Binance hack: what its reserves proof means for your money

Binance has made its promised reserves proof available for ten tokens, including Bitcoin and ether, Ethereum’s coin. Customers of the cryptocurrency exchange can check that their balances were included in its 31st October snapshot. Questions remain about other tokens and whether Binance’s security fixes work.

That follows the theft on 29th October 2026, which Binance puts at approximately USD 6.34 billion, or about KES 824 billion. Binance has committed to covering the loss. The FBI blames North Korea’s TraderTraitor hacking activity; North Korea denies involvement.

When we covered Sunday’s withdrawal restart, the proof was expected by Tuesday. Binance announced its completion on Monday 2nd November. Its new incident report dates a higher replenishment figure to a time when earlier updates gave lower percentages.

What Binance’s dated updates show

On 31st October, Binance put replenishment at 90%. Its 2nd November notice still gave 95%. Yet the incident report published on 3rd November says 98% had been replenished as of 31st October. It does not reconcile those figures.

Binance needs to explain what each percentage measures before customers can read them as a reliable recovery timeline. The discrepancy alone is insufficient evidence that customers’ balances are missing.

These percentages concern replacing stolen tokens with company funds, not recovering the original coins. The completed proof covers Bitcoin (BTC), ether (ETH), BNB, Solana (SOL), XRP and Zcash (ZEC), plus USDT, USDC, USD1 and RLUSD. The last four are stablecoins designed to track the US dollar. Its snapshot was taken at 03:00 Kenyan time on 31st October.

Proof of Reserves compares disclosed holdings with customer balances. Binance says the ten tokens have at least one coin held for each coin owed. Its cryptographic process lets customers check inclusion without seeing other people’s balances. Its verification guide starts with logging in on the official site and opening Wallet, then Verification. Select the 31st October record. We have not run a customer’s verification; Binance warns that the snapshot can differ from current holdings.

Nor is this a full financial-statement audit. Binance used its treasury, the Secure Asset Fund for Users (SAFU) emergency reserve and part of its futures insurance funds to replace assets. Those insurance funds cover trading losses beyond a trader’s collateral. The funding update does not itemise each insurance drawdown or date SAFU’s restoration; the customer proof cannot settle those questions.

Why pausing withdrawals could not stop the attack

Binance’s new account describes a malicious job-interview assignment downloaded onto an engineer’s work computer in September. On 20th October, the attacker used that machine and an internal AI tool to reach two other engineers. Stolen deployment credentials then enabled access to wallet-signing operations, which authorise transactions. The report does not name the AI tool or explain that access precisely.

Security company Blockaid’s blockchain analysis found signed authorisations handing an Ethereum wallet to attacker-controlled code. The mechanism, EIP-7702, lets an account use a smart contract, a program on the blockchain, until the authorisation is replaced or cleared. A malicious contract can therefore keep moving funds without a fresh signature for every transfer. Blockaid found later deposits were swept too.

That explains why closing the customer withdrawal interface could not stop this route. It also answers part of the signing-authority question we raised last Friday. Binance says it rebuilt affected systems; independent security reviewers are still being engaged.

What customers can check now

A wider withdrawal phase was scheduled from 07:00 Kenyan time on 3rd November. Availability remains specific to each token and network, so check that combination on Binance’s withdrawal page. The notice warns of delays and says deposits remain open.

Kenya’s one-year compliance window we explained in July ends on 4th November under the Virtual Asset Service Providers Act. Licensed providers must separate customer assets from their own. Binance’s current Kenyan licence or application status remains unverified from the records checked.

Binance plans a broader token snapshot on 4th November, with another 40 to 50 hours estimated for its proof. Customers outside the first ten need that coverage demonstrated. The completed check concerns an earlier snapshot; Binance still owes a consistent replenishment account and independently reviewed security findings.