Binance Covers All $6.3B Hack Losses, Reserve Proof Still Pending
Binance says coverage of assets affected by its $6.3 billion October hack is complete and has published a new Proof of Reserves snapshot. The zero-knowledge proof that would let users verify 1:1 backing has not been generated, and Binance gave no timeline.
Update: November 12, 20:33 UTC
Binance said a fake job interview was one entry point in the October attack, according to Blockonomi. A Binance engineer downloaded a malicious coding test onto his work computer in September, the outlet reported.
Blockonomi also noted that Binance security chief Jimmy Su described this exact risk to Cointelegraph in July.
Separately, Bitcoin Magazine reported that the new Proof of Reserves snapshot covers 198 tokens, up from 44 in the previous snapshot. Users cannot yet independently verify it because the zero-knowledge proof has not been published.
Original report: November 12, 18:45 UTC
$6.3 billion in affected user assets, fully covered. That is Binance's position as of Nov. 12, alongside a new Proof of Reserves snapshot. The cryptographic proof that should back it has not been generated yet.
"Binance has completed coverage of assets impacted in the security incident,"
Binance
No completion time for the proof. No asset-by-asset breakdown of the final purchases. Binance said customers will be able to independently verify backing of at least 1:1 once the zero-knowledge proof exists. Until then, the snapshot is a claim, not something users can check themselves.
What Binance did and did not say
Bloomberg calls the Oct. 29 incident, first detailed in our earlier coverage, the largest cybertheft in history. Coverage stood at 90% in the Oct. 31 update and reached about 98% by Nov. 4, as we reported. The last tokens took longer on thin liquidity. Binance kept buying through market and OTC channels.
The stolen crypto was not recovered. Binance's statement describes buying replacement assets from its own resources, drawn from three company sources: the Secure Asset Fund for Users (SAFU), part of its Futures Insurance Funds, and its corporate treasury. In the Oct. 31 update it had set aside more than $6.34 billion in company funds. Binance calls its futures insurance reserves company money, separate from customer assets, taken from balances above its risk framework requirement.
No final split among the three sources. No confirmation that SAFU is back at the roughly $1 billion Binance committed to.
The proof gap
Earlier rounds followed a set order: a Nov. 2 verification of an Oct. 31 snapshot covering ten assets, then a Nov. 4 snapshot covering 44 tokens, with an estimated 50 to 60 hours to generate the proof. This time the snapshot is out first.
Reported user balances, Oct. 1 to Oct. 31: USDT down 7.95% to 29.48 billion. ETH down 3.80% to 3.65 million. BTC up 0.52% to 692,187. USDT reserve coverage slipped from 103.88% to 100%; BTC stood at 100.04%. All of it predates the Nov. 1 reopening of withdrawals.
That reopening was heavy. In the first nine and a half hours, Binance reported $4.649 billion in withdrawals against $1.01 billion in deposits, about $3.64 billion net out. Santiment's Nov. 6 research counted about 28,316 BTC net leaving Binance-associated wallets from the attack through Nov. 5, but cautioned that the exchange's BTC balance decline began before the hack.
Limits of a reserve snapshot
The PCAOB Office of the Investor Advocate's March 2023 advisory says proof-of-reserves reports are not audits. They describe assets at one point in time and may not establish liabilities or customers' legal rights. They give no assurance on controls or on later availability of assets.
For now, the claim that users are made whole rests on Binance's word. The zero-knowledge proof is what would let customers test the 1:1 backing themselves. It has no date.
