Morning Brief: Binance Closed 90% of Loss, FBI Named Pyongyang, Peg at 3.7500

Let's start with the numbers, because the story lies within them: Binance announced that it had returned 90 percent of the $6.34 billion in assets stolen in the attack that occurred on October 29 to its users. The rate announced as 80 percent on Thursday climbed ten points higher in 48 hours. The company individually listed ten assets on the compensation list: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC; it noted that the remaining 10 percent consisted of tokens outside this list with low liquidity. Withdrawal channels are planned to reopen today, Sunday, November 1.

Here's how the mechanism works: Binance says it set aside reserves from company resources to cover the loss, and used a portion of this from the user security fund (SAFU). According to a report that TASS attributed to an FBI statement, 50 percent of the fund was allocated to compensation. That is, the user wallet appears complete all at once; but behind the scenes, the exchange is paying from its balance sheet and reserves. A proof-of-reserves update was also released on the same day — the company says users can independently verify through zero-knowledge proof that their assets are covered at a 1:1 ratio. How many users will actually perform this verification in practice is another question.

The FBI attributed the attack to the North Korea-linked TraderTraitor group; the agency did not share evidence. It also included in the official statement a prediction that stolen assets would first be moved to Ethereum, then laundered through DeFi and instant swap services. The roughly $3 billion asset freeze announced by Binance on Friday — nearly half the total — represents the first concrete step in this tracking process.

Now for the irony: the sector's record theft is being substantially compensated for within 72 hours; this is a sentence that both those who say 'the infrastructure is sound' and those who say 'this is exactly why centralization exists' can use. According to a regional news outlet, the starting point of the attack was access to an engineer's laptop; from there, a 6.3 billion dollar attack surface is not ground for an infrastructure soundness argument. On the other hand, the ability of an exchange of this size to cover such a gap from its own balance sheet is not something to be dismissed lightly. The bill was charged to Binance's own capital, not to users — at least on the first reading.

The Gulf side is calm. USD/SAR at 3.7500, USD/AED at 3.6725; both pegs passed the weekend as if it were a weekday. TASI closed at 9,922 points on October 29, just a tick below the 10,000 threshold. Given that a significant portion of Saudi Arabia's crypto holdings are kept on international platforms, Binance's Monday withdrawal opening is the only operational calendar item the Gulf trader will be watching today. The proof-of-reserves may have been officially released; what matters is how fast the withdrawal queue clears.

In my morning brief last Friday, I wrote that Wall Street was grappling with the artificial intelligence bill in October; on that front, big-cap tech is being priced while on this front the bill for the centralized exchange model is being paid. Both fronts are seeking an answer to the same question: Is the soundness beneath the big number visible, or only payable?

Today's asymmetry: User wallet is full, exchange balance sheet is $6.3 billion thinner. The company picked up the bill first; how the market will price it will be shown by today's withdrawal window.