Binance is widening access to withdrawals while the money stolen from its wallets remains a separate recovery problem. Its November 3 notice announced another progressive reopening, beginning at 04:00 UTC, with availability determined by the particular asset and network. That is an operational milestone, rather than evidence that every customer can already withdraw every balance.
The financial question has also changed. Identifying a theft establishes the initial damage. Establishing which assets have been replaced, which remain immobilized and which customers can actually move requires different evidence. Confusing those measures can make a recovery announcement look more conclusive than it is.
Three different balances sit behind the headline loss
The FBI’s October 31 alert attributes the theft of more than $6 billion around October 29 to North Korea’s TraderTraitor activity. Separately, Elliptic estimates that $6.43 billion was stolen. Those are attributed assessments with different precision, not amounts to add together. Neither figure is a current calculation of the exchange’s remaining unreimbursed exposure.
There are three relevant ledgers. The first records assets taken. The second records assets that investigators or issuers have prevented from moving. The third records the replacement assets available to satisfy customer claims. An asset can appear in the theft and freeze ledgers without yet being back under the exchange’s control.
Conversely, Binance could replenish a customer balance from its own resources before recovering the corresponding stolen token. That would improve customer backing while leaving the exchange bearing the cost. Replacement and recovery can therefore move in different directions. The distinction matters to anyone assessing the platform’s capacity to absorb a shock, rather than simply its ability to identify attacker addresses.
This distinction also prevents double counting: a replacement purchase is a use of resources to meet an obligation, while a later recovery can reduce the ultimate burden. They are not two independent thefts.
A transfer block changes who can act next
Elliptic’s methodology distinguishes stolen amounts valued at the time of theft from frozen amounts valued at current prices. Even apparently comparable dollar totals can therefore have different valuation dates. Subtracting one headline from another would produce a misleadingly precise residual unless the assets, prices and ownership status were reconciled first.
Issuer intervention also has a defined perimeter. Circle’s USDC terms describe address blocking and circumstances involving freezes or government orders. That documentation explains a control available within USDC’s system; it does not establish that every token in this incident has the same controls or that any particular frozen amount has been returned to Binance.
The analytical implication is that immobilization can preserve a potential recovery route without completing it. Someone still has to establish entitlement and execute the steps that place usable assets back with the rightful party. A visible blockchain balance is evidence about an address. It is not, by itself, evidence that a customer has received an unrestricted payment.
Replacement assets and a dated proof answer narrower questions
In its November 2 update, Binance said it had covered approximately 95% of the impacted amount, with less liquid tokens making up the remainder. It also said the proof for an October 31 reserve snapshot was ready for users of ten specified tokens to verify. These are company disclosures, rather than this article’s independent verification of customer accounts.
A snapshot is inherently dated. Its usefulness depends on the assets and obligations it covers and the question being asked. Verifying inclusion and backing within that perimeter does not establish how much stolen property investigators have recovered, nor does it measure the exchange’s entire financial condition after all costs. This is a scope distinction, not a claim that the disclosed proof is false.
Replenishment can also require execution in the market. If the obligation is denominated in a particular token, having resources elsewhere does not automatically provide that token in the required quantity. Our inference is that purchasing less liquid assets can introduce timing and execution costs. The public information does not support a quantified estimate of those costs or a conclusion about insolvency.
Reopening a withdrawal channel is a liquidity milestone
November 3’s asset-and-network rollout makes access more granular than a single open-or-closed label. Binance says restoration depends on security and readiness checks and warns that processing can take longer during the rollout. An announcement of phased availability should therefore be distinguished from confirmation that a specific withdrawal has settled.
The strongest counterargument to a pessimistic reading is straightforward: an exchange with sufficient resources can protect customers while pursuing stolen funds over a longer period. A pause and a theft do not, on their own, establish that customer losses will follow. Equally, an undertaking to absorb losses does not eliminate the need to demonstrate execution.
A reconciled account of assets replaced, assets actually recovered and remaining customer restrictions would materially narrow the uncertainty. Until then, the defensible reading is that operational access, customer backing and ultimate loss absorption are related measures of progress, each requiring its own evidence.