SINGAPORE, November 2, 2026 — Binance says customers can now independently verify a new proof-of-reserves snapshot covering ten major cryptocurrencies, as the exchange continues responding to a theft estimated at about $6.3 billion. The company says it has covered roughly 95% of the affected amount with replacement assets and reserves, while the remaining shortfall involves tokens outside the ten included in the latest snapshot that are less liquid and may take longer to source.

The update is a new step in Binance’s response to the October 29 breach, when attackers made unauthorised withdrawals from the exchange’s hot-wallet infrastructure. The FBI has attributed the theft to TraderTraitor, a North Korean state-linked cyber operation, and said investigators observed the stolen assets being converted primarily into ether. Binance has said it will bear the financial impact rather than pass the loss to customers, but the latest recovery figures are the company’s own disclosures and do not mean that all stolen tokens have been traced or recovered from the attackers.

Binance’s latest announcement says the proof-of-reserves snapshot is now fully verifiable after the company generated a zero-knowledge proof. The snapshot is based on balances recorded at 00:00 UTC on October 31 and covers ten assets: bitcoin, ether, USDT, BNB, solana, USDC, XRP, USD1, RLUSD and Zcash. Binance says customer balances in those assets are backed at a minimum one-to-one ratio in the snapshot. That statement describes the assets and balances included in the published verification; it should not be read as a guarantee about every token, every liability or every future market movement.

Also read: Binance Says $6.3 Billion Affected in Security Incident

The exchange said the remaining 5% of the affected amount consists of tokens outside the top ten in the snapshot. It described those assets as less liquid and said it was continuing to acquire them through market and over-the-counter channels. The company has previously said it set aside more than $6.34 billion in company funds, including the Secure Asset Fund for Users, its corporate treasury and other reserves, to cover the impact. Those are Binance’s stated arrangements, and the final amount and composition of the replacement assets will need to be checked against subsequent disclosures.

Binance began restoring withdrawals in stages after temporarily suspending services while it secured affected systems and checked the integrity of the platform. The company said the next phase of withdrawals is planned for Tuesday, November 3, with details to follow. A phased restart allows the exchange to test individual networks and assets rather than reopen every route at once, but it can also mean customers holding some tokens or using particular networks must wait longer.

Reuters reported on Monday that Binance had experienced net customer outflows of about $4.72 billion after the platform reopened. The company said withdrawals had stabilised after an initial surge and that about $2.7 billion had flowed back in since Sunday. These figures cover different reporting windows and should not be added together. They show that customers were moving substantial sums after the breach while some deposits returned, but they do not by themselves establish whether the exchange is facing a lasting liquidity problem.

The scale of the outflows is important because confidence is a central part of how a cryptocurrency exchange operates. Customers generally rely on the platform to safeguard assets, process withdrawals and maintain accurate records of account balances. When a major breach occurs, some users will withdraw funds as a precaution even if the exchange promises to reimburse them. That behaviour can create a sharp rise in transaction demand and make the speed and reliability of withdrawals a test of the company’s response.

A proof-of-reserves report can help customers check whether specified assets held by the exchange match the balances attributed to customers. A cryptographic proof can provide stronger evidence than a simple public statement because it allows verification of defined data without exposing every account detail. However, a snapshot is limited by what it includes, the time it records and the liabilities it measures. It does not automatically show the exchange’s full financial condition, prove that every asset is free of encumbrances or eliminate the risk of another security incident.

That distinction is particularly relevant in this case. Binance says the ten listed assets are fully backed, while separately acknowledging that about 5% of the affected amount remains to be covered through purchases of other tokens. The company’s statement therefore describes progress toward replacing the stolen assets, not the recovery of 95% of the stolen coins from the attackers. Some funds have been frozen through cooperation with issuers and other industry partners, but recovery, replacement and customer-balance backing are different measures.

The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. It refers to the activity as TraderTraitor and said investigators had observed the actors converting the stolen assets primarily into ether, with further laundering expected through decentralised finance services and instant-swap platforms. That is the FBI’s attribution and assessment. The full technical investigation and the exchange’s own post-incident review remain separate processes.

Binance’s earlier updates said its investigation found no evidence that wallet private keys had been leaked, while describing the incident as more complex than a single unauthorised action. The company said it had contained compromised infrastructure, revoked affected authorisations and added controls. It has not yet published a complete technical post-mortem explaining the full attack path, the exact vulnerabilities exploited or the changes that have been independently tested.

The difference between an exchange’s operational controls and its public reserves is important. Proof-of-reserves data can help demonstrate that specified customer balances are backed at a given time, but it does not establish how an attacker entered the system or whether every relevant permission and software component is now secure. Those questions require technical evidence, independent review and information about the controls that were changed after the breach.

Customers also face a separate risk from scams that exploit the incident. Binance and its founder have warned users about fake screenshots, fraudulent compensation claims and messages that purport to offer help recovering stolen funds. A user should not share seed phrases, private keys, authentication codes or remote-access credentials with someone claiming to be a recovery agent. A message that uses the hack as a reason to ask for additional payments or urgent account verification should be treated cautiously and checked through the exchange’s established support channels.

For customers whose assets are not yet available for withdrawal, the practical questions are which networks have been restored, whether deposits and withdrawals are both enabled, and whether the exchange has announced a timetable for the remaining assets. A balance shown in an account is not the same as a completed withdrawal, and availability can vary by token and blockchain. Users should rely on the exchange’s current status notices rather than social-media screenshots or unverified claims about individual accounts.

The incident has also drawn attention to how cryptocurrency exchanges manage assets across multiple blockchains. Hot wallets are connected to systems that facilitate transactions and are therefore exposed to a different risk profile from assets held offline. Exchanges need to balance security with the ability to process customer activity, monitor transactions, enforce access controls and respond quickly when suspicious behaviour is detected. No single control removes every risk, particularly where complex internal systems and third-party services are involved.

Proof-of-reserves systems have their own limits. A snapshot can show that assets were present at a defined moment, but it cannot substitute for a full audit of liabilities, internal controls, governance and the processes used to safeguard customer assets. Customers may also hold tokens that are not included in a particular snapshot, or use networks that are temporarily unavailable during a security review. The latest publication is therefore one element of Binance’s recovery process rather than a final resolution of every concern.

The market reaction will depend on more than the percentage of the loss that Binance says it has covered. Customers and counterparties will look for consistent withdrawals, transparent reporting, a credible explanation of the breach and evidence that the safeguards put in place are working. Regulators may also assess how the incident was handled and whether the company’s controls and disclosures meet relevant requirements. No final regulatory findings were included in the updates reviewed for this report.

The exchange’s next milestones are the planned withdrawal phase on November 3, the release of any further proof-of-reserves data, completion of the remaining replacement purchases and publication of a detailed incident review. Each milestone should be judged on what it actually verifies: a restored network, a completed cryptographic proof, a reconciled balance or an independently tested security control. Progress on one does not automatically prove that all other issues have been resolved.

For now, Binance says the affected balances are largely covered and that users can verify the backing of ten listed assets through the new proof. The FBI has attributed the theft to TraderTraitor, while the exchange continues to restore services and replace the remaining less-liquid tokens. The recovery is under way, but the full technical explanation, the final replacement figures and the outcome of any regulatory review remain open questions.