Summary
- Binance says approximately 95% of affected assets have been replenished.
- A new zero-knowledge proof covers ten major assets in the October snapshot.
- Withdrawal services are returning in phases following security checks.
Cryptocurrency exchange Binance has issued a new cryptographic proof of reserves and continued restoring withdrawals after a security incident that it estimates affected approximately $6.3 billion in customer assets.
In an update dated 2 November, Binance said it had completed a zero-knowledge proof for its 31 October reserves snapshot, covering ten major digital assets including Bitcoin, Ethereum, and widely used stablecoins.
The company says users holding those assets can verify that their account balances are included in a reserve calculation backed at a minimum ratio of one to one. The new evidence addresses financial assurance during a broader technical recovery programme.
Binance suspended withdrawals after detecting unauthorised transactions on 29 October. Its preliminary investigation identified a possible compromise of a DevOps engineer’s laptop followed by access to a service container and the submission of unauthorised withdrawal requests.
Those findings remain preliminary. Binance has not published a final account of the intrusion path, and the absence of evidence that wallet private keys were exposed is not a complete explanation of how the transactions were authorised.
The exchange’s early estimate placed the amount affected at approximately $6.3 billion. It subsequently reported that substantial assets associated with the incident had been frozen through cooperation with blockchain organisations and law-enforcement partners.
By 2 November, Binance said it had replenished approximately 95% of the affected amount using company resources. That figure concerns asset replacement rather than recovery of 95% of the funds taken by attackers.
The remaining balance involved assets outside the ten principal tokens included in the first reserve verification. The exchange described those as less liquid and consequently more difficult to replace in large volumes over a short period.
Withdrawals began returning in phases on 1 November as the company completed security checks and restored selected networks and token services. Customers could still experience delays or restrictions while additional systems were brought back online.
The recovery programme consequently has two separate measures of progress: whether transaction services are available and whether the assets behind customer balances have been restored or independently evidenced.
A platform can resume processing transactions without immediately resolving all questions about the assets it holds. Conversely, sufficient reserves do not prove that its technical environment is free from vulnerabilities or compromised identities.
Binance’s proof-of-reserves system combines a Merkle tree representation of customer balances with zero-knowledge proofs. The latter allow certain statements about the reserve calculation to be checked without disclosing the underlying balances of individual users.
The calculation refers to the specified assets at the date of the snapshot. It is not equivalent to an audit of every liability, operational process, or contingent risk associated with the exchange.
The company planned a further proof covering additional assets on 4 November. That timetable indicates that the verification process was being expanded while investigations and service restoration continued.
The preliminary account of a technical employee’s device being compromised raises questions about access governance and the authorisation of high-value transactions. An attacker may exploit operational workflows without acquiring the most sensitive cryptographic keys.
Privileged service credentials, infrastructure permissions, and the separation of administrative functions can all affect how a cloud or application compromise translates into the ability to move funds. The exact role of those mechanisms in this incident remains under investigation.
The company’s commitment to replace affected assets also creates an operational financial responsibility distinct from tracing stolen funds. Replenishment can protect customers while investigations continue, even if the attacker-controlled assets have not been recovered.
Binance has said that the final forensic findings will be published after the investigation is complete. Until then, its reported figures should be treated according to their stated purposes: affected assets, frozen funds, replenishment, and reserves are not interchangeable.
The latest update establishes progress in withdrawal restoration and balance verification but does not close the investigation or establish the full sequence of unauthorised activity.
