Binance says $6.3B hack losses covered, new reserve proof pending

Binance has announced that it has fully covered user assets affected by its $6.3 billion October hack and published a new Proof of Reserves snapshot, with the accompanying zero-knowledge proof still to come.

Binance said in its Nov. 12 announcement that customers would be able to independently verify backing of at least 1:1 once the proof was generated. Its message did not give a completion time for that step or an asset-by-asset breakdown of the final purchases.

“Binance has completed coverage of assets impacted in the security incident,” the exchange wrote, thanking customers for their patience.

Binance funded replacements from three company sources

In its Oct. 31 recovery update, Binance identified three funding sources: the Secure Asset Fund for Users, part of its Futures Insurance Funds and its corporate treasury. It had set aside more than $6.34 billion in company funds, with replacement coverage then reaching 90%.

The exchange described its futures insurance reserves as company funds, separate from customer assets. Its explanation said the money transferred came from balances above the level required by its risk framework, while the remaining funds continued to meet that requirement.

For SAFU, Binance committed to restoring the emergency reserve to approximately $1 billion. The Nov. 12 announcement did not provide a final allocation among the three sources or confirm completion of that separate replenishment commitment.

By Nov. 4, replacement coverage had reached approximately 98%, according to Binance. Purchases continued through market and over-the-counter channels, with the remaining tokens taking longer to source because of limited liquidity.

The company described that work as buying replacement assets from its resources. Its latest statement does not say that all cryptocurrency stolen by the attackers has been recovered.

Binance’s latest reserve proof is still pending

Binance’s earlier verification rounds followed the same sequence. As crypto.news previously reported, the exchange completed reserve verification on Nov. 2 for a snapshot taken at 00:00 UTC on Oct. 31.

That round covered ten cryptocurrencies, including Bitcoin, Ethereum, USDT, BNB, Solana and XRP. A subsequent snapshot, taken at 00:00 UTC on Nov. 4, expanded coverage to 44 tokens. Binance estimated 50–60 hours to generate its accompanying proof, citing the computing workload.

On its reserves page, Binance explains that a Merkle tree lets customers check whether their balances appear in the reported account totals. Its zero-knowledge system checks the balance calculations without publicly revealing individual users’ holdings.

Customers can find their record ID and Merkle leaf through the verification section of their accounts. Selecting a verification date displays the assets covered and the account balances recorded at that snapshot, according to the exchange’s instructions.

The published methodology lists wallet ownership checks and a snapshot of customer balances among the verification steps. Within its zero-knowledge circuit, Binance says each account’s total net balance must be nonnegative, and account balances must contribute to the claimed aggregate. The Merkle root changes if an account ID or balance changes in the underlying data.

Earlier balances show withdrawals across separate periods

The October disclosures provide a dated comparison. Binance’s reported user USDT holdings fell 7.95% between Oct. 1 and Oct. 31 to 29.48 billion tokens. Ethereum holdings dropped 3.80% to 3.65 million ETH, while Bitcoin balances rose 0.52% to 692,187 BTC.

USDT’s reported reserve coverage moved from 103.88% to 100%, and Bitcoin’s stood at 100.04%. The figures predate the reopening of withdrawals on Nov. 1 and do not measure departures after customers regained access.

During the first nine-and-a-half hours of reopening, Binance reported $4.649 billion in withdrawals against $1.01 billion in deposits, producing roughly $3.64 billion in net outflows.

Separately, Santiment’s Nov. 6 research recorded approximately 28,316 BTC leaving Binance-associated wallets on a net basis from the attack through Nov. 5. Its exchange-wide Bitcoin balance decline began before the hack, so the firm cautioned against attributing the entire movement to the incident.

Reserve proofs have a narrower scope than audits

In the United States, the PCAOB’s Office of the Investor Advocate has distinguished PoR reports from financial statement audits. Its March 2023 advisory says such reports describe assets at a particular time and may not establish liabilities, borrowing arrangements, or customers’ legal rights.

The advisory says reserve reports provide no assurance about internal controls or governance, and cannot establish whether assets remain available after the snapshot.

The office states that PoR engagements fall outside PCAOB inspection and auditing standards, including when the service provider is a registered accounting firm.