For the full technical walkthrough, see “$6.3B Stolen: Binance Hot Wallet Hijacked via EIP-7702 Delegation, Flagged by Blockaid in Two Minutes”. This article covers only what has changed by November 1.

Binance Replaces 90% of the Stolen Assets, Withdrawals Return Today, FBI Points at North Korea: the Case as of November 1

Roughly $6.3 billion left Binance’s hot wallet on October 29 — the second-largest single-loss breach in crypto history. Three days later, on October 31, Reuters, the FBI and Binance’s own press team all broke news within a few hours of one another, and the mood turned on a dime. What follows is only the new material from October 31 and November 1.

Binance has plugged 90% of the gap, and withdrawals reopen November 1

A Reuters exclusive on October 31 put the covered share at 90%, funded with company money and the SAFU reserve. CEO Richard Teng filled in the rest at an internal all-hands: the outstanding 10% is mostly long-tail tokens with thin on-chain liquidity, which Binance intends to buy back through OTC desks and then reconcile against the books. Talks with several market makers are already under way.

That same report cited two people familiar with the matter saying Binance has set itself an internal deadline of “full withdrawal resumption this Sunday, November 1.” Technical teams are auditing every hot-wallet node and running staged canary checks as we speak — standard practice after an incident of this size, and the only way to be sure nothing was left behind.

On proof of reserves, Binance took a new Merkle tree snapshot at 00:00 UTC on October 31, with the complete PoR report due out on November 2. It is the first time the exchange has pulled its PoR schedule forward after a hack — an obvious answer to the market’s demand for transparency.

CZ, Binance’s co-founder, joined current CEO Richard Teng for a statement on the evening of October 31: “We fully cover all losses. Every user, every asset.” It was CZ’s first public comment on a single security incident since he stepped down.

The FBI names North Korea’s Trader Traitor — the crew behind Bybit’s $1.5B loss in 2025

This was the heaviest item of October 31. The FBI’s cyber division issued a formal attribution pinning the Binance breach on North Korea’s “Trader Traitor” group, and confirmed that the same actors carried out the $1.5 billion Bybit theft in February 2025.

The bureau laid out three pieces of technical evidence:

• The EIP-7702 delegation hijack script in the attack chain shows strong code similarities with tooling recovered in the Bybit case;
• Several addresses controlled by the hackers had previously been seen pooling funds during the 2025 Bybit incident;
• The phishing lures and impersonation scripts used in the social-engineering stage match the long-established playbook of Lazarus Group.

Blockaid’s on-chain security team caught the anomalous delegation within two minutes of the first transaction and published a live tracking report.

ChainCatcher and other on-chain intelligence outfits have been following the money too. As of October 31, roughly 30% of the stolen assets had been frozen or flagged across chains by Binance; about 20% had been washed through mixers such as Tornado Cash; the rest was still moving across bridges.

Trader Traitor is hardly a new name in open-source reporting. Since 2024 the group has run targeted social-engineering campaigns against OKX, Gate and Coinbase, among others, without ever getting inside a hot wallet. Binance is their first success — and by a wide margin their biggest.

Market reaction: bitcoin climbs back to $77.5K, fear gauge retreats

In the first hours of October 29, bitcoin slid from $77,800 to $75,100 — a peak 24-hour drawdown of about 3.5%. Then came the October 31 news flow: 90% of the loss covered, a withdrawal timetable, a joint statement from CZ and Teng. Sentiment repaired fast.

By the morning of November 1 in Beijing, BTC was back above $77,500, essentially where it sat before the hack. The Fear & Greed Index moved from “fear,” at 24, on October 30 to “neutral,” at 42, on November 1.

BNB bounced harder still: it fell more than 18% to below $520 on the day of the incident, and by November 1 was trading near $595 — a 24-hour gain of over 12%.

The November 1 timeline

What regular users should actually do

Seventy-two hours in, Binance’s sequence of moves is fairly legible. For anyone with funds on the exchange:

• Wait for the green light: the official target is Sunday, November 1, but access will probably come in waves — spot first, futures and earn products later. Don’t sit there refreshing; the site notice is the source of truth;
• Start small: once channels reopen, move $50–$100 first and check that on-chain settlement and gas fees look normal;
• Do the security reset, all three parts: change your password, confirm 2FA is switched on, and regenerate every API key — including the ones you think you never used;
• Watch the PoR: after the full report lands on November 2, check your own Merkle leaf. Binance is expected to open a self-verification tool this time.

What it means for the industry

Two trends are already clear:

One, proof of reserves goes from optional to obligatory. After FTX in 2022, PoR had its moment, but most exchanges treated it as voluntary. Post-Binance, heavyweights including OKX, Gate and Coinbase have said they will move from quarterly to monthly attestations, and some are weighing weekly snapshots.

Two, audits for newer standards such as EIP-7702 become mandatory in exchange hot-wallet design. EIP-7702 only activated in March 2025, and most venues had not yet retrofitted risk controls for delegated authorization. That is industry-wide technical debt, and this incident is the bill for it.

BlokWiki will keep following the case: the PoR release, further FBI notices and progress on recovering the funds. We will update as soon as there is anything new.