MakeBoxExplore tools The Binance hack.
Follow the facts.
Not the panic.
The FBI attributes a multibillion-dollar theft to North Korea. Withdrawals are reopening. Here is what the numbers tell us—and what they cannot.
Unpack the numbersThe incident. The money flows. The recovery claims.
Binance · October 30
November 1 · 06:00–15:30 UTC
Two different measures. Not a combined loss.
A theft.
A reopening.
A test of trust.
The FBI’s October 31 alert attributes the theft of more than $6 billion from Binance, on or about October 29, to North Korean cyber activity it calls TraderTraitor.
Binance’s initial statement estimates the impact at about $6.3 billion. Its preliminary account points to a compromised engineer’s laptop and unauthorized withdrawals through a service container. That is an initial explanation, not a completed forensic report.
Now the story has entered a second phase: access to funds. CNBC reports that withdrawals resumed in stages, followed by a substantial net outflow. The theft and that later movement of customer funds are separate events. Reading them as one number would misstate the situation.
This is an evolving story. The figures below are dated snapshots, not a live view of Binance balances or an assessment of any individual account.
Three different questions.
SCROLL TO EXPLORE · SWIPE ON MOBILE
What was
taken?
The estimated impact describes the security incident. It is not a measure of later withdrawals.
What moved
after reopening?
Withdrawals minus deposits gives net outflow over a defined time window.
What has been
verified?
Keep company statements, law-enforcement attribution and independent verification distinct.
Source.
Date.
Editorial explanation · illustrative motion, not live activity. The sourced figures below remain unchanged.
Same dollar sign.
Different meanings.
Choose a measure. The graphic changes its explanation, source and time window with the number. None of these totals is a forecast.
Watch the relationship, not a price ticker
Looping editorial illustration. Not transaction data, market prices or a reconstruction of the attack.
Binance’s own figures, November 1, 06:00–15:30 UTC. The reported net figure rounds to $3.64B. This is a flow calculation, not an additional theft.
From incident
to phased access.
Dates and sources matter. A later company update can supersede an earlier statement without proving that every remaining issue has been resolved.
Binance’s November 1 recovery update says approximately 95% of the impacted amount had been covered and that less-liquid tokens accounted for the remainder. It also promises to absorb the financial impact rather than pass it to users. These are company statements; they are not an independent audit by MakeBox.
“Covered,” “frozen” and “recovered” should not be used interchangeably. Replacing assets with company resources is different from retrieving the exact assets stolen. An announcement that some assets are frozen does not, by itself, establish their final return.
Keep the claim
attached to its source.
Attribution, operating status and financial capacity are different questions. The evidence for one should not silently become proof of the others.
Swipe the table to see all columns.
| Claim | Source and status | Limit of the claim |
|---|---|---|
| North Korean responsibility | FBI alert · Oct 31 | Law-enforcement attribution; not MakeBox’s own investigation. |
| Approximately $6.3B impacted | Binance · Oct 30 | Exchange estimate; retain the approximation. |
| Approximately $3.64B net outflow | Binance · Nov 1 | Defined 9.5-hour window; not a full-day total. |
| Approximately 95% covered | Recovery update #4 | Replenishment claim, not 95% recovered from attackers. |
| Withdrawals restored in stages | Binance · Nov 1 | Initial phase completed; remaining networks still being tested in that update. |
| AI caused this attack | Not established by the primary sources reviewed | Commentary about future AI threats is not evidence of this incident’s mechanism. |
There is another denominator trap. A percentage of assets is not a percentage of users. The exchange’s 2.1% comparison cannot establish that 97.9% of customers stayed, approved of the response or faced no disruption. One customer can move a large amount; many customers can move small amounts.
Nor should an asset snapshot taken before the breach be presented as a fresh post-incident balance sheet. Dates, coverage and independent assurance are part of the evidence—not footnotes to discard.
Good incident reporting
reduces confusion.
Separate the ledgers.
Keep incident impact, customer flows and remediation progress distinct. A dashboard becomes misleading when unrelated measures share one dramatic total.
Timestamp every state.
“Restored” needs a scope: which service, asset or network, and at what time? A status label is useful only when a reader understands what it covers.
Show what is unresolved.
A clear report can contain both verified facts and open questions. Confidence comes from traceable evidence, not from removing uncertainty from the wording.
For anyone building business software or AI workflows, this is also a communication lesson. An automated summary should retain the source, measurement window and qualification attached to each claim. It should distinguish a company’s assurance from independent verification. Those habits make a useful system even when the news is changing quickly.
Our conclusion is deliberately narrower than a market prediction: the incident’s scale, the later outflow and the recovery process need separate scrutiny. This article does not recommend buying, selling or moving funds.
Better systems start with clearer thinking.
Explore practical AI learning at MakeBox School. This article is an independent news analysis, not a cryptocurrency service or security certification.
Before you share the headline.
Can we add $6.3B and $3.64B?
No. One describes the estimated incident impact; the other is the net of withdrawals and deposits over a later window. Adding them would create a misleading “total loss.”
Does 95% covered mean the stolen funds were recovered?
No. Replenishing affected assets and recovering stolen assets are different processes. The cited update uses company resources as part of replenishment.
Why does the CNBC URL say November 2?
The page displays November 1, 2026 at 7:11 PM EST. We use the visible publication timestamp, not the calendar date in its URL, and keep the flow window in UTC.
Sources & reading
- FBI cyber alert — attribution; October 31.
- Binance initial incident update — preliminary account; October 30.
- Binance recovery update #4 — company recovery claims; November 1.
- Binance withdrawal and deposit statement — original flow figures and window; November 1.
- CNBC: outflows after withdrawals resume — reviewed in the browser.
- Fox Business: FBI attribution — reviewed; AI-risk commentary is not treated as a finding about this hack.
- WSJ: behind the scenes of the cyber heist — further reading supplied by the reader. Full article was not available in this review; no exclusive claims taken from it.
Prepared November 1, 2026, America/New_York. Sources checked for this edition; not a live tracker. Original MakeBox analysis, charts and explanations. No independent financial audit or forensic investigation claimed. Published November 1, 2026.