Binance Reserve Report Faces Scrutiny After Hack
Binance is preparing to publish a proof-of-reserves report on Monday, November 2, after disclosing that an attack on a hot wallet resulted in the loss of token assets worth approximately $6.3 billion. The pending report has become a focal point for unconfirmed inside-job allegations circulating on X, according to Bitcoin.com News.
Binance has said it is replacing the lost assets with company funds and working with outside parties to freeze assets on-chain. At the same time, reporting from BTCMedia points to a different account of the attack timeline and attributes the theft to TraderTraitor, a North Korean hacking group.
What happened
In an October 30 post, Binance said its hot wallet was attacked at approximately UTC+8 on October 30, 2026. The exchange said the incident led to the loss of token assets valued at approximately $6.3 billion.
Binance said it had set aside more than $6.34 billion in company funds to address the loss. More than $5 billion of that amount was in corresponding tokens, including USDC, USDT, BTC, ETH and BNB, which Binance said replenished approximately 80% of the stolen funds.
The exchange also said approximately $3 billion in assets had been frozen on-chain. Binance attributed that result to cooperation with law enforcement, blockchain firms, issuers and industry partners.
Binance said it would take its first proof-of-reserves snapshot within 12 hours and publish the results by Monday, November 2. The stated purpose of the report is to show that its holdings back user balances.
Bitcoin.com News reported that claims framing the breach as a possible inside job were spreading on X as the reserve report approached. Those claims are unconfirmed social-media speculation. Neither Bitcoin.com News nor Binance presented evidence in the reported information establishing that the attack involved Binance personnel.
BTCMedia reported a separate assessment from TRM Labs, which estimated that the attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains beginning at UTC on October 29. BTCMedia said TRM Labs and Chainalysis attributed the attack to TraderTraitor with high confidence.
Why it matters
The proof-of-reserves report is central to Binance’s public response because it is intended to address whether customer balances remain backed after the reported loss. Binance has positioned the snapshot as a verification of holdings rather than simply an update on its replacement-fund efforts.
The size of the reported loss and the scale of Binance’s stated response make the distinction significant. Binance said it had covered approximately 80% of the stolen funds through company resources, while it planned to complete purchases of the remaining replacement tokens before the reserve report is issued.
The report will also arrive while withdrawals are suspended and deposits continue. That operational setting places particular attention on Binance’s statement that customer assets are being protected through its Secure Asset Fund for Users, known as SAFU, and its corporate treasury rather than through user funds.
There are differences in the figures and timeline described by the available accounts. Binance reported a loss of approximately $6.3 billion, while TRM Labs estimated roughly $6.36 billion moved from Binance wallets. Binance said approximately $3 billion had been frozen, while outside estimates cited roughly $2.7 billion frozen.
Those differences do not by themselves establish competing explanations for the incident. They do, however, leave several elements that users and observers may seek to reconcile when Binance publishes its reserve information and further details about the attack response.
Background and context
Binance is covering the loss through SAFU and its corporate treasury, rather than users, according to the stated recovery approach. The exchange has suspended withdrawals while allowing deposits to continue.
The planned Monday proof-of-reserves report is presented as independent verification that customer balances are fully backed after Binance completes the purchase of the remaining 20% of replacement tokens. Binance’s October 30 statement described the report as a way to demonstrate holdings backing user balances.
Bitcoin.com News characterized the online inside-job discussion as skepticism surrounding the timing of the reserve disclosure. The available reporting does not confirm those allegations. By contrast, BTCMedia reported that TRM Labs and Chainalysis linked the theft to TraderTraitor, a North Korean hacking group, with high confidence.
The two narratives should not be treated as equivalent evidence. One consists of unverified claims spreading on a social platform, while the other is an attribution reported from blockchain analytics firms. Binance’s own statement focused on the hot wallet attack, replacement funds, frozen assets and the forthcoming proof-of-reserves process.
What to watch
The main immediate question is what the Monday proof-of-reserves publication contains and whether it demonstrates the holdings Binance says back customer balances. Binance said the snapshot would follow efforts to replenish the stolen assets.
Further clarification may also be needed on the apparent timing difference. Binance placed the hot wallet attack at approximately UTC+8 on October 30, while TRM Labs, as reported by BTCMedia, said transfers began at UTC on October 29.
Another open question is whether Binance or the outside organizations involved provide updated figures for frozen assets. Binance’s approximately $3 billion figure differs slightly from outside estimates of roughly $2.7 billion.
Finally, Binance may provide additional information on the operational status of withdrawals and on the progress of its cooperation with law enforcement, blockchain firms, issuers and industry partners. The current record does not substantiate the inside-job claims circulating on X.
