Binance says it fully replaced $6.3 billion stolen in hack

Binance said Thursday, Nov. 12, that it had replaced all of the roughly $6.3 billion in cryptoassets stolen from its hot wallets on Oct. 29. That includes the less common tokens that took longer to find and buy, Bloomberg reported, citing a social-media post from the exchange. The announcement wraps up Binance's recovery from what Bloomberg called the largest cybertheft in history. US authorities and blockchain analysts have blamed North Korea for the attack.bloomberg.com

Binance also said it would publish an updated Proof of Reserves report. The report will use zero-knowledge proofs so users can check that their holdings are backed 1:1, Bloomingbit reported, citing Cointelegraph.en.bloomingbit.io

From 80% to full coverage

Binance said the hackers broke into its hot wallets at about 20:05 UTC on Oct. 29. It promised that it, not its users, would absorb the loss, using its Secure Asset Fund for Users and its corporate treasury, according to the exchange's Oct. 30 update. It said at the time that it had already covered about 80% of the losses. Withdrawals resumed in phases on Nov. 1, and customers pulled out a net $3.64 billion, or 2.1% of the exchange's assets, according to the Express Tribune.binance.com+1

By Nov. 4, Binance said it had replaced about 98% of the stolen amount. It said buying the remaining 2% would be slower because those tokens trade less often, and that its reserve snapshot now covered 44 tokens instead of 10, per Recovery Update #7. "We need some time to procure them without affecting market functioning," co-CEO Richard Teng told Fox Business. Binance also said about $2.85 billion of the stolen assets had been frozen or intercepted, according to its initial findings.binance.com+2

North Korea blamed

The FBI linked the theft to TraderTraitor, a North Korean group connected to the Lazarus Group, The Register reported. North Korea called the accusation "absurd rhetoric," the BBC reported. Binance said the hackers used a fake job interview and malware hidden in an advertisement to break into engineers' computers. They then moved 233.46 million XRP ↘ 2.44% out of five hot wallets in four minutes before taking other assets, including Bitcoin ↘ 2.73%, Reuters reported Thomson Reuters Corporation ↗ 0.59%.reuters.com+2

The stolen money is still being moved around. Blockchain analytics firm Elliptic said the hackers created six memecoins between Nov. 5 and Nov. 7 to pass off about $430,000 worth of NEAR as trading profits, according to Stox News. Analysts at TRM Labs have called the heist "cyber warfare" and warned that more North Korean attacks will follow, Bloomingbit noted.stox.news+1