Let me put the conclusion first: Binance had already turned in its proof-of-reserves exam yesterday—but it answered only ten questions, and the rest of the questions haven't been released yet. What actually happened today (November 3) is that Phase 2 withdrawals began to resume. Confusing these two things is the easiest trap to fall into these days.
First, a correction to something I said last night. In my late-night post, I said the full zero-knowledge proof of reserves was due on November 3, based on Binance's earlier timeline. Here's what actually happened: Binance's November 2 Recovery Update #5 had already announced that the zero-knowledge proof for the October 31 snapshot was complete, and that users could check their balances using the verification tool. Today's Update #6 is not about the proof; it's about Phase 2 withdrawals—from noon today, Beijing time, more assets will gradually be restored network by network, covering nine networks including BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, Tron, and Base. But they won't all reopen at once: each asset on each network must pass security checks. Get the date wrong by one day, and the whole assessment is wrong, so let me put this correction up front.
So what, exactly, does this submitted report prove? We need to look at it as three separate pieces of paper. Treat them as one, and it’s easy to be misled.
The first piece of paper is a snapshot. At midnight UTC on October 31, Binance took a snapshot of its assets and liabilities: reserves for ten tokens—BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC—were at least 1x user balances. In the snapshot, BTC was at 100.04%, BNB at 101.30%, and USDC at 106.08% (snapshot figures cited by AInvest). Pay attention to that 100.04%: it passed, but with almost no margin. The tolerance here isn’t “plenty of room”; it’s “just over the line.” A snapshot is a freeze-frame. It speaks only to that moment at midnight on October 31—not to what happened after the withdrawal surge on November 1, and not to today.
The second piece of paper is the proof. The snapshot says, “the total is sufficient.” Zero-knowledge proofs and a Merkle tree address a different question: was your balance included in that total? Users can check Binance’s verification tool to see whether their balance is included in the snapshot’s total liabilities, without revealing their account details. That’s what this proof genuinely adds: before, the exchange was the only one making claims about the total; now, each user can verify their own line. The 40 to 50 hours of computing went into this: compressing the balances of tens of millions of accounts into a structure that can be verified without exposing private information.
The third piece of paper is the one that’s missing: a complete balance sheet and an audit. The proof covers only ten tokens and speaks only to the snapshot date; it is not an audit of the exchange’s overall financial condition (the official position cited by TradingView acknowledges this too). It doesn’t answer three questions: First, what is the current status of assets outside those ten tokens? Second, do the exchange’s total liabilities—including off-balance-sheet positions such as derivatives, lending, and market making—exceed its reserves? Third, how much has the compromised part of the signing infrastructure actually been fixed? PoR answers “is the money there?”, not “will the people guarding it open the door again?” This tool was created after FTX to answer the first question. Don’t overload it by expecting it to answer the second.
Now let’s look at two other sets of figures that are still in motion today. Don’t let “proof submitted” obscure them.
One set tracks replenishment: the figure of about 95% hasn’t moved since November 1. The remaining roughly 5% consists of less liquid tokens outside the ten covered by the proof, which are still being bought gradually on the market and over the counter. The 95% refers to the amount affected, according to the exchange’s own figures; it wasn’t verified by the proof itself. The proof verifies a 1:1 ratio for the ten tokens, not “what proportion of the $6.3 billion stolen has been replenished.” The two percentages have different denominators—don’t mix them up.
The other set concerns the cost to SAFU. Cointelegraph reported that Binance transferred 7,499 BTC out of SAFU on October 31. The publicly disclosed SAFU Bitcoin wallet fell from about 15,000 BTC to about 7,500 BTC—roughly $583 million, cut in half—with no replenishment deadline announced. SAFU is an emergency fund, and this time it was real money put up front. Whether an emergency fund can cover a second incident, and how long it would take to replenish, are questions for the next exam—not questions answered by this proof.
The figures from the second phase of withdrawals also need to be read in context. During the first nine and a half hours of phase one on November 1, withdrawals totaled $4.649 billion and deposits $1.01 billion, for net outflows of $3.64 billion. The outflow rate then slowed (according to DefiLlama; multiple sources cited net outflows of about $2.57 billion on Monday, but the measurement window differs from the first nine and a half hours of day one, so the figures cannot be directly compared as points on a single curve). The trend is “the doors are open, people are leaving, but they’re leaving more slowly”—not “the run is over.” Assets in phase two were released in order of user demand over the past week. That itself is a signal: the assets people are most urgently asking for are being released first, not the ones easiest to release.
My framework is called the “three-paper comparison method.” You can use these three pieces of paper to assess any exchange’s proof of reserves:
First, ask when: What date and time was the snapshot taken, and did the withdrawal surge happen before or after it?
Second, ask what’s covered: How many tokens does the proof cover, what proportion of user assets do they represent, and how is the rest accounted for?
Third, ask how it can be verified: Can users check their own line, or can they only see the total published by the exchange?
Only when all three pieces of paper are in place can you say, “This exchange’s books check out for now.” If any one is missing, all you can say is “they check out in part.” In this case, Binance has the first and second pieces; the third is missing; replenishment is still 5% short; and SAFU has been cut in half and remains to be replenished. That’s a state of “checks out in part, still in progress,” not “back to normal.”
Let’s honestly lay out the risks and the evidence pointing the other way.
First, frozen doesn’t mean recovered. Issuers froze roughly $2.7 billion to $3 billion in stablecoins, depending on the source. Elliptic estimates that attackers still hold about $3.28 billion, mainly in BTC and ETH. The frozen portion is “unable to move,” not “back in our hands.”
Second, attribution doesn’t mean the case is closed. The FBI has attributed the attack to North Korea’s TraderTraitor group, but one fact remains: the compromised part was the signing infrastructure, not users’ passwords or private keys. A full technical postmortem is still pending. Until it’s published, “fixed” can only be described as a work in progress.
Third, withdrawal reopening periods are prime time for scams. Binance warned today that scams are appearing, including “paid withdrawal acceleration,” “compensation claims,” and “Binance vault” offers. Official withdrawals are handled only through the app and the withdrawal page on the official website. Anyone asking you to pay first or click an unfamiliar link to “speed things up” is a scammer—the most valuable thing during a recovery period isn’t the coins, it’s people’s anxiety.
One final thought: a proof of reserves isn’t an exchange’s graduation certificate. It’s one answer sheet from a midterm: ten questions were answered, and answered correctly, but the exam isn’t over. The next test date is already set: on November 4, Binance will take a new snapshot covering more tokens, then spend another 40 to 50 hours generating the proof. When that happens, we’ll use the three-paper comparison method again.
One real question to leave you with: will you use the verification tool to check your own line? If you find that it’s included, will you trust the exchange a little more—or do you think this is simply what an exchange should do? Share your thoughts in the comments.
One article a day, each one unpacking a single issue in depth. Yesterday was a pre-submission checklist; today was a guide to reviewing the results. See you tomorrow.
No calls to buy or sell—just doing the math.
$BTC $BNB