Binance Reserve Proof After $6.3B Hack: What It Shows

Binance says customers can now independently check whether balances in ten major cryptocurrencies were backed at least one-to-one in a new proof-of-reserves snapshot, marking a significant step in the exchange’s response to the $6.3 billion security breach disclosed last week. The result is important, but its scope is narrower than a complete solvency audit or confirmation that every withdrawal route is fully restored.

In its November 2 recovery announcement, Binance said the zero-knowledge proof had been generated for a snapshot taken at 00:00 UTC on October 31. The covered assets are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Binance says customers holding these tokens can verify that their own balances were included in reserves covering at least 100% of the corresponding customer liabilities at that point in time.

It is the exchange’s latest public recovery milestone after it disclosed that compromised hot-wallet infrastructure had allowed approximately $6.3 billion in unauthorized withdrawals on October 29. Binance has said it will bear the losses using company resources, rather than charge customers. That pledge, its reported asset replacement figures and the cryptographic reserve snapshot are related but separate claims.

Ten tokens covered, more assets still outstanding

Binance says it has replenished approximately 95% of the affected assets, with the balance concentrated in smaller and less liquid tokens outside the ten-asset proof. The 95% figure is the company’s estimate of replenishment progress; it should not be confused with a claim that 95% of stolen funds have been independently recovered from the attacker.

The distinction is consequential. Replacing a missing cryptocurrency from corporate funds may restore backing for customer balances without recovering the specific coins taken in a breach. Binance has separately said it is working with law enforcement and on-chain partners to trace stolen funds. Its earlier incident update said approximately $3 billion had been frozen on-chain, but freezing assets is not necessarily the same as recovering and returning them.

For its next phase, Binance plans a fresh proof-of-reserves snapshot on November 4 with broader token coverage. The exchange expects generating the resulting zero-knowledge proof to take roughly 40–50 hours. As of the November 2 announcement, that next snapshot was a plan, not a completed verification.

Withdrawal access is also returning in stages. In its November 1 update, Binance announced phased resumption after security checks. Whether a particular asset can be withdrawn depends on the token and supported network, so a general announcement about reopened withdrawals should not be read as a guarantee that every route is available.

What customers can verify—and what they still cannot

A proof of reserves typically combines a snapshot of customer balances with evidence of assets the exchange controls. Binance says its approach uses a Merkle tree and a zero-knowledge proof, permitting an account holder to check inclusion without publicly disclosing personal balances. The company has published instructions and a verification tool for customers who want to perform the check themselves.

However, a cryptographically valid reserve statement about named tokens at a named time does not by itself establish the exchange’s entire financial position. It cannot prove that no other debts exist, explain every off-chain obligation, or guarantee liquidity during a sudden surge in withdrawals. Those are among the reasons proof of reserves should not be mistaken for proof of solvency.

Binance’s preliminary account of the intrusion pointed to a compromised employee laptop and unauthorized access to a service container; the company said it had found no evidence of leaked wallet private keys. That remains a preliminary explanation. A complete technical post-mortem has been promised but has not been published in these recovery notices, leaving the full failure chain open to scrutiny.

For customers, the useful questions now are concrete: Does the published proof include their balance at the snapshot time? Is withdrawal enabled for the asset and network they use? And what independent evidence emerges as the exchange publishes further reports? The November 2 proof answers the first question for ten named assets. It is progress, not a substitute for the others.

How do you rate this article?