Binance Completes Proof of Reserves After $6.3 Billion Hack as Withdrawals Resume
Key Takeaways
- •The October 31 reserves snapshot, anchored to Bitcoin block 973895 and verified with Merkle tree and zk-SNARKs technology, shows all ten listed tokens backed at or above 100%, including 100.04% for Bitcoin and 106.08% for USDC.
- •Withdrawals after reopening on November 1 totaled roughly $7.4 billion gross, and with $2.7 billion flowing back in, net outflows reached $4.72 billion, about 3% of platform assets.
- •Binance reports that around 95% of the assets affected by the hack have been replaced using company funds, with the remaining less liquid tokens still being sourced, according to founder Changpeng Zhao.
- •The FBI determined the North Korean TraderTraitor group carried out the October 29 breach, and Elliptic tracking shows $2.85 billion of stolen funds frozen or seized while $3.24 billion remains in the involved addresses.
- •Experts and regulators caution that proof of reserves is not equivalent to a solvency audit, and Binance plans a new snapshot on November 4 to extend coverage beyond the ten verified tokens.

Binance has released fresh statistics backing its commitment to protecting customers after a hack that cost $6.3 billion, completing a cryptographic verification of its reserves snapshot as of October 31, according to an official announcement. The verification confirms that at least ten major tokens are backed one-to-one, and the exchange's 335 million users can check the results themselves — even though this is no solvency audit.
What the latest proof shows
Binance issued its most recent reserves snapshot at 00:00 UTC on October 31, citing Bitcoin block 973895 as the benchmark, an anchor that lets outside observers verify exactly when the data was captured. The proof uses Merkle tree and zk-SNARKs technologies — cryptographic tools that allow users to confirm the presence of their balances without handing over account-specific details.
Reserve ratios stood at 100.04% for Bitcoin, 100% for Ether and USDT, 106.08% for USDC, 100.99% for XRP, and 101.30% for BNB — a reading at or above 100% means the exchange holds at least as much of each asset as customers have on deposit. All ten tokens listed can be considered fully backed, a status that does not yet apply to the platform's other assets. To address that, Binance plans a new snapshot on November 4, which will probably require an additional 40-50 hours to generate.
$4.72 billion out, $2.7 billion back in
Customers moved quickly when withdrawals reopened on November 1. Binance processed about $7.4 billion in gross withdrawals, the Wall Street Journal reported, citing a company spokesperson. With $2.7 billion flowing back in, net outflows came to $4.72 billion — roughly 3% of platform assets. Most withdrawals were in USDT.
Other exchanges gained deposits, though the origins of those funds are unclear. Binance has handled outflows of similar scale before: it saw about $6 billion in net outflows over 72 hours after FTX collapsed in 2022.
Crypto prices are showing signs of stabilizing. Bitcoin recovered above $77,000 by Monday after hitting a six-week low, while Ether rebounded from a two-month low. Bitwise researchers André Dragosch and Luke Deans summed up the market's response: "Market reaction was sharp but orderly."
Replaced funds versus frozen funds
According to Binance, approximately 95% of the impacted assets have been replaced using the company's funds. The remaining tokens are less liquid, which is why sourcing them is taking considerable time. Binance founder Changpeng "CZ" Zhao addressed the progress on X on November 2:
Binance has allocated 100% of the funds, it's just 5% remaining to convert to some of the small coins taking time. — CZ 🔶 BNB (@cz_binance) November 2, 2026
Recovering the stolen cryptocurrencies is another story. Elliptic researcher Dr. Tom Robinson revealed that frozen or seized cryptocurrencies have reached $2.85 billion, with $3.24 billion still sitting in the addresses involved in the theft. None of these funds have been converted into fiat currency. Elliptic tracked about 12,000 wallets and over 40,000 operations across 11 blockchains. The FBI has also determined that the North Korean TraderTraitor group was responsible for the breach, which took place on October 29.
Why a reserves snapshot is not an audit
Proof of reserves offers a snapshot of an exchange's holdings, but it cannot guarantee future solvency or security. A 2025 IEEE Access study highlights a theoretical weakness: exchanges could manipulate snapshots to understate their liabilities. The PCAOB likewise cautions that these reports are not equivalent to audits.
Those limitations matter even more after a major security breach. As TRM Labs policy chief Ari Redbord told Reuters: "A hack at a crypto exchange is bank robbery at the speed of the internet."
The scale of Binance's attack adds to those concerns. Bitwise compared the $6.3 billion theft with Bybit's $1.5 billion hack in 2025. The incident has also revived questions about where investors should keep their crypto: as Cryptopolitan reported, experts are weighing the relative safety of ETFs, self-custody, and decentralized platforms.
Phased withdrawals and a scam warning
Binance resumed selected crypto withdrawals on Sunday, followed by US-dollar cash withdrawals on Monday. More networks will reopen in stages.
But the reopening has also given scammers an opportunity. Binance warned on X about impostors targeting users through emails, direct messages, group chats, and even small transfers, urging customers to rely only on official channels.
Attention now turns to the November 4 reserves snapshot, wider withdrawal access, and efforts to recover more of the stolen funds.