Binance Says $6.3B October Hack Is Covered; Proof Pending

Binance said on Nov. 12 that it had fully covered customer assets affected by a $6.3 billion security incident on Oct. 29. The zero-knowledge proof needed to verify its latest reserves had not yet been generated, although the underlying Proof of Reserves snapshot was public.

Completion of replacement funding does not yet amount to a completed cryptographic verification. Binance said customers could independently verify backing of at least 1:1 once the proof was produced. The announcement gave no completion time or asset-by-asset breakdown of the final purchases.

“Binance has completed coverage of assets impacted in the security incident,” the exchange wrote, thanking customers for their patience. The statement did not say that attackers had returned all stolen cryptocurrency.

The three funding sources

In an Oct. 31 recovery update, Binance identified three sources for the replacement funding:

• Secure Asset Fund for Users, or SAFU
• Futures Insurance Funds
• Corporate treasury

Binance had set aside more than $6.34 billion in company funds, and replacement coverage had reached 90% by Oct. 31.

By Nov. 4, Binance said replacement coverage had reached approximately 98%. Purchases continued through market and over-the-counter channels. The company said some tokens took longer to source because liquidity was limited, describing the work as buying replacement assets from Binance’s resources.

Binance characterized its futures insurance reserves as company funds, separate from customer assets. It said the transferred balances exceeded the level required under its risk framework, while the remaining funds continued to meet that requirement.

For SAFU, Binance committed to restoring the emergency reserve to approximately $1 billion. The Nov. 12 announcement gave no final allocation among the three sources and did not confirm completion of that separate replenishment commitment.

What does this change for customers?

Practically, the pending proof leaves customers with Binance’s published snapshot, not the announced route to test the 1:1 claim cryptographically. Once generated, the proof should let account holders confirm that their balances are included in aggregate totals without exposing individual holdings. No deadline means no date on which customers can complete that independent check.

How the verification works

Binance completed an earlier verification round on Nov. 2 for a snapshot taken at 00:00 UTC on Oct. 31. That round covered ten cryptocurrencies, including Bitcoin, Ethereum, USDT, BNB, Solana and XRP. A subsequent snapshot, taken at 00:00 UTC on Nov. 4, expanded coverage to 44 tokens. Binance estimated 50–60 hours to generate the accompanying proof, citing the computing workload.

On its reserves page, Binance says a Merkle tree lets customers check whether their balances appear in the reported account totals. Its zero-knowledge system checks the balance calculations without publicly revealing individual users’ holdings.

Customers can find their record ID and Merkle leaf through the verification section of their accounts. Selecting a verification date displays the assets covered and account balances recorded at that snapshot.

The published methodology lists wallet ownership checks and a snapshot of customer balances among the verification steps. Within the zero-knowledge circuit, each account’s total net balance must be nonnegative and contribute to the claimed aggregate. The Merkle root changes if an account ID or balance changes in the underlying data.

What the balances and withdrawals show

Binance’s earlier disclosures and withdrawal figures cover different dates and types of exchange activity, rather than measuring the incident’s full effect. Reported user USDT holdings fell 7.95% between Oct. 1 and Oct. 31 to 29.48 billion tokens. Ethereum holdings dropped 3.80% to 3.65 million ETH, while Bitcoin balances rose 0.52% to 692,187 BTC.

USDT’s reported reserve coverage moved from 103.88% to 100%, while Bitcoin’s stood at 100.04%. The figures predate the Nov. 1 reopening of withdrawals and do not measure departures after customers regained access.

During the first nine-and-a-half hours of reopening, Binance reported $4.649 billion in withdrawals against $1.01 billion in deposits. That produced roughly $3.64 billion in net outflows.

Separately, Santiment’s Nov. 6 research recorded approximately 28,316 BTC leaving Binance-associated wallets on a net basis from the attack through Nov. 5. Santiment said the exchange-wide Bitcoin balance decline began before the hack, so the entire movement could not be attributed to the incident.

Why a reserve proof is not an audit

In the United States, the Public Company Accounting Oversight Board’s Office of the Investor Advocate distinguished Proof of Reserves reports from financial statement audits in a March 2023 advisory. Such reports describe assets at a particular time and may not establish liabilities, borrowing arrangements or customers’ legal rights.

They provide no assurance about internal controls or governance and cannot establish whether assets remain available after the snapshot. The office said Proof of Reserves engagements fall outside PCAOB inspection and auditing standards, even when the service provider is a registered accounting firm.

The next operational checkpoint is publication of the zero-knowledge proof; Binance has set no deadline, leaving the promised independent 1:1 verification window open-ended.