Binance's proof of reserves is done — and phase two of withdrawals is open

Binance has cleared the test it set itself after the largest crypto theft on record — and opened the next stage of getting customers' money out. The exchange said on November 2 that it had finished the full zero-knowledge proof of reserves for its October 31 snapshot, so holders of ten major tokens can now check for themselves that their balances are backed at least one-to-one. Then, at 04:00 UTC on Tuesday, November 3, it began a second phase of withdrawal restorations across nine blockchain networks.

The proof covers bitcoin, ether, USDT, USDC, BNB, Solana, XRP, USD1, RLUSD and Zcash — the same ten assets Binance had already said were fully backed in the October 31 snapshot, taken at 00:00 UTC, two days after attackers drained about $6.3 billion from its hot wallets on October 29. The system pairs a Merkle tree, which shows each user that their own account was counted, with a zk-SNARK, a cryptographic proof that total reserves cover what users are owed without revealing anyone's balance. Binance's co-CEO Richard Teng announced the completed verification, and the exchange said users can check their balances through its reserve verification system.

The second withdrawal phase covers additional cryptocurrencies on BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base, including stablecoins, major coins and smaller tokens. It follows phase one, which reopened withdrawals on Sunday, November 1, for 15 networks and assets — a day on which Binance processed $4.649 billion in withdrawals against $1.01 billion in deposits, a net outflow of $3.64 billion that it said was 2.1% of the $171 billion in its October 28 proof-of-reserves data.

Binance also repeated its replenishment claim: about 95% of the affected assets have now been replaced from company funds, up from about 90% on October 31, with the remaining 5% sitting in less liquid tokens that take longer to buy back. A fresh, broader snapshot is planned for November 4, covering more tokens — but the accompanying proof will take another 40 to 50 hours of computing, according to co-CEO Yi He, so verification of that snapshot will not land immediately.

What the proof does not do matters as much as what it does. It is a snapshot of one moment, October 31 — before the November 1 withdrawal wave, and before this week's second phase. It covers ten tokens, not the hundreds of smaller assets still being restored, and it says nothing about the exchange's other liabilities. Data from analytics platform DefiLlama, cited by Bitcoin.com, shows Binance's tracked exchange assets falling from about $144.9 billion on October 29 to roughly $128.3 billion early on November 2 — a different measure from Binance's own $171 billion total, reflecting falling token prices as well as withdrawals, but the same direction: a smaller exchange than before the hack.

For ordinary users, the practical meaning is simple. If you hold one of the ten covered tokens, you can now verify your own balance is in the tree. If you hold anything else, you are still waiting on the November 4 snapshot and the phased reopening — and on Binance keeping its word that the last 5% of stolen assets will be bought back.

What to watch: the November 4 snapshot and how many new tokens it covers; whether phase-two withdrawals run smoothly; and whether tracked exchange assets stabilise or keep shrinking.