Binance began reopening withdrawals for additional tokens across Ethereum, BNB Chain, Base, Tron, Polygon and Sui on Nov 5, including UNI, AAVE, AVAX and INJ. The exchange has now replaced about 98% of the $6.34 billion in assets affected by its Oct 29 breach, up from 95% earlier in the week, and expanded its latest Proof of Reserves snapshot to 44 tokens from 10. Binance is buying the remaining 2% of less liquid tokens through market and over the counter channels while generating a new zero-knowledge proof expected to take 50 to 60 hours.
In an initial investigation report, Binance traced the heist to a months-long social engineering campaign that the FBI attributed to North Korea’s TraderTraitor group, an allegation Pyongyang denied as “absurd fabrication.” Attackers gained reconnaissance after a wallet engineer downloaded a tampered Homebrew installer in June, then infected a second engineer’s work computer in September via a malicious coding assignment during a fake job interview. On Oct 20, the hackers used that device and an internal AI tool to compromise two other wallet engineers and steal deployment credentials, which they used on Oct 29 to breach Binance’s wallet-signing service and abuse Ethereum’s EIP-7702 authorization mechanism.