# Exchanges say the assets are back. What can users actually verify?

> Binance's recovery updates show what Proof of Reserves can verify, and why account inclusion alone cannot establish complete liabilities or withdrawal access.

Source: https://sheng.page/en/posts/binance-2026-hack-user-assets-reserves/ · Published: 2026-11-01 · Updated: 2026-11-02 · Author: Sheng

An exchange's recovery percentage does not tell you whether your coins are fully backed or available to withdraw. Binance's announcements illustrate the limits of the published evidence.

Proof of Reserves (PoR) lets you check whether your balance appears in a published total. Your proof may pass even if another account was omitted. Sufficient assets at the snapshot do not establish withdrawal availability, which depends on the coin and network.

![Checks for a recovery announcement, a PoR snapshot and withdrawals: the percentage needs a valuation basis and denominator, PoR leaves omissions and asset encumbrances unresolved, and withdrawals depend on the coin and network](/images/binance-2026-hack-user-assets-reserves/claims.en.png)

## What the recovery percentage covers

In Update #4 on 1 November, Binance said it had covered approximately 95% of the affected amount, with BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC fully backed. The remaining roughly 5% concerned unnamed tokens that were harder to buy in sufficient quantities. A separate [Binance X post](https://x.com/binance/status/2116728061765034338) put replenishment at US$6 billion, while Update #2 estimated the incident at about US$6.3 billion. These rounded figures came without the token quantities and valuation breakdown needed to reproduce the 95% calculation or determine coverage for an individual account.

Update #4 said company resources would cover the losses. Update #3 had identified portions of SAFU and the Futures Insurance Fund alongside the corporate treasury, but gave no itemised amounts to reconcile with the latest increase. Update #2 also said Binance had set aside more than US$6.34 billion to absorb the losses, [Reuters reported](https://uk.marketscreener.com/news/binance-says-it-has-covered-90-of-losses-from-6-3-billion-hack-so-far-ce785fd8db8cf425) Yi He as saying 50% of SAFU would be used, and Update #3's FAQ said Binance was replenishing SAFU and had committed to restoring it to approximately US$1 billion. These are Binance's own statements and come without an itemised record of spending.

SAFU is Binance's emergency fund. Its Academy glossary says Binance may use it to compensate users after a security incident, without guaranteeing that losses will never occur. [Deposit insurance](https://en.wikipedia.org/w/index.php?title=Deposit_insurance&oldid=1380724625) protects bank depositors. SAFU is not deposit insurance, and its glossary offers no equivalent compensation commitment.

## What an on-chain transfer establishes

Update #3 said part of SAFU would buy assets that remained short. One [transfer of 7,499 BTC](https://mempool.space/tx/774fcb97827d7ed2389447cc3ef3e1abcd024574cd745d2182cc0ec58e7914bd) from the public address on 31 October can be checked through mempool.space, but the record does not reveal which tokens were bought or establish that purchases covered the shortfall.

Update #2 reported about US$3 billion frozen. Elliptic identified US$2.85 billion frozen or seized in its on-chain analysis at about 05:50 UTC on 1 November; TRM estimated about US$2.7 billion as of 00:30 UTC on 30 October. Their timing and scope differ, so the figures cannot be added together. None supplied an amount already returned to Binance.

## What PoR lets you check

A [Merkle tree](https://en.wikipedia.org/w/index.php?title=Merkle_tree&oldid=1375083916) hashes data through successive layers into a root that commits to the dataset; a verification path shows whether an entry belongs to that commitment. Vitalik Buterin's article on solvency describes a Merkle sum tree, which also adds balances through those layers. With their own verification path, users can check that their balance contributes to the published total. Solvency also requires comparing controlled assets with customer liabilities.

The example in `merkle_sum_por.en.py` builds a complete tree, then omits dave and checks the remaining accounts' proofs. It serves only as a minimal demonstration, with no claim to describe Binance's implementation. No comparison across exchanges' production code was performed; the code comment's blanket claim about their implementations is unverified.

```python
import hashlib

# A minimal Merkle sum tree: each node carries (hash, subtree balance total).
# It only shows how an inclusion proof is checked; no exchange implements it this way.

def leaf(user: str, balance: int) -> tuple[bytes, int]:
    return hashlib.sha256(f"{user}:{balance}".encode()).digest(), balance

def parent(left: tuple[bytes, int], right: tuple[bytes, int]) -> tuple[bytes, int]:
    total = left[1] + right[1]
    data = left[0] + left[1].to_bytes(8, "big") + right[0] + right[1].to_bytes(8, "big")
    return hashlib.sha256(data).digest(), total

def build(leaves):
    levels = [leaves]
    while len(levels[-1]) > 1:
        cur = levels[-1]
        if len(cur) % 2:
            cur = cur + [(hashlib.sha256(b"pad").digest(), 0)]
        levels.append([parent(cur[i], cur[i + 1]) for i in range(0, len(cur), 2)])
    return levels

def proof(levels, index):
    path = []
    for level in levels[:-1]:
        if len(level) % 2:
            level = level + [(hashlib.sha256(b"pad").digest(), 0)]
        sibling = index ^ 1
        path.append((level[sibling], sibling < index))
        index //= 2
    return path

def verify(user, balance, path, root):
    node = leaf(user, balance)
    for sibling, sibling_is_left in path:
        node = parent(sibling, node) if sibling_is_left else parent(node, sibling)
    return node == root

ledger = {"alice": 50, "bob": 30, "carol": 20, "dave": 100}

# The exchange builds the tree honestly
full = build([leaf(u, b) for u, b in ledger.items()])
root = full[-1][0]
print("full root total:", root[1])
print("alice included:", verify("alice", 50, proof(full, 0), root))

# The exchange leaves dave out: liabilities shrink, everyone else still verifies
shown = {u: b for u, b in ledger.items() if u != "dave"}
partial = build([leaf(u, b) for u, b in shown.items()])
proot = partial[-1][0]
print("partial root total:", proot[1])
print("alice included:", verify("alice", 50, proof(partial, 0), proot))
print("bob included:  ", verify("bob", 30, proof(partial, 1), proot))
print("dave can find a proof:", "dave" in shown)
```

```text
full root total: 200
alice included: True
partial root total: 100
alice included: True
bob included:   True
dave can find a proof: False
```

Omitting dave reduces the total from 200 to 100, while accounts still in the tree can pass verification; the output shows alice and bob. Their paths do not expose dave's missing 100. The final line only shows that dave is absent from the published ledger; the program does not run verify for him.

Binance's PoR page describes zk-SNARK constraints covering balances' inclusion in the total, non-negative net account balances and valid root changes after leaf updates. These check the submitted data, without establishing that every account was submitted.

Provisions relies on customers checking their balances' inclusion. The 2026 proof-of-liabilities (PoL) paper, *Mitigating Collusion in Proofs of Liabilities*, likewise notes that existing aggregate proofs do not guarantee a total reflecting every user's current balance.

Binance's PoR page lists wallet ownership checks, but control does not rule out borrowed assets; pledges and other encumbrances need separate evidence. The PCAOB's Office of the Investor Advocate warned in 2023 that PoR procedures were likely not to address liabilities or borrowed assets, among other matters, and were not audits. Buterin also notes that fiat balances need evidence from banks, auditors or similar parties, beyond these cryptographic checks.

## A snapshot and a withdrawal answer different questions

Provisions ties its snapshot to a particular Bitcoin block. Binance's self-verification instructions also warn that reported balances may differ from current holdings. Repeated proofs help with observation, but a successful check does not establish that assets stayed in place afterwards.

Withdrawal availability depends on the coin and network. Update #4 itself schedules the resumption around those combinations.

A [bank run](https://en.wikipedia.org/w/index.php?title=Bank_run&oldid=1372874320) and the [Diamond–Dybvig model](https://en.wikipedia.org/w/index.php?title=Diamond%E2%80%93Dybvig_model&oldid=1301278492) illustrate the maturity mismatch between bank deposits and assets: deposits can be withdrawn on demand, while loans may take longer to repay, so concentrated withdrawals can create payment difficulties. This banking model is used here only to distinguish assets from liquidity, without inferring that Binance will face a run.

## Binance's status at the time of the check

The original check ran to 14:15 UTC on 1 November 2026, or 22:15 that day in Taipei. That record is retained below, followed by a separate update for 2 November. The latest numbered notice found was [Recovery Update #4](https://x.com/binance/status/2116744986096292263); no verifiable Update #5 was found. Subsequent progress appeared in posts on [Binance's official X account](https://x.com/binance).

### Announced progress

**Withdrawals**: the [official X update at 12:36 UTC](https://x.com/binance/status/2116871932075516174), or 20:36 in Taipei, added ZEC, TON and SUI. Together with earlier entries, it listed the following combinations across 15 networks as re-enabled. These are Binance's announcements; no withdrawals were tested for this article, and a network's inclusion does not establish availability for every token on it.

| Network | Assets listed in the announcement |
| --- | --- |
| BTC | BTC |
| Ethereum (ETH) | ETH, USDT, USDC |
| BNB Smart Chain (BSC) | BNB, USDT, USDC |
| XRP | XRP |
| Base | ETH, USDC |
| DOGE | DOGE |
| Optimism (OP) | ETH, USDT, USDC |
| Arbitrum | ARB, ETH, USDT, USDC |
| TRON (TRX) | TRX, USDT |
| Solana (SOL) | SOL, USDT, USDC |
| Polygon (MATIC) | POL, USDT, USDC |
| Avalanche C-Chain (AVAXC) | AVAX, USDT, USDC |
| Zcash (ZEC) | ZEC |
| TON | USDT, GRAM |
| Sui (SUI) | SUI |

**Replenishment**: the latest percentage found remained approximately 95% in Update #4. A separate [official post at 03:04 UTC](https://x.com/binance/status/2116728061765034338) said US$6 billion had been covered. No higher official percentage was found. These are the platform's replenishment claims and do not establish recovery of an equivalent amount of stolen funds.

**PoR**: [Update #3](https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62) said the snapshot taken at 00:00 UTC on 31 October had been published. An [official X post at 06:53 UTC](https://x.com/binance/status/2116785774540787920) said the PoR address list had been updated with new wallets and that future withdrawals would use them. An address-list update does not establish that the full zero-knowledge proof has been generated.

**Frozen and returned funds**: the official frozen total found remained about US$3 billion, from the [official post of 30 October](https://x.com/binance/status/2115970069696217576) and Update #2. No verifiable revised total or amount returned to Binance was found. Frozen funds cannot simply be added to the replenishment figure.

**Attribution**: an [FBI notice of 31 October](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) said North Korea was responsible for the theft of more than US$6 billion in virtual assets from Binance on or about 29 October, and named the activity TraderTraitor. The FBI, with the USSS and IRS-CI, observed the stolen assets being converted mainly into ETH. The notice does not set out the basis for the attribution, and naming the actor is not the same as publishing the intrusion path or root cause.

### Planned or unverified

- **Phase two**: no fixed date was found. [Yi He's post](https://x.com/heyibinance/status/2116754265121366112) said other wallets still needed security checks; [crypto.news](https://crypto.news/binance-reopens-bitcoin-withdrawals-after-hack/) and [BusinessToday](https://www.businesstoday.in/technology/story/binance-resumes-crypto-withdrawals-after-6-3-billion-security-breach-whats-open-from-today-564972-2026-11-01) also reported no fixed timetable. Update #4's 06:00–09:00 UTC window was the planned start of phase one, without establishing completion across all networks by 09:00.
- **Full PoR proof**: Update #3 estimated publication by 3 November UTC. This remains an estimate. The [English PoR page](https://www.binance.com/en/proof-of-reserves) and [Simplified Chinese page](https://www.binance.com/zh-CN/proof-of-reserves) retrieved on 1 November supplied no current snapshot fields, root or ratios. The page values and availability of the full proof could not be verified in that retrieval; this did not establish that they were unpublished.

The [withdrawal status page](https://www.binance.com/en/network) returned a table with no coin records when retrieved on 1 November, preventing an independent check of live status. The table above therefore follows Binance's announcements.

### Update: 2 November 2026

**PoR page**: the record of the [English page](https://www.binance.com/en/proof-of-reserves) read at about 10:30 UTC shows the 31 October 00:00 UTC snapshot, BTC block height 973895 and Merkle root `169dd7e2300fabd4f7a8d11d745fe24f4c31ae1ccac6c4391fbd47b548740ad0`. Displayed ratios included BTC at 100.04% and USDC at 106.08%. No publicly downloadable full zk proof was seen in that reading; dashboard values do not establish that the full proof has been verified. In its [official X post at 16:12 UTC on 1 November](https://x.com/binance/status/2116926305254133892), Binance said ZKP computation had begun and the updated report was expected the next day, 2 November. Update #3 had estimated 3 November UTC for the full proof. Both are forecasts, without confirming completion.

**Withdrawal flows**: the same 16:12 UTC post reported approximately US$4.649 billion in withdrawals and US$1.01 billion in deposits between 06:00 and 15:30 UTC on 1 November, giving net outflows of about US$3.64 billion. Its 2.1% figure used US$171 billion in AUM from PoR data available as of 28 October, rather than the 31 October snapshot. These are company figures, not independently reconciled for this article, and do not establish that every asset and network is available for withdrawal.

**Fiat withdrawals**: at [08:00 UTC on 2 November](https://x.com/binance/status/2117164969582330063), Binance announced new fiat withdrawal channels for USD, AED, VND, PHP and IDR. This is progress on fiat channels; the post gives no date for phase two of crypto withdrawals. No withdrawals were tested for this article.

## Publish enough for users to repeat the checks

Users need each period's data and verification method. Binance documents self-verification and says routine snapshots are taken at 00:00:00 UTC on the first of each month, with results published by the seventh. Each proof should state its snapshot date and corresponding block so users can identify the period being checked.

Exchanges should also identify excluded coins and questions users cannot verify themselves, so users can see whether their assets are covered and what evidence is still missing.

For the signing side, see [Once the key is safe, who gets to ask for a signature? Custody lessons from Binance in 2019](/en/posts/who-can-ask-the-signer-to-sign/). The related supply-chain discussion is [Valid signatures on the wrong transaction: Bybit and Safe's signing supply chain](/en/posts/bybit-safe-signing-supply-chain/).

## Still unclear

Although Binance had reported approximately 95% replenishment and US$6 billion covered, a valuation time, denominator breakdown and token-by-token reconciliation of the remainder were still missing. This article does not estimate a shortfall from those figures. No verifiable funding amounts by source, returned-fund total or firm phase-two date were found, and availability of the full PoR proof could not be confirmed.

A later post will look at what an exchange should publish so outsiders can keep checking its assets, liabilities and ability to deliver. This article draws on public material and does not constitute financial advice.

## Notes

- An overall recovery percentage cannot be converted into an account's coverage rate, and the SAFU glossary does not offer a deposit-insurance commitment.
- A transfer does not establish that purchases are complete, and frozen funds have not necessarily been returned.
- Your balance can verify while another account is omitted; asset encumbrances also need separate evidence.
- The 1 November list covered assets on 15 networks; new fiat channels followed on 2 November, with no firm date found for crypto phase two.
- PoR dashboard values were read on 2 November, but the full proof remains unverified. X forecast an updated report for 2 November; Update #3 estimated 3 November for the full proof.

## Corrections

- 2 November 2026: Retained the 1 November reading and added PoR values read at about 10:30 UTC, both publication forecasts, withdrawal flows with their 28 October AUM basis, and the fiat withdrawal update; the full proof remains unverified.
- 1 November 2026: Added the FBI's North Korea attribution of 31 October. The notice predates this article's cut-off and was missing from the original.
- 1 November 2026: The funding paragraph now includes Binance's statement that it had set aside funds, the planned share of SAFU and the SAFU replenishment commitment, and notes that none of these comes with an itemised record of spending.

## Further reading

- [FBI: North Korea Responsible for $6 Billion+ Binance Attack](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack): law-enforcement notice of 31 October 2026 giving the North Korea attribution and the TraderTraitor name, and asking node operators and DeFi services to block the listed addresses. It sets out no attribution method and is not a root-cause report.
- [Reuters report of 31 October 2026, republished by MarketScreener](https://uk.marketscreener.com/news/binance-says-it-has-covered-90-of-losses-from-6-3-billion-hack-so-far-ce785fd8db8cf425): wire report, the source for Yi He's statement on using 50% of SAFU.

- [11:31 UTC withdrawal update](https://x.com/binance/status/2116855614634852611) and [12:36 UTC withdrawal update](https://x.com/binance/status/2116871932075516174): official X lists from 1 November; the latter adds ZEC, TON and SUI. [Binance News's 15-network summary](https://www.binance.com/en/square/post/383529401136033) reports the same scope.
- [US$6 billion replenished](https://x.com/binance/status/2116728061765034338) and [new PoR wallet addresses](https://x.com/binance/status/2116785774540787920): official X posts at 03:04 and 06:53 UTC on 1 November, respectively. Neither replaces token-level reconciliation or the full proof.
- [Yi He's phase-one announcement](https://x.com/heyibinance/status/2116754265121366112): other wallets still required security checks, with no firm phase-two date supplied.
- [crypto.news on Bitcoin withdrawals](https://crypto.news/binance-reopens-bitcoin-withdrawals-after-hack/) (1 November 2026, 08:01 UTC) and [BusinessToday on the withdrawal schedule](https://www.businesstoday.in/technology/story/binance-resumes-crypto-withdrawals-after-6-3-billion-security-breach-whats-open-from-today-564972-2026-11-01) (updated that day): media accounts of the initial schedule and lack of a fixed phase-two timetable. The later resumption scope follows Binance's official X list.
- [Security Incident | Recovery Update #4](https://www.binance.bh/en-GB/support/announcement/security-incident-recovery-update-4-withdrawals-resume-in-phases-2026-11-01-73911fb819b240f88b88256bdd318eda) and the [full official X article](https://x.com/binance/status/2116744986096292263): the statement of 1 November 2026 supplies the approximately 95% figure and planned phase-one window, checked on Binance Bahrain and X.
- [Security Incident | Recovery Update #3](https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62): Binance's own statement of 31 October 2026 describes the intended use of SAFU and the snapshot arrangements, with the full zero-knowledge proof's publication date still an estimate.
- [Security Incident Update #2](https://www.binance.bh/en-GB/support/announcement/security-incident-update-2-2026-10-30-d3306d9dca5243548c813b605e1d1751) and the [official frozen-funds post](https://x.com/binance/status/2115970069696217576): Binance's statements of 30 October put frozen funds at about US$3 billion, without establishing an amount returned.
- [Binance Proof of Reserves](https://www.binance.com/en/proof-of-reserves) and the [Simplified Chinese page](https://www.binance.com/zh-CN/proof-of-reserves): the official mechanism and circuit description. Neither retrieval supplied snapshot fields, root or ratios on 1 November. The English-page reading at about 10:30 UTC on 2 November showed those values, without a publicly downloadable full proof being seen.
- [How to Verify Your Account Balance on Binance?](https://www.binance.com/en/support/faq/detail/815b25f0cb054bdd9d35eccc408fe981): the official instructions document verification steps and the routine snapshot timetable, without establishing that files for a particular period are available.
- [Binance Deposit & Withdrawal Status](https://www.binance.com/en/network): the official live page returned a table with no coin records on 1 November; that establishes neither availability nor suspension.
- [Secure Asset Fund for Users (SAFU)](https://www.binance.com/en/academy/glossary/secure-asset-fund-for-users): the Academy glossary was read directly in this check and is marked as updated on 13 October 2026. It describes the platform's own fund, without establishing a deposit-insurance commitment.
- [mempool.space: SAFU address](https://mempool.space/address/1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD): this source exposes public on-chain records, with the 7,499 BTC transfer checked through its API, but cannot establish that the missing tokens were bought.
- [Provisions: Privacy-preserving proofs of solvency for Bitcoin exchanges](https://jbonneau.com/doc/DBBCB15-CCS-provisions.pdf): Dagher and colleagues' ACM CCS 2015 paper supports the discussion of a solvency proof's design and limits, without assuring any particular exchange's solvency.
- [Having a safe CEX: proof of solvency and beyond](https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html): Buterin's personal technical article of 19 November 2022 explains Merkle sum trees and limits on asset proofs, without investigating this incident.
- [Mitigating Collusion in Proofs of Liabilities](https://arxiv.org/abs/2603.12990): Mohamed and Karame's arXiv preprint of 13 March 2026 discusses completeness in existing liability proofs, without providing assurance about a particular exchange.
- [PCAOB Investor Advisory on Proof of Reserve Reports](https://pcaobus.org/news-events/news-releases/news-release-detail/investor-advisory-exercise-caution-with-third-party-verification-proof-of-reserve-reports): the advisory of 8 March 2023 expresses the views of Office of the Investor Advocate staff, rather than a Board rule or a finding about this Binance incident.
- [Elliptic: The largest theft in history](https://www.elliptic.co/insights/binance-largest-hack-in-history/) and [TRM Labs: North Korea Steals USD 6.36 Billion From Binance](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history): these third-party chain analysts provide estimates with different timing and scope, neither establishing that the frozen funds had been returned to Binance.
- [Merkle tree](https://en.wikipedia.org/w/index.php?title=Merkle_tree&oldid=1375083916) and [Deposit insurance](https://en.wikipedia.org/w/index.php?title=Deposit_insurance&oldid=1380724625): these fixed Wikipedia revisions supply general definitions, without providing assurance about an exchange or fund.
- [Bank run](https://en.wikipedia.org/w/index.php?title=Bank_run&oldid=1372874320) and [Diamond–Dybvig model](https://en.wikipedia.org/w/index.php?title=Diamond%E2%80%93Dybvig_model&oldid=1301278492): these fixed Wikipedia revisions supply the banking concepts, with a notice about insufficient inline citations on the latter, and are used only to distinguish assets from liquidity, without predicting Binance's outcome.

> Ideas and technical judgement by Sheng; drafted with Claude · Example tested on Linux with Python 3.13.18.