$6.34 Billion Buffer: Binance Promises a Full Proof of Reserves by Monday

Binance intends to publish a full proof of reserves by Monday. Co-CEO Richard Teng said so on October 30, 2026, two days after the largest theft the crypto market has seen so far. A first snapshot of the reserves is due before the full report. In parallel, the exchange says it has set aside more than $6.34 billion of corporate funds to cover the damage.

For you as a customer, this attestation is the first point at which a pledge can be recalculated instead of simply believed. A proof of reserves is not a seal of quality and not a guarantee. It is a set of figures tied to a cut-off date, and what it can tell you is clearly bounded. This article explains what Monday's report can show, what it structurally does not show, and how to verify your own balance inside it.

The market itself has already calmed down. Bitcoin trades at $77,439, which is 0.04 percent above its level 24 hours ago, while the weekly view shows a loss of 4.0 percent. The range of the past 24 hours runs from $76,338 to $77,932, and those are the two levels where direction is currently decided. Ether stands at $2,247.18 between $2,208.56 and $2,257.45, and BNB at $704.57 between $693.16 and $709.72, which is 3.84 percent below the level of the previous week. All prices from CoinGecko data, as of October 31, 2026, 12:48 CET.

Proof of reserves: what an exchange reserve attestation shows

A proof of reserves is an exchange's evidence that on a fixed cut-off date it holds at least as many coins as its customers have deposited with it. It always consists of two halves, and only both together add up to a statement.

The first half is the holdings. The exchange names the blockchain addresses on which its coins sit and proves with a signature that it controls those addresses. That is the hard part of the attestation, because anyone can read the balances of those addresses off the blockchain for themselves. The second half is the sum of customer balances. That figure comes out of the exchange's books and cannot be looked up directly from outside.

The two figures together give the coverage ratio: holdings divided by customer balances. A value of 100 percent means that for every coin deposited there is exactly one coin on hand. Values well above that occur when an exchange keeps its own funds in the same pot. That is precisely the case at Binance now, because the buffer from corporate funds is meant to close the gap the attack tore open.

$6.34 billion buffer against $6.3 billion in damage

The amount of the damage has not been determined consistently to this day, and that is part of the picture. Binance itself put the impact at around $6.3 billion on October 30. The analytics firm Chainalysis arrived at $5.912 billion at the time of the theft, and its co-founder Jonathan Levin named $6.4 billion a few hours later. The data service Arkham identified wallets holding roughly $5.84 billion, which is explicitly a holdings figure and not a confirmed theft total. The defensible range therefore sits between roughly $5.9 billion and $6.4 billion.

Against that, the exchange reports more than $6.34 billion from corporate funds. That includes $5 billion that Binance already holds in exactly those tokens that flowed out. A spokesperson said these $5 billion were held in custody. The fact that the buffer consists of the same tokens is more than a formality: anyone covering a bitcoin outflow with dollars carries the price risk until the repurchase, and that is exactly the risk avoided here.

On top of that come frozen funds. On October 29 Binance first reported $2.54 billion in verified frozen assets, and a few hours later $3 billion, with the note that the sum could rise further. Tether said it had blocked more than $1.567 billion, and Circle more than $800 million.

Merkle tree and attestation: the two parts of a proof of reserves

A Merkle tree is a procedure that combines many individual entries in pairs into checksums, then those checksums in pairs again, and so on until a single number is left. That number is called the Merkle root. If a single entry changes, the root changes. For a reserve attestation that is practical, because it lets the exchange publish the sum of all customer balances without disclosing the balances of individual customers.

Each customer also receives a Merkle path, meaning the sequence of checksums that leads from their own entry up to the root. With that path they can recalculate that their balance really is contained in the published sum. They see nothing of the other customers' balances in the process.

The second part is the attestation. An attestation is an auditor's confirmation that the published figures match the documents submitted on a given cut-off date. This is explicitly not an annual audit report. An auditor who attests says something about a snapshot, not about the management, the risks or the debts of a company.

How to check your own balance in the Merkle tree

Once Binance has published the report, checking it yourself takes a few minutes. The procedure is built along similar lines at all the large exchanges.

1. Open the reserve attestation area in your logged-in account. It holds an identifier for your record, usually labelled record ID or account key, along with the Merkle path and the cut-off date.
2. Compare the balances stored there with what was actually in your account on the cut-off date. If a position differs, that is the real finding, and it belongs on the record.
3. Have the path recalculated. The exchanges provide a verification tool for this, and there are independent calculators that check the same path against the published root.
4. Compare the Merkle root your check produces with the root in the published report. If the two match, your balance is contained in the stated sum.

The last step is the important one. An attestation whose root nobody recalculates is a claim in tabular form. Only the match turns the figure into a check. How that comparison runs in detail, we have written up step by step elsewhere.

What a proof of reserves does not show: the liabilities

This is where the limit of the procedure lies, and it is the reason why a reserve attestation on its own is no all-clear.

A proof of reserves sets holdings against customer balances. Every other debt a company carries does not appear in it. Loans, bonds, outstanding claims from business partners, obligations from derivatives business: none of that shows up in the calculation. An exchange can therefore report a coverage ratio of 100 percent and at the same time carry liabilities that weigh on its solvency.

Then there is time. The attestation applies to one cut-off date. What happens the day after is not in it. Anyone who borrows the holdings shortly before the cut-off date and returns them afterwards produces a correct picture at the wrong moment. The only remedy is to compare attestations across several cut-off dates and to watch the signatures of the addresses.

And finally, the customer side is only as complete as the exchange enters it. A customer who never recalculates their own entry does not learn whether they are included at all. That is exactly why the check from the section above is not a detail for the technically inclined.

Withdrawals at Binance: from 48 hours down to 40 hours

The statements about the resumption of withdrawals have shifted several times, which is why they should be read with the date and time attached. Co-CEO Yi He said on October 30 that Binance expected withdrawals back within the next 48 hours, and added: “We're working on improving the withdrawal service and related address controls.” Over the course of the day the exchange first named 45 hours, then Richard Teng 40 hours, each time with the caveat that the security review has to be finished. Deposits are running normally according to the exchange, after being briefly suspended during the night of October 30 for security checks and blocks.

That three figures were named within a single day is the actual information for you. A deadline that is revised downwards is a good sign to begin with. It only becomes reliable once withdrawals are running broadly again. Until then, the same applies to every time estimate: the figure comes from the exchange itself and is not an independently verified fact.

EIP-7702 and a developer laptop: the attackers' route as documented so far

On the course of the attack there are statements from the exchange and assessments from security firms. Both are preliminary, and Binance itself has stressed that repeatedly.

According to a first finding by the exchange on October 30, the route ran through the compromised notebook of an employee in the development operation. Binance says it found no indication of a leaked private key. A few hours later the exchange reported that the investigation had produced further points of entry. Richard Teng described the incident as a multi-stage attack and stated explicitly that no single person had been held responsible.

Technically, Teng points to a delegation under EIP-7702 via a hot wallet that “did not pass through our normal approval controls”. A hot wallet is a wallet whose keys sit on a system connected to the internet so that withdrawals can run automatically. EIP-7702 is an Ethereum extension that lets an ordinary account temporarily take on the rules of a program account. Abuse that delegation and outflows can be triggered without stealing the key itself. The security firm Blockaid classified the case as key abuse via a compromised signing infrastructure; its chief executive said: “We don’t think a key was leaked.”

TraderTraitor: how Chainalysis and TRM Labs attribute the attack

Chainalysis considers it likely that the North Korean group TraderTraitor is behind the attack, pointing to connections with an earlier case. TRM Labs attributes the act to the same group with high confidence. The investigator ZachXBT reported that stolen funds had come together in one address with money from the Bitget incident, which points to the same actor.

These attributions are assessments by analytics firms and investigators, not a court finding. Binance itself has named no attacker. For you as an investor the attribution changes little about the facts, but a great deal about the prospect of funds returning: money that runs through state-backed groups rarely comes back, as experience shows. All the more weight therefore rests on the exchange's buffer and on the frozen sums.

$3 billion frozen: what Tether and Circle have blocked

That $3 billion could be locked down at all comes down to the design of stablecoins. The issuers of USDT and USDC can block individual addresses because they retain administration of their tokens. A blocked address can still hold the tokens but can no longer transfer or redeem them.

This option ends with the tokens that belong to nobody. Bitcoin and Ether cannot be frozen, because there is no body that could order it. That is why the frozen sum is spread very unevenly across the values that flowed out, and why the share that Tether has blocked with more than $1.567 billion and Circle with more than $800 million remains a special case and not a rule.

MiCA exchanges in Germany: which proofs are mandatory there

For German investors the legal framework is the second half of the answer. Providers that hold crypto assets or arrange trading here need authorisation under the EU regulation on markets in crypto-assets, MiCA for short, and are supervised by BaFin. Among their duties is keeping customer holdings separate from their own funds. We have written up separately which duties a MiCA licence triggers in detail.

A voluntary proof of reserves does not replace that supervision, and the supervision does not replace the attestation. The attestation shows you figures; the supervision gives you an addressee for complaints and a body allowed to inspect the books. Anyone who wants to hold larger amounts over a longer period cannot avoid the third option: holding the coins yourself and thereby removing counterparty risk entirely. How the devices for that differ is shown in our hardware wallet comparison.

Proof of reserves: Monday shows the coverage, not the debts

Monday's report is an interim status, not a final line. It can prove that the holdings are there. About the exchange's liabilities it says nothing, and about the time after the cut-off date nothing either. Three steps make sense now:

1. Recalculate your own entry. As soon as the report is out, check your balance against the published Merkle root. The instructions are in our guide checking a proof of reserves yourself.
2. Split up your holdings. Leave on an exchange only what you need for trading and for a savings plan. Which providers bring which terms and which authorisation is set out in our overview of the best crypto exchanges.
3. Keep an eye on the reimbursement pledge. What counts is not the announcement but the payout. We have written up the state of the pledge and the role of the SAFU fund in Binance pledges full reimbursement.

The evidence for the figures in this article is in the continuously updated log by Cointelegraph on the Binance hack and in the report by U.Today on the resumption of withdrawals.

(As of October 31, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)