Binance said on Nov. 2 that it has finished the full zero-knowledge proof for its Oct. 31 proof-of-reserves snapshot, so anyone holding one of 10 tokens on the exchange can now check that their balance is backed at least 1:1.

The proof covers BNB, BTC, ETH, RLUSD, SOL, USD1, USDC, USDT, XRP and ZEC. Binance took the snapshot at 00:00 UTC on Oct. 31, two days after attackers drained over $6.3 billion from its hot wallets on Oct. 29.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

How Users Check Their Balance

Binance’s system pairs a Merkle tree, which shows a user their own account was counted in the snapshot, with a zk-SNARK, which proves total reserves cover what users are owed without revealing anyone’s balance. To run the check, a user logs in, downloads Binance’s open-source verifier and runs it locally. The exchange says the verifier’s code sits in a public GitHub repository and has been independently audited.

Next Snapshot on Nov. 4

Only those 10 tokens are covered for now. Binance plans a fresh snapshot on Nov. 4 that will include more tokens. Yi He, Binance’s co-CEO, wrote in an X post that producing the proof “will take about 40 to 50 hours after the snapshot is completed,” with the time depending on how many tokens are included.

The exchange also said the next phase of reopening withdrawals for more networks and assets was planned for Nov. 3, as a gradual rollout with details to follow.

How the Oct. 29 Hack Unfolded

On Oct. 29, attackers drained more than $6.3 billion from Binance hot wallets on several blockchains, most of it within about 20 minutes, according to TRM Labs, in an exploit that has since been attributed to a North Korea-backed group tracked by the FBI as TraderTraitor.

Binance’s first account was that the breach “may involve a compromised DevOps engineer’s laptop,” which let the attacker reach a service container and send out unauthorized withdrawals. The exchange added that it had found no sign of a leaked wallet key. Hours later, Binance CEO Richard Teng wrote that the attacker “did not simply use one engineer’s permissions.” About an hour after that, the exchange said further digging had turned up “additional points of breach,” calling it “a complex attack.”

“It certainly looks like the wallet signing infrastructure inside Binance was compromised,” Pangolin Intelligence founder “Jonty” said on the Unchained podcast on Nov. 2.

Opsek founder Pablo Sabbatella on the same show likened it to a bank’s check-writing pen: “they didn’t steal the check, but they were able to access the pen inside the bank and sign transactions.”

Freezing Funds and Covering the Shortfall

Binance has said about $3 billion had been frozen onchain with help from blockchain partners. This includes sums frozen by stablecoin issuers Circle and Tether and protocols like Arbitrum, which saw its Security Council move assets out of an address tied to the exploit. Binance halted withdrawals while it ran security checks, then restarted them in phases on Nov. 1.

The exchange pledged to cover all losses from its SAFU emergency fund and company money, and said it had set aside more than $6.34 billion. Coverage had reached about 90% by Oct. 31 and roughly 95% by Nov. 1, Binance said. The last 5% sits in tokens beyond the 10 named in the proof that are less liquid and slower to buy in size.

“Our commitment is unchanged: Binance will absorb the financial impact of the stolen funds, not our users,” the exchange wrote on Nov. 2, adding that “with the generated proof, the backed portion of that commitment is now publicly verifiable.”

For Ram Ahluwalia, who runs Lumida and co-hosts Unchained’s Bits + Bips, the breach landed on a whole sector. He said on the show’s Nov. 2 episode that “digital assets as a category has failed to secure their customer deposits,” calling it “incredibly disappointing.” He added, “It’s all about trust, it’s all about confidence.”

Related Listen: How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack