North Korea has been named by the FBI. Billions in stolen tokens have been frozen, and Binance is replenishing customer assets. But the transaction records point to a more troubling question: how did the attackers get valid instructions signed?

The first visible sign of the attack came on the XRP Ledger. Between 20:05 and 20:09 UTC on October 29, five wallets attributed to Binance sent 233.46 million XRP to one address. Minutes later, funds were moving out of the exchange on other networks. At 20:20, a Bitcoin hot wallet transferred 18,270 BTC.

Those timestamps come from transaction analysis by blockchain intelligence company TRM Labs. By the time the major wave subsided, the theft would be valued at roughly $6.3 billion by Binance, making it the biggest cryptocurrency exchange theft yet documented. The FBI subsequently attributed the operation to North Korea's TraderTraitor hackers.

On Sunday, Binance began restoring withdrawals and said it had acquired enough replacement assets to cover approximately 95% of the stolen value. That is significant financial relief for customers. It does not establish that the exchange has recovered 95% of the stolen cryptocurrency—or that investigators know exactly how the attackers persuaded its systems to move it.

In fact, the company's own explanation has widened. An initial notice raised the possibility of a compromised DevOps engineer's laptop. A second October 30 update said the investigation had found additional points of breach. The exchange said it had no evidence that wallet private keys had leaked. Those statements make the mechanism of authorization, rather than the theft of a single key, the central unresolved issue.

A series of transfers, not one broken wallet

TRM traced approximately $6.36 billion across ten blockchains. Rival analytics company Elliptic, counting eleven networks and using its own valuation, put the figure at $6.43 billion. Those totals should not be forced into an artificial consensus: they reflect different asset coverage and valuation choices. Binance's reported loss is approximately $6.3 billion.

The visible sequence was unusually compressed. TRM found XRP outflows first. Solana and Optimism followed. Bitcoin moved at 20:20; around two minutes later, a wallet on Tron sent 612.7 million USDT and 46.4 million TRX to attacker-controlled addresses. Activity continued in later waves, including transfers on Avalanche and Polygon after 23:00 UTC.

The Ethereum portion tells a particularly revealing story. TRM identified a transaction containing 50 authorization signatures prepared for successive transaction counts. One matched the wallet's current count, allowing an attacker-controlled contract to be designated under Ethereum's EIP-7702 delegation feature. About three minutes later, the operator directed a sweep worth billions of dollars from the wallet. Further sweeps followed when new assets arrived.

What EIP-7702 did—and did not do — Ethereum's delegation feature lets a wallet authorize contract-based behavior. It is a legitimate capability, not evidence of a newly discovered flaw in Ethereum. In this attack, researchers observed authorizations associated with a Binance wallet being used for malicious transfers. The outstanding question is how the attacker obtained or induced those valid authorizations.

Other affected chains saw conventional signed transfers. That breadth is why both TRM and Elliptic have raised the possibility of a compromise involving the exchange's signing or transaction-approval infrastructure. Neither firm can establish the entire internal intrusion path by reading public blockchains. A blockchain records that a transaction was validly authorized at the protocol level; it cannot tell us whether a human or internal security control intended it to happen.

The FBI's attribution is firmer than the technical explanation

On October 31, the FBI identified North Korea's TraderTraitor operation as responsible for the theft. It said investigators, working with the Secret Service and IRS Criminal Investigation, were watching stolen assets being converted mainly into ether. The agency published associated addresses and asked virtual-asset services, exchanges and infrastructure operators to block related transactions.

That is a law-enforcement attribution. It is not a public forensic account of how the attackers entered Binance. TRM points to wallet preparation beginning at least 36 hours before the theft and testing carried out in advance. Those observations support the picture of a planned operation, but the exchange has not yet published an independently verifiable sequence of its internal compromise.

Three very different meanings of recovery

It is easy to read the latest figures and come away with the wrong impression. Binance says approximately $3 billion in stolen assets were frozen through cooperation with issuers and other industry participants. Elliptic independently identified about $2.85 billion frozen or seized on-chain as of its November 1 update. Freezing limits an attacker's ability to transfer specific assets. It does not, by itself, put those assets back into the exchange's wallets.

Most of the freezeable assets are issuer-controlled tokens, including certain stablecoins. Ether and bitcoin do not have a central issuer able to blacklist a wallet. That distinction has shaped the aftermath: Elliptic documented attackers converting and moving other holdings, including a steady stream of transfers on Tron that its researchers believe were automated. The faster funds reach assets or services that cannot be frozen, the harder recovery becomes.

The 95% figure refers to replenishment. Binance said it was using its Secure Asset Fund for Users and company resources to acquire replacement tokens, with the less-liquid remainder still being sourced. It says major balances—including BTC, ETH, USDT and USDC—are fully backed and that users will not bear the theft's financial cost. Those remain company representations; the ongoing withdrawal restart and final accounting are separate tests of the promise.

Withdrawals, paused while Binance contained the incident and checked its systems, began reopening in phases on November 1. Not every network and asset pair became available at once. That operational reality matters more to a customer trying to access funds than the headline percentage alone.

The missing account is about authority

There are three questions a credible post-incident report must resolve. First, how were the Ethereum authorizations produced or obtained? Second, what explains similarly timed, valid transactions on separate blockchains? Third, which internal control was meant to stop the transfers, and why did it not?

The distinction is crucial because the public evidence does not show that the mathematics protecting cryptocurrency was defeated. It suggests that the systems surrounding the mathematics—people, developer machines, services that prepare transactions and controls that approve signatures—may have been made to act for the attacker.

Binance has promised a technical report after its investigation. Until that appears, the exchange can document how quickly it replaces money and how many assets have been frozen. What it cannot yet demonstrate publicly is the one assurance customers and other exchanges most need: that the process which gave an attacker authority to move billions has been understood and closed.

References and reporting notes

This is independently written analysis of first-party incident disclosures and public transaction research. Tech Little Brawta has not claimed exclusive interviews or its own on-chain forensic examination. Financial figures are attributed and time-bound.