Binance Confirms Full Asset Coverage from $6.3 Billion Hack; Proof of Reserves Underway

Binance Compensates Users After $6.3 Billion Hack

In a significant update regarding the $6.3 billion hack that occurred in October, Binance has confirmed that it has fully compensated users for their lost assets. The cryptocurrency exchange made this announcement on November 12, revealing that it has published a fresh snapshot for its Proof of Reserves. However, users are still waiting for the associated zero-knowledge proof, which will enable them to verify that their found assets are backed at a minimum ratio of 1:1. While Binance expressed appreciation for user patience, it did not specify when this verification step would be finalized or provide a detailed account of the assets involved.

Funding Strategy and Recovery Efforts

Following the security breach, Binance released an update on October 31, detailing its funding strategy for recovering the losses. This included utilizing the Secure Asset Fund for Users (SAFU), the company's Futures Insurance Funds, and its corporate treasury, with over $6.34 billion allocated to this initiative. As part of its recovery efforts, replacement coverage rose to around 90%. Binance clarified that its futures insurance reserves are comprised of company funds distinct from customer assets, with a portion of the transferred sums derived from surplus balances above its risk framework thresholds.

Furthermore, Binance pledged to restore SAFU to approximately $1 billion, yet the latest announcement did not confirm the completion of this commitment or elaborate on the specific allocations among the funding sources. By November 4, the company noted that replacement coverage had surged to nearly 98%, although difficulties in sourcing remaining tokens persisted due to liquidity constraints. The exchange indicated that replacement assets were being acquired via various channels, but notably, it did not assert that all stolen cryptocurrency had been recovered.

Verification and Transparency Measures

Earlier verification efforts by Binance included a snapshot from October 31, where it validated its reserves for ten cryptocurrencies, encompassing major assets such as Bitcoin, Ethereum, USDT, BNB, Solana, and XRP. A subsequent verification on November 4 broadened this scope to encompass 44 different tokens. The exchange projected a timeframe of 50 to 60 hours for generating the necessary proof, referencing the computational demands involved.

To further ensure transparency, Binance employs a Merkle tree system that allows users to cross-check their account balances against the reported totals without compromising individual holdings. Customers can access their Merkle leaf and record ID in the verification section of their accounts, displaying their account balances at specific checkpoints.

Market Impact and Regulatory Context

A retrospective examination of Binance's reported USDT holdings illustrates a decrease of nearly 8% from October 1 to October 31, dropping to 29.48 billion tokens. Similarly, Ethereum holdings fell by 3.8% to 3.65 million ETH, contrasting with a slight uptick in Bitcoin reserves. The reserve coverage for USDT shifted from over 103% to exactly 100%, while Bitcoin maintained a coverage figure slightly above 100%.

On November 1, following the resumption of withdrawals, Binance experienced substantial net outflows, reporting $4.649 billion in withdrawals against $1.01 billion in deposits during the first 9.5 hours. Additionally, a report by Santiment noted a significant net outflow of approximately 28,316 BTC from Binance-associated wallets following the hack.

In a broader context, the Public Company Accounting Oversight Board (PCAOB) in the U.S. has specified that Proof of Reserve (PoR) reports differ from traditional financial audits. Their March 2023 advisory indicates that these reports reflect asset levels at a particular moment but do not guarantee the existence of liabilities, customer rights, or internal control effectiveness. The advisory further emphasizes that PoR engagements do not comply with PCAOB's inspection and auditing standards, underscoring the need for caution regarding the interpretation of such reports.