Binance has published a new zero-knowledge proof-of-reserves snapshot for 10 major assets while it works to restore withdrawals following an attack that reportedly moved more than $6 billion from the exchange's systems. The update is central to Binance's effort to contain withdrawal pressure by giving customers a way to verify that balances for selected assets are backed on a 1:1 basis.
The snapshot covers Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash, Binance said. Users holding those assets can independently check whether their account balance was included in the exchange's cryptographic reserves calculation without publicly revealing their individual holdings.
Binance CEO Richard Teng said the exchange had replenished roughly 95% of assets affected by last week's attack using company funds. The remaining 5% consists of less-liquid tokens that Binance is still seeking to obtain, according to the recovery update.
The exchange plans to take another reserves snapshot on Wednesday and expects to begin progressively restoring withdrawals for further assets and blockchain networks on Tuesday. That timeline leaves customers dependent on a staged reopening process rather than an immediate return to normal transfers across the platform.
Proof-of-reserves update covers major customer assets
Zero-knowledge proof systems allow an exchange to demonstrate that a set of customer liabilities has been included in a calculation without exposing the underlying customer data. In Binance's case, the system is intended to let users verify that their balance appears in the snapshot while comparing the exchange's recorded reserves against aggregate customer obligations.
Such a proof can provide a useful check on whether listed assets are represented in the exchange's reserve structure at a particular time. It does not, by itself, resolve operational questions around the security of wallet infrastructure, withdrawal availability or the recovery of assets outside the 10-token snapshot.
Teng said users can independently verify the updated proof and that recovery work remains underway. Binance estimated that producing the full proof after a snapshot requires around 40 to 50 hours, citing the number of tokens included in the calculation.
The delay between a snapshot and a completed proof is relevant during a fast-moving recovery. A reserves report offers a view of balances at a defined point in time, while withdrawal queues, wallet repairs and attempted laundering can continue changing the exchange's operational position after that point.
Withdrawals reopen as net outflows ease
Binance's withdrawal plans follow substantial customer outflows after the attack. Blockchain-data platform DeFiLlama recorded approximately $3.29 billion in 24-hour net outflows, down by more than half from an earlier peak near $7 billion.
The figures indicate that the initial rush to move funds has moderated, though Binance remains in the middle of restoring access rather than operating under routine conditions. A separate estimate published by WuBlockchain placed assets in Binance-linked onchain wallets at about $127.78 billion. That wallet-based figure should not be treated as a full measure of all customer liabilities or the exchange's complete balance sheet, but it provides a view of funds visible on public blockchains.
Another set of figures in the recovery coverage said users withdrew $4.65 billion and deposited $1.01 billion by Sunday afternoon, leaving net outflows of around $3.64 billion. The same account compared that movement with $171 billion in assets under management. The differing numbers reflect separate measurement periods and methodologies, underscoring why a scheduled proof-of-reserves snapshot is more useful as a point-in-time verification tool than as a live measure of withdrawals.
For customers, the immediate practical issue is whether their particular token and network are available during the phased reopening. A balance can appear in a reserves proof while withdrawals remain unavailable if the relevant wallet, network connection or security controls have not yet been restored.
Investigators trace laundering across blockchains
Onchain investigators have attributed the exploit to North Korean attackers who allegedly compromised internal systems and wallet-signing mechanisms. Wallet-signing systems authorize blockchain transactions, making them a critical target for attackers seeking to move funds held in exchange-controlled wallets.
The attackers allegedly dispersed more than $6 billion across several blockchains after the breach. SomaXBT reported on Sunday that about $242 million of the stolen funds had been laundered through the Tron network.
Public blockchain records cited in the recovery coverage also showed the movement of 486,970 stolen SOL, valued at approximately $46.4 million, in transactions intended to convert the holdings into Bitcoin. The attackers were said to have used decentralized swap services including Relay and THORChain, tools that can move assets between networks without relying on a centralized trading venue.
The reported use of cross-chain infrastructure complicates recovery because stolen funds can be broken into smaller transfers, exchanged into different tokens and routed through networks with distinct monitoring capabilities. Some recovery efforts have focused on freezing funds before they reach services able to convert them into fiat currency or more liquid crypto assets.
The materials provided said federal agencies and corporate partners had frozen approximately $2.85 billion of stolen cryptocurrency. They also estimated that attackers still controlled roughly $3.24 billion across primary addresses, largely in Bitcoin and Ether that had not yet entered more complex laundering routes. Those estimates may change as investigators identify additional wallets and track new transfers.
Binance faces a security and liquidity test
Binance's claim that it used corporate funds to replenish affected balances places the immediate financial burden of the attack on the company rather than on customer accounts covered by the recovery effort. The new proof snapshot is designed to support that claim for the listed assets, while the exchange continues acquiring less-liquid tokens needed to complete its reported replenishment.
The reopening schedule will be a more direct test of the recovery than the snapshot alone. Each restored network gives customers an option to transfer funds, but it also requires Binance to ensure that wallet-signing controls and transaction-monitoring systems are secure after an attack centered on those functions.
Customers with assets outside the 10-token proof, or tokens on networks still under maintenance, will need to wait for Binance's additional recovery notices. The planned Wednesday snapshot and Tuesday withdrawal expansion should provide the next measurable checkpoints in an incident that has shifted from the initial theft to the harder work of restoring routine access without reopening the same security gaps.
After Binance’s $6B hack, tighten your defenses—learn key protection steps in this security guide.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
