Binance has replenished 95% of affected assets and plans another reserve snapshot as US authorities investigate the $6.3 billion theft.
Binance has completed its zero knowledge Proof of Reserves verification for ten major cryptocurrencies, allowing users to independently confirm that their balances are backed at least 1:1 following the exchange’s $6.3 billion security breach.
In its fifth recovery update, published Monday, Binance said the cryptographic proof for its October 31 reserve snapshot is now available through its verification platform.
The verification covers Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash, which the exchange previously confirmed were fully backed after replenishing the affected assets with company funds.
Binance has now replenished approximately 95% of the impacted assets, up from 90% on October 31. The remaining 5% consists of less liquid tokens that the company is still acquiring through market and OTC transactions.
The exchange plans to take another reserve snapshot on November 4, covering additional tokens, with the corresponding zero knowledge proof expected to take approximately 40 to 50 hours to generate.
Binance also plans to expand withdrawal availability to additional networks and assets beginning November 3, following the first phase of restoration on Sunday.
Binance replenishes 95% of stolen assets as withdrawals resume
The latest update follows an October 29 security breach that compromised Binance’s hot wallets and resulted in approximately $6.3 billion in unauthorized withdrawals, the largest cryptocurrency theft on record.
Binance initially committed more than $6.34 billion in company resources to cover the losses, including approximately $5 billion held in the specific cryptocurrencies affected by the attack.
The recovery effort has drawn on the exchange’s Secure Asset Fund for Users, Futures Insurance Fund and corporate treasury, according to its earlier recovery update.
By October 31, Binance had replenished 90% of the affected assets. That figure increased to 95% by November 1, when the exchange began restoring withdrawals across 15 blockchain networks, including Bitcoin, Ethereum, BNB Chain, Solana and Tron.
Binance said the remaining tokens are harder to source in the required quantities because of limited market liquidity.
The company has also worked with law enforcement, blockchain intelligence firms and token issuers to freeze approximately $3 billion in assets linked to the attack. Those frozen assets are separate from the funds Binance has allocated to replenish customer balances.
Binance plans additional reserve verification and security report
Binance said users can independently verify their holdings through Merkle trees, a cryptographic system that allows customers to confirm their balances were included in the exchange’s October 31 reserve snapshot without exposing individual account information.
The process also uses zero knowledge proofs to verify that the covered assets are backed by sufficient reserves.
The verification applies to the ten covered assets at the time of the snapshot and does not constitute a comprehensive financial audit of the exchange.
Binance said its next reserve report will expand coverage to additional cryptocurrencies as it continues replacing the remaining affected assets.
The exchange is also investigating the cause of the breach. Its initial findings suggested a compromised employee laptop may have played a role, although subsequent investigations uncovered additional points of compromise. Binance previously said it had found no evidence that wallet private keys were leaked.
The company has committed to publishing a detailed technical report explaining the attack and the security measures implemented in response.
“Binance will absorb the financial impact of the stolen funds, not our users,” the exchange reiterated in Monday’s update.
FBI attributes Binance hack to North Korea as Secret Service investigates
US federal authorities are also investigating the theft, with the FBI, Secret Service and other agencies coordinating efforts to trace stolen assets and identify those responsible.
In an October 31 advisory, the FBI attributed the attack to North Korea’s TraderTraitor hacking operation, saying investigators had observed stolen funds being converted primarily into Ethereum, with further laundering expected through decentralized finance and instant swap services.
The US Secret Service said its investigators worked with industry partners within minutes of the October 29 breach to identify and freeze a significant portion of the stolen cryptocurrency.
The agency said the investigation continues alongside the FBI, IRS Criminal Investigation, federal prosecutors in Washington, DC, and California, and the Justice Department’s computer crime and national security divisions.
The FBI has also published a list of wallet addresses linked to the theft and urged cryptocurrency exchanges, DeFi protocols and other industry participants to block transactions involving those addresses.
