Binance has fully replaced approximately $6.3 billion in assets stolen during the October 29, 2026 security breach, the exchange confirmed on November 12. The disclosure came alongside an updated Proof of Reserves snapshot that uses zero-knowledge proofs, allowing customers to independently verify that their balances are backed at least 1:1.
Binance stated that it has completed coverage of assets impacted in the security incident and has published a new Proof of Reserves snapshot. Once the zero-knowledge proof is generated, users can independently verify that their assets are backed at a minimum of 1:1.
The FBI attributed the theft to the North Korea-linked TraderTraitor group and said more than $6 billion in crypto assets were stolen. In a parallel action, the U.S. Department of Justice obtained court authorization to seize or prevent the transfer of over $1.2 billion in stolen assets. Authorities said a joint effort between U.S. agencies and the private sector has frozen more than $2.7 billion.
Blockchain analytics firm Elliptic also identified a laundering technique involving meme tokens used by North Korean hackers. Separately, U.S. authorities seized cloud infrastructure linked to the FaceStealer campaign, which used deepfake video calls and stole over $400 million in crypto assets over 18 months, targeting crypto and Web3 professionals.
The incident underscores ongoing security threats to major exchanges while highlighting coordination between law enforcement and industry players to trace and recover stolen funds.
