Binance has reopened withdrawals, says 95 percent of assets were returned, and the FBI blames North Korea

Withdrawals are back, and the final damage figure is not. On 1 November Binance opened the first phase of withdrawals on 15 networks and says 95 percent of the affected assets were returned. crypto.news reports that at 09:01 Central European time, first for bitcoin. At 10:31 USDT, USDC, ether, and BNB follow. Cointelegraph carries the same first phase at 10:38. A full proof of reserves is announced by 3 November. Kriptoteme writes that deposits worked the whole time and that Binance has not yet published a full damage estimate. The Defiant records a transfer of 7,499 bitcoin linked to the SAFU fund. The status of ADA on Binance is not available in this briefing.

On 31 October the FBI attributed the attack to the North Korean group TraderTraitor and published hundreds of addresses. CryptoSlate carries that at 13:20 on 1 November. Cointelegraph reports the same attribution at 08:44. The FBI says the stolen funds are being converted mostly into ether and calls on THORNode and RPC operators to block the published addresses. Those are attributions by those sources. This desk reports them and does not confirm them on its own. crypto.news, citing Swolecharts, holds that about $1.85 billion remains in the futures insurance fund. Binance named SAFU, the corporate treasury, and that fund as the sources of cover. At 08:04 @scottmelker reports that payouts are coming from new addresses added to the proof of reserves. The post has 84 likes and 23,252 views. @RuLooking4This2 claims that neither ADA nor NIGHT was stolen. @Varavas9 adds that public reports have not confirmed that. The claim stays unconfirmed.

What else arrived

Lookonchain, according to crypto.news, records 970,522 stolen SOL, about $95.9 million, which the attacker is swapping toward bitcoin through Relay. Earlier, more than 130 altcoins were converted into $277.26 million of ether. news.bitcoin.com, citing TRM Labs, writes that XRP was hit first: five wallets lost 233.46 million XRP, about $296 million, between 21:05 and 21:09 Central European time on 29 October. SongMarketCap carries Hoskinson's analysis of the wallet attack: EIP-7702 delegation and 50 signed authorizations. In that reading Blockaid cites about $2.5 billion from Binance wallet 14. According to that piece, the key was not stolen. An authorization was abused.

On 31 October Chainalysis was hit by a security incident. User identifiers, names, and email addresses were exposed. There is no evidence of access to investigation content or to credentials. Chainalysis says the incident is not linked to Binance. The Moscow Exchange starts trading in bitcoin, ether, and USDT on 1 December, from 06:50 to 23:50 Moscow time. Unqualified investors must pass a test and have a limit of 300,000 rubles a year per intermediary. crypto.news confirms the date via RBC. On 31 October Blockaid flagged at least 12 DeFi domains, among them Flap, Kintsu, Pickle Finance, Echelon, and FluxBeam. The Crypto Basic cites about $138,000 of damage and the registrar Name.com. This desk does not treat the ICE and Trade XYZ announcement of a move of perpetual markets into the United States as confirmed. The source is CoinMarketCap Community.

Sources: crypto.news, bitcoin withdrawals, crypto.news, the other withdrawals, Cointelegraph, phase one, Cointelegraph, FBI, CryptoSlate, FBI, crypto.news, the fund, Kriptoteme, the recovery, @scottmelker, @RuLooking4This2, @Varavas9, crypto.news, SOL, news.bitcoin.com, XRP, SongMarketCap, Hoskinson, Kriptoteme, Chainalysis, Kriptoteme, Moscow, crypto.news, Moscow, Kriptoteme, DNS, The Crypto Basic, 31 October.