Binance has switched on user-side verification for its proof of reserves after a hack it said involved about $6.3 billion. If you hold any of 10 major tokens on the exchange, you can now check whether your assets on Binance still had at least 1:1 backing.
At 8:45 p.m. Taipei time on Nov. 2, the exchange said the full zero-knowledge proof for the Oct. 31 proof-of-reserves snapshot had been produced within the timeframe it had originally expected. Binance also repeated what it said earlier: "Binance will absorb the financial impact caused by the stolen funds, not our users." And it said the finished proof makes the replenished part of that promise publicly verifiable.
Ten tokens included in the current proof
This round covers BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The account snapshot was taken at 8:00 a.m. Taipei time on Oct. 31, which is 00:00 UTC on Oct. 31. In its third incident update, Binance said these 10 assets had been fully replenished using its own funds and were backed 100%.
Binance said its proof-of-reserves setup works in two layers. First, a Merkle Tree lets each user verify that their account balances were included in the snapshot. Then a zk-SNARK proof shows aggregate reserves were at least 1:1, without exposing any individual user's balance.
Under Binance's normal schedule, proof-of-reserves snapshots are taken on the first day of each month and published before the seventh day. The Oct. 31 snapshot was an extra one, outside that routine. Binance also said the report shows only the asset picture at the moment of the snapshot. It is not a real-time balance report, so it may not line up with a user's current holdings.
Hacked hot wallet had appeared in the Oct. 1 reserve report
The hacked wallet, identified as hot wallet No. 14, had appeared in Binance's Oct. 1 proof-of-reserves report. After the incident, CoinDesk estimated the ETH loss was equal to about 5.6% of Binance's ETH reserves, cutting the reserve ratio from 100% to about 94%.
Verification requires local data download and an open-source tool
Binance said the verification process has to be done on a computer. Users need to download the open-source verification tool from GitHub, log in to their Binance account, download their account-specific Merkle Tree data from the wallet verification page, and run the verification program on macOS, Linux or Windows.
Binance said running the process on a user's own device means users do not have to rely only on numbers supplied by the exchange. The verification tool's source code is publicly available on GitHub, and the code has been independently audited. Binance pointed to a February 2023 audit report by cybersecurity firm Hacken as one example.
The exchange also warned users to use only Binance's official website during the process, avoid sharing login credentials, and not run the verification on untrusted devices.
About 5% of the affected amount remains in lower-liquidity tokens
For now, only the 10 listed assets are open for self-verification. In its fourth incident update, Binance said it had replenished about 95% of the affected amount. The last 5% is made up of tokens outside those 10 assets, and Binance said those markets have lower liquidity, so buying back enough supply takes longer. It also said it is still working with industry partners on those repurchases.
Binance plans to take another snapshot on Nov. 4 to include more tokens, then generate a new full zero-knowledge proof. It said the computation is heavy and should take 40 to 50 hours.
Withdrawals are reopening in stages
On withdrawals, Binance said it had already restored the first phase covering 15 chains on Nov. 1. The next phase is expected on Nov. 3, when more chains and assets will reopen in batches. Details will be announced once confirmed. Binance said the incident timeline and withdrawal status by chain have been compiled on its incident page.
