener noreferrer nofollow">completed the replacement of affected assets</a> on November 12, using corporate funds, emergency reserves and insurance resources to cover customer losses. A new Proof of Reserves snapshot covering 198 cryptocurrencies has also been published, although its full cryptographic verification remains pending.
The recovery comes two weeks after <a href="https://cryptoadventure.com/binance-hack-6-3b-affected-3b-in-assets-frozen/" rel="noopener noreferrer nofollow">attackers drained approximately $6.3 billion from Binance’s hot wallets</a>, triggering emergency withdrawal restrictions and one of the largest coordinated asset-freezing operations in cryptocurrency history.
<h2 id="binance-completes-asset-replenishment-withdrawals-still-limited">Binance Completes Asset Replenishment, Withdrawals Still Limited</h2>
Binance financed the replacement of stolen assets through its Secure Asset Fund for Users (SAFU), surplus capital from its futures insurance fund and its corporate treasury.
The exchange had already replenished approximately 98% of affected assets earlier this month, with the remaining portion consisting primarily of less liquid cryptocurrencies that required additional purchases through spot markets and over-the-counter transactions.
The <a href="https://www.binance.com/en/proof-of-reserves" rel="noopener noreferrer nofollow">November 12 reserve snapshot</a> covers 198 tokens and is designed to allow customers to verify that their holdings are backed at least 1:1.
However, the complete zero-knowledge proof was not available when Binance announced the replenishment. Its generation was expected to take another 40 to 50 hours, meaning independent verification of the latest snapshot remained pending.
Binance also committed to restoring SAFU to approximately $1 billion after drawing on the emergency fund. Withdrawals continue to reopen in phases, rather than returning to full availability across every supported network.
The replacement of customer assets is separate from recovering the stolen cryptocurrency, which remains subject to ongoing blockchain tracing and law enforcement action.
<h2 id="u-s-freezes-2-7-billion-linked-to-north-korean-hackers">U.S. Freezes $2.7 Billion Linked to North Korean Hackers</h2>
The U.S. Department of Justice <a href="https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency" rel="noopener noreferrer nofollow">secured court authorization to seize or restrain more than $1.2 billion</a> in stolen Binance assets on November 12.
That amount forms part of more than $2.7 billion frozen through coordinated efforts involving federal investigators, cryptocurrency exchanges and other private-sector partners. The court orders do not establish that the funds have already been returned to Binance.
The FBI previously <a href="https://cryptoadventure.com/fbi-links-6-3b-binance-hack-to-north-koreas-tradertraitor/" rel="noopener noreferrer nofollow">attributed the attack to North Korea’s TraderTraitor operation</a>, which exploited compromised internal systems to initiate unauthorized transfers across multiple blockchains.
Binance’s preliminary investigation traced the intrusion to compromised employee devices, stolen credentials and access to its wallet-signing infrastructure. Attackers also exploited Ethereum’s EIP-7702 authorization mechanism to move funds independently of the exchange’s normal withdrawal systems.
North Korean operators have continued attempting to launder the proceeds through cryptocurrency bridges, mixers and exchanges. Earlier recovery efforts included <a href="https://cryptoadventure.com/arbitrum-secures-30m-in-binance-hack-funds-vote-pending/" rel="noopener noreferrer nofollow">Arbitrum securing approximately $30 million in stolen Binance assets</a>, subject to governance approval before any release.
<h2 id="doj-disrupts-separate-400-million-north-korean-scam">DOJ Disrupts Separate $400 Million North Korean Scam</h2>
U.S. investigators also disrupted a separate <a href="https://cryptoadventure.com/community/articles/north-korean-cyber-espionage-in-crypto/" rel="noopener noreferrer nofollow">North Korean social-engineering campaign</a> known as FaceStealer, responsible for stealing more than $400 million in cryptocurrency over the preceding 18 months.
The operation used compromised messaging accounts, fraudulent video meetings and AI-generated deepfakes to deceive cryptocurrency professionals into installing malware.
Attackers frequently impersonated trusted contacts before introducing fake technical problems during video calls, persuading victims to download malicious software that provided access to their computers and cryptocurrency holdings.
The FBI seized cloud infrastructure supporting the campaign and obtained more than 900 webcam videos of victims under a federal warrant.
Investigators are also examining attempts to compromise developers maintaining open-source software, potentially giving attackers access to widely used software repositories and their users.
The post <a href="https://cryptoadventure.com/binance-replaces-6-34b-after-hack-as-u-s-secures-1-2b/" rel="noopener noreferrer nofollow">Binance Replaces $6.34B After Hack as U.S. Secures $1.2B</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Binance Replaces $6.34B After Hack as U.S. Secures $1.2B

Table of Contents

Crypto Adventure

Other articles published on Nov 14, 2026

Join our free newsletter for daily crypto updates!