Binance’s October 1 Proof of Reserves snapshot let CoinDesk match an affected wallet to assets backing customer balances. CoinDesk estimated ETH backing could be around 94% if the withdrawn assets had not been replaced. That is an estimate based on an earlier snapshot, not a confirmed current ratio. Binance said it would cover losses and publish updated reserves after remediation.
What did Binance say about the hack?
On October 30, Binance said its preliminary investigation pointed to a possible compromise of a DevOps engineer’s laptop and access through a service container.
The exchange estimated the total impact at about $6.3 billion and said blockchain partners had frozen about $3 billion in assets at that point. Binance said it had found no evidence that wallet private keys were leaked, temporarily suspended deposits and withdrawals, and would cover losses through its SAFU fund and company funds.
This was Binance’s preliminary account, not a final technical post-mortem. The possible access path should therefore be described as an early investigative finding, not an established final cause.
What does the reserve data say about ETH backing?
CoinDesk linked Binance 14 to the October 1 Proof of Reserves snapshot and estimated that ETH backing could be about 94% after the incident if the assets had not been replaced.
CoinDesk’s analysis found Binance 14 in the October 1 reserve snapshot and connected it to wallets later associated with the outflows. The publication reported that customer ETH liabilities were fully covered on the snapshot date and estimated that the withdrawal of roughly 204,500 ETH could reduce ETH backing to around 94% if the exchange had not replenished the asset.
This is a third-party estimate based on a specific snapshot, not Binance’s published post-incident balance. It should not be treated as a confirmed overall reserve ratio or proof that customers cannot access their funds. Binance said it would cover losses and publish updated Proof of Reserves after remediation.
What does Proof of Reserves confirm—and what does it leave out?
Proof of Reserves helps verify asset and customer-balance data at the time of a snapshot, but it does not provide a continuous, real-time view of reserves.
Binance describes a process that uses a snapshot of customer balances and cryptographic proofs, allowing users to check whether their balances were included in a report. The exchange also notes that a report reflects a particular point in time and may not match current asset holdings.
That makes the October 1 snapshot useful for understanding which wallets and assets were counted then, but it cannot by itself show how much remained after the October 29–30 incident. Updated post-remediation data is needed to assess the later position.
What can crypto platform operators learn from the incident?
The incident illustrates that reserve verification and wallet-access security address different risks, so platform operators need both kinds of control.
Proof of Reserves can help check reported assets and customer liabilities at a chosen date. Separate access controls and incident response are needed to address unauthorized transactions. Based on the confirmed information in this case, practical considerations include:
- Do not treat a reserve snapshot as real-time monitoring. Compare the report date with the date of an incident.
- Publish updated data after a material incident. Binance said it would do so after remediation.
- Separate established facts from preliminary findings. Until a post-mortem is available, describe the proposed access path as preliminary.
- Assess assets individually. An ETH backing estimate does not describe the exchange’s entire asset position.
These points do not establish which internal security controls Binance did or did not use: the reviewed sources do not include a completed technical report with such findings.
FAQ
Does the roughly 94% ETH backing estimate prove Binance was not fully backing customer assets?
No. It is CoinDesk’s calculation using the October 1 snapshot and estimated ETH outflows, assuming the assets had not been replaced. It is not a final post-incident audit or an overall ratio for all assets.
Did Binance confirm that wallet private keys were stolen?
No. In its October 30 update, Binance said it had found no evidence of a wallet private-key leak. It presented a possible DevOps laptop compromise as a preliminary investigative finding.
When will updated Proof of Reserves data be available?
Binance said it would publish updated Proof of Reserves after remediation. Its reviewed statement did not give a later specific publication date.
What is Proof of Reserves?
It is a way to report assets held by an exchange and verify that customer balances are included in a report at a particular time. Binance says its report is a snapshot, not a real-time display of assets.