Binance Has Replenished 95% of the $6.3 Billion Hack — But the Hacker Is Already Swapping $96 Million in Stolen SOL for Bitcoin

Recovery at 95%, withdrawals reopening
Binance announced on November 1 that it has replenished about 95% of the assets stolen in the October 29 breach — up from 90% reported on October 31 — and is reopening withdrawals in a phased manner, with the first stage scheduled between 06:00 and 09:00 UTC on Sunday, November 1 across fifteen networks. The exchange says it is covering all losses from a combination of its corporate treasury, a portion of its Secure Asset Fund for Users (SAFU) and its futures insurance fund, and that users will not bear the financial impact; co-CEO Richard Teng confirmed the commitment publicly. An updated proof-of-reserves snapshot shows major assets including Bitcoin, Ethereum, USDT, BNB, Solana, USDC and XRP fully backed, with a more detailed cryptographic proof of reserves scheduled for Monday, November 2. Roughly $3 billion of the stolen funds has already been frozen on-chain with the help of industry partners and law enforcement. The breach, at approximately $6.3 billion drained from hot wallets, is described as the largest crypto heist in history.

Attribution: TraderTraitor, in about 20 minutes
The FBI, with the US Secret Service and IRS-CI, formally attributed the theft on October 31 to TraderTraitor, a North Korea-aligned group also tracked as Jade Sleet, UNC4899 and Slow Pisces. Blockchain analytics firm TRM Labs had linked the operation to TraderTraitor with high confidence before the FBI announcement. Reporting puts the execution at about 20 minutes of unauthorised withdrawals across multiple blockchains, after a compromised DevOps engineer laptop led to a service container and then to the withdrawals — the same intrusion chain described in Binance's own first findings. The FBI says investigators have observed stolen assets moving mainly into Ethereum. The attribution matters beyond the headline: it turns a platform incident into a state-actor case, which is why freezing $3 billion required industry partners and law enforcement working together, and why the remaining recovery will be measured in weeks of tracing rather than days of patching.

The laundering trail is already moving — $96 million in SOL
Recovery and laundering are now racing each other in public. On November 1, Lookonchain, citing an Arkham Intelligence-labelled address belonging to the Binance attacker, reported the hacker swapping 970,522 stolen SOL, worth approximately $95.9 million, for Bitcoin through cross-chain service Relay Protocol. The first reported movement was about 486,970 SOL, valued at about $46.4 million — roughly half the reported pool — with the remaining balance valued at roughly $49.5 million at the time of the reports. Those figures describe the reported conversion pool and its initial movement, not a confirmed $95.9 million Bitcoin transfer completed in a single transaction, and using a cross-chain service does not erase transaction history or make funds untraceable. But the direction is clear: the attacker is converting chain by chain, and every conversion is a new tracing problem for exchanges and analytics firms. Earlier movements involving other stolen assets are already under law-enforcement monitoring.

The week's other security wounds
Binance was not the week's only crypto-security incident, and the others show how varied the attack surface has become. Polymarket, hit on October 29 when a hijacked third-party page-speed script sold traders' positions, said it has issued full refunds to 689 of the 726 affected wallets, with the remaining 37 being reimbursed as their claims are verified, and is paying $1.19 million to around 5,500 wallets to compensate traders who lost funds during its trading halt. Separately, Chainalysis disclosed a breach carried out with offensive agentic techniques that exposed customer names, emails, user IDs and organisational roles — while stating that investigation content, credentials and session tokens were not accessed. Three incidents in one week, three different doors: a compromised laptop, a compromised third-party script, and an AI-accelerated intrusion. No single fix closes all three, which is why the week's real lesson is defence in depth — and why users should treat every "recovery" message after any of these incidents as a potential phishing lure.

What users should do now
If you trade on Binance, use only the exchange's own announcements for withdrawal status, and expect the phased reopening rather than instant full access. If you were a Polymarket user, verify any refund through the platform itself, not through a message or link. If you hold NFTs or use marketplaces, read this cycle's Talis report alongside this one — the same week produced a custody-contract exploit in NFTs and a hot-wallet drain at the world's largest exchange. And as always after a major hack: no legitimate support team will ever ask you to connect your wallet via a direct message to claim or recover funds. Binance says a full technical post-mortem will follow once the investigation allows, without compromising recovery efforts. Until then, the honest scoreboard is 95% replenished, $3 billion frozen, and a $96 million SOL trail still moving.

FAQ
How much of the Binance hack has been replenished? About 95% as of November 1, up from 90% on October 31; Binance says it will cover the remaining 10% and users will not bear the loss.
When did withdrawals reopen? In phases from November 1, first stage 06:00–09:00 UTC across fifteen networks, subject to final security checks.
Who does the FBI blame? TraderTraitor, a North Korea-aligned group (also tracked as Jade Sleet, UNC4899, Slow Pisces); TRM Labs linked it with high confidence before the FBI announcement.
What is the hacker doing with the stolen SOL? Reportedly swapping 970,522 SOL (about $95.9 million) for Bitcoin via Relay Protocol; about 486,970 SOL (about $46.4 million) moved first.
What happened at Polymarket and Chainalysis? Polymarket refunded 689 of 726 wallets in full plus $1.19 million to about 5,500 wallets after a hijacked third-party script; Chainalysis disclosed a breach exposing customer names, emails, user IDs and roles, but not credentials or session tokens.

Read more on Zimbuck: https://zimbuck.com/pages/zimbucknews and join the discussion at https://zimbuck.com/groups/zimbuckmarketnews. Related reading on the site: the Crypto Security guide in the Crypto Security category.

This article is market news and general information only, not financial advice.