Binance says 95% bought back. What will its next reserve proof show?

Binance reported buying back about 95% of its lost assets before withdrawals restarted. A reserve snapshot planned for 4 November could show coverage for more tokens. It cannot verify the buyback figure.

Both of Binance's recovery figures predate the restart of withdrawals. It posted the 95% repurchase figure at 04:11 UTC on 1 November. Its proof of reserves used a snapshot from 00:00 UTC on 31 October. Withdrawals restarted at 06:00 UTC on 1 November.

The proof covers ten tokens: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Binance says the missing 5% "consists of tokens not included in the top ten", which are "less liquid" and "take longer to source at the required scale".

The next proof's token list will determine how much new evidence Binance provides on their reserve coverage. The 95% repurchase figure cannot answer that question.

What the 95% measures

Hot wallets were compromised about 29 October, and Binance confirmed the theft of around $6.3bn, with about half of it frozen. Withdrawals were halted for about 48 hours, according to Reuters. Binance's pledge is plain: "Binance will absorb the financial impact of the stolen funds, not our users."

The 95% is a measure of buying, not of coverage. Binance's updates moved from about 80% to about 90% to about 95% in two days. The figure counts how much of the impacted assets Binance has repurchased. It does not compare reserves with what customers are owed in each token, and the two measures answer different questions.

How much has left since the restart

Customers began withdrawing as soon as the service restarted. Binance said that between 06:00 and 15:30 UTC on 1 November it processed $4.649bn of withdrawals and $1.01bn of deposits.

That is a net outflow of about $3.64bn, equal to 2.1% of the $171bn in the pre-hack 28 October proof. The comparison shows scale against the earlier asset base, not the exchange's available post-hack liquidity. Binance said that by 12:36 UTC withdrawals had resumed on all 15 networks and assets in the first phase.

The figure has since grown. Reuters reported that net withdrawals since reopening reached $4.72bn, and Binance said that was about 3% of assets.

Binance also told Reuters of $2.7bn of customer inflows since Sunday and said most withdrawals were in USDT. Reuters gives no cutoff time for the $4.72bn, so the extra $1.08bn over the first print may reflect a longer window.

Why DefiLlama shows bigger numbers

DefiLlama shows larger and shifting numbers because it measures something else. It tracks balance changes in on-chain wallets, which include hack-day movements, over rolling windows.

Cointelegraph quoted a 24 hour net outflow of $5.8bn and later "more than $7 billion". At 15:45 UTC on 2 November the tracker showed 24 hour flows of minus $3.29bn, seven day flows of minus $13.35bn, and assets of $127.78bn.

Those readings do not form a single series. The $127.78bn in tracked wallets and the $171bn in the proof cover different dates and assets. Their $43bn difference does not represent missing money.

A falling 24 hour figure shows that the window has rolled on, not that customers have returned.

Binance describes the flows as settling. Its post says volumes "have declined and are stabilising" and that "market conditions are stable". HashKey's Tim Sun said the outflow "has not yet triggered widespread panic".

Neither statement is a measurement. Comparable daily figures for processed withdrawals and deposits would show whether net outflows are slowing, and whether lower withdrawals or higher deposits drive the change. They would not by themselves establish customer confidence or the adequacy of reserves. Binance has published only two windows so far.

Funding and the SAFU fund

A separate question is how Binance funds the recovery. Binance said it set aside more than $6.34bn of company funds. Reuters reported $6bn from the corporate treasury, an insurance fund and breach reserves, and CTOL does not add the two figures together.

About $3bn of stolen assets was frozen by industry partners including Tether and Circle. Frozen stolen tokens are not reserves that customers can withdraw.

The SAFU emergency fund's Bitcoin wallet fell to about 7,500 BTC, roughly $583m, from about 15,000 BTC after a 7,499 BTC transfer on Saturday. That is a wallet movement, not a measure of spending on replacement purchases or withdrawals. SAFU policy calls for a rebalance to $1bn if value falls below $800m, and sets no timeline for replenishment.

Binance also widened the restart. It added fiat withdrawals in US dollars, dirhams, dong, pesos and rupiah on 2 November.

What the proof can and cannot show

The proof also has limits. Binance says it is a zk-SNARK proof and that the ten tokens are verifiable at "a minimum of 1:1", and calls them fully backed at 100%. A snapshot taken before the restart shows nothing about withdrawals made after it.

CTOL's view is that Binance has reopened withdrawals and reports heavy replacement buying. It has not yet shown that customer claims in the non-top-ten tokens are backed. That is a limit of the evidence so far, not evidence of a deficit.

On CTOL's arithmetic, 5% of the $6.3bn stolen would be about $315m, if the impacted amount equals the amount stolen. Binance gave no dollar figure, so that is an illustration, not a shortfall.

Watch the next proof. Binance plans another withdrawal phase on 3 November and a new snapshot covering more tokens on 4 November. Preparing the proof takes 40 to 50 hours, so the report is not due before about 5 November.

If the report includes the relevant non-top-ten tokens and shows at least 1:1 reserves against customer liabilities, it would establish reported coverage for those tokens at that snapshot. If it omits them, the coverage question stays open. Even a clean result would show backing on one date, not future liquidity or a full account of the loss.