Binance Completes Zero-Knowledge Proof of Reserves After the $6.3 Billion Hack: 10 Tokens Backed 1:1, Next Snapshot Due November 4

Five days after the largest crypto theft on record, Binance has put its most concrete evidence yet on the table. The exchange said on November 2 that it has completed the full zero-knowledge proof for its October 31 proof-of-reserves snapshot, so holders of ten tokens can now check for themselves that their balances were backed at least one-to-one. It is not a full audit, and it does not answer every question about the October 29 hack — but it is the first verifiable, user-checkable claim Binance has made since the attack, and it arrives alongside new details about how the attackers got in.

What the proof actually covers. The snapshot was taken at 00:00 UTC on October 31, two days after attackers drained more than $6.3 billion from Binance hot wallets on October 29. The ten covered tokens are BNB, BTC, ETH, RLUSD, SOL, USD1, USDC, USDT, XRP and ZEC. Binance says users holding any of them can independently verify that their balances in the snapshot are backed at a minimum of 1:1, using an open-source verifier downloaded from its proof-of-reserves site. A fresh snapshot covering more tokens is planned for November 4, with its proof taking approximately 40 to 50 hours after that. The next phase of reopening withdrawals for more networks and assets was also planned for November 3, as a gradual rollout.

How a zero-knowledge proof works, in plain language. The system pairs two ideas. A Merkle tree lets each user check that their own account was counted in the snapshot, without seeing anyone else's balance. A zk-SNARK — a zero-knowledge proof — proves that total reserves cover what users are owed, again without revealing individual balances. In other words, Binance is claiming: we can prove the total is enough, and you can prove you were included, and neither check requires publishing your balance. That is stronger than a press statement, and weaker than a full independent audit — a distinction that matters, and one to keep in mind through the rest of this article.

The money side: 95% replaced, about $3 billion frozen. Binance has said it set aside more than $6.34 billion from its corporate treasury, its SAFU emergency fund and its futures insurance fund to cover the loss, and that users will not bear the financial impact. Coverage reached about 90% by October 31 and roughly 95% by November 1, the exchange said. The last 5% sits in less liquid tokens that are slower to buy in size, which is why replenishment of the big assets came first. Separately, about $3 billion has been frozen on-chain with help from blockchain partners and token issuers. Outflows, meanwhile, are easing from their peak: DefiLlama data cited in November 3 coverage put 24-hour net outflows at about $3.29 billion, down from a peak of around $7 billion — a large exit, but a slowing one, not an accelerating run.

How the attackers got in: the November 3 details. The same day's reporting added the attack's origin story, and it is uncomfortably ordinary. Binance revealed on November 3 that the October 29 attack began with two engineers whose computers were compromised separately. The first incident happened in June, when an engineer downloaded a tampered software package while searching for an AI tool. Attackers then used stolen credentials to access Binance's wallet systems and authorise fraudulent withdrawals, with a fake job interview among the lures used. The FBI has attributed the theft to North Korea's TraderTraitor group; on November 3, North Korea rejected that attribution, with Kim Yo Jong calling the allegations absurd rhetoric. That denial does not change the on-chain facts — the money moved, the freezes happened, the proof was published — but it does mean the attribution fight will run in parallel with the recovery, in public.

What the proof does NOT prove. This is the part readers should not skip. A proof of reserves is a snapshot at one moment — October 31, 00:00 UTC — for ten tokens. It does not cover every asset on the exchange, it does not prove that every weakness is fixed, it does not publish a full technical post-mortem of the attack path, and it does not guarantee that another incident cannot occur. As of November 3, Binance had not published that promised full post-mortem. The proof is best read as one check among several: reserves at a point in time, plus replenishment progress, plus frozen funds, plus the pace of withdrawal reopening. Any one of those alone would be thin. Together, they form a picture that is improving but incomplete.

Why this matters beyond Binance. Every exchange that holds customer funds faces the same question after a hack: prove it, don't just say it. Binance's move — a user-verifiable proof, on a published schedule, with a wider snapshot promised for November 4 — sets a practical standard other exchanges will now be measured against, especially after Coinbase adjusted its offline key-storage systems as a precaution and Kraken said its teams were reviewing vulnerabilities for lessons. The industry response is also becoming coordinated: OKX chief executive Star Xu has proposed a real-time alert system so exchanges can warn one another about a suspected hack and freeze suspicious funds faster. The $3 billion frozen so far shows why that coordination matters — freezes only work if issuers and partners act in hours, not weeks.

What to watch next. Three dates and numbers decide whether this proof holds up. First, the November 4 snapshot: does it cover more tokens, and does its proof arrive in the promised 40 to 50 hours? Second, the remaining 5% of replenishment: do the less liquid tokens get bought without moving their markets against Binance? Third, the withdrawal reopening: does the gradual November 3 phase complete without new suspensions? If all three land cleanly, Binance will have turned a record hack into a working example of verifiable recovery. If any of them slips, the proof will be remembered as a snapshot that froze a moment — not as a recovery that finished the job.

FAQ

What did Binance complete on November 2? The full zero-knowledge proof for its October 31 proof-of-reserves snapshot, covering ten tokens.

Which ten tokens are covered? BNB, BTC, ETH, RLUSD, SOL, USD1, USDC, USDT, XRP and ZEC — each backed at least 1:1 in the snapshot, according to Binance.

How can a user check it? By downloading an open-source verifier from Binance's proof-of-reserves site and checking that their own balance was included and covered.

When is the next snapshot? November 4, covering more tokens, with its proof taking approximately 40 to 50 hours.

How much of the $6.3 billion loss has been replaced? About 95% by November 1, from corporate funds, SAFU and the futures insurance fund; about $3 billion has also been frozen on-chain.

How did the attackers get in? According to Binance's November 3 account, two engineers' computers were compromised separately, starting in June with a tampered software package, with a fake job interview among the lures; the FBI attributes the theft to North Korea's TraderTraitor group, which North Korea denies.

Is a proof of reserves a full audit? No — it proves backing at one moment for covered tokens; it does not cover every asset, publish the full attack post-mortem, or guarantee future safety.

Read more on Zimbuck: Binance's $16.6 billion outflow and the proof of reserves due Tuesday is here, https://zimbuck.com/blogs/874/Binance-Has-Shed-16-6-Billion-Since-the-Hack-and , and how to lock down your own exchange account is here, https://zimbuck.com/blogs/974/How-to-Lock-Down-Your-Crypto-Exchange-Account — plus the Zimbuck News page at https://zimbuck.com/pages/zimbucknews and discussion at https://zimbuck.com/groups/zimbuckmarketnews . The zero-knowledge proof story this article is based on is here: https://unchainedcrypto.com/binance-publishes-zero-knowledge-reserve-proof-for-btc-eth-and-8-other-tokens-after-hack/ . This is market news and general information only, not financial advice. Join Zimbuck at https://zimbuck.com to follow more exchange coverage.