• Binance co-CEO Richard Teng says a full proof-of-reserves report is targeting Monday, with withdrawals still suspended.
  • The exchange has earmarked more than $6.34 billion of company funds against a reported $6.3 billion cyberattack, while roughly $3 billion of affected assets has been frozen.
  • The central question is whether the disclosure will show restored, token-by-token backing for customer balances — not merely funds set aside.

A Verification Milestone, Not a Clean Bill of Health

Binance's promise to publish a proof-of-reserves report by Monday is emerging as the first hard test of whether the world's largest crypto exchange can demonstrate it has made customers whole after a reported $6.3 billion breach — a figure that alone exceeds the $2.9 billion TRM Labs estimates attackers stole across nearly 150 incidents in all of 2025.

Teng's published transcript describes the disclosure as "targeting Monday," which would be November 2 — wording notably softer than the headline commitment to a "full" report by Monday. As of October 30, 10:39 a.m. EDT, that report had not been published. The distinction matters: publishing a reserve snapshot is a verification milestone, not confirmation that the losses have already been repaired.

The exchange says it has earmarked more than $6.34 billion of company funds to cover the damage, a figure that includes $5 billion already held in the tokens affected by the theft. Binance is purchasing the remaining tokens through exchanges and over-the-counter transactions, a process that thin liquidity and settlement times could drag out. The allocation excludes frozen or protected assets, according to the company.

Withdrawals remain suspended. Binance has said it expects to restore them within 48 hours — a recovery target, not a confirmation of reopening. Deposits were reported as unaffected.

Frozen Is Not Recovered

Roughly $3 billion of affected assets has been frozen, but investigators and analysts caution that freezing prevents further movement of funds without establishing that Binance can immediately deploy them to satisfy customer withdrawals. The gap between immobilized and recovered assets is likely to be a focal point of Monday's disclosure.

Investigators initially identified a potentially compromised engineer's laptop, but Binance subsequently reported additional breach points. Teng has rejected characterizations of the incident as a simple "one-click" attack. TRM Labs, Chainalysis and Elliptic have attributed the theft to North Korean-linked attackers with high confidence — an analytical attribution, not a company finding. Binance says its own investigation has not yet identified the attackers, and North Korea routinely denies involvement in crypto theft.

Binance is working with the FBI and U.S. Secret Service on the probe, according to a person familiar with the situation. Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating licence, says it is engaging closely with the exchange and monitoring the incident. Binance declined to comment beyond Teng's published remarks. A spokesperson for the FBI did not immediately respond to a request for comment.

Market Stress and the Liquidity Test

The immediate fallout has been global crypto-market stress rather than a demonstrated shock to the wider economy. Bitcoin touched a six-week low of $76,368, while ether fell more than 3% to a two-month low of $2,178 before markets stabilized. BNB also declined, and listed crypto-exchange shares came under pressure.

The incident landed amid existing pressure from higher U.S. interest rates and softer demand from exchange-traded-fund buyers, potentially amplifying the confidence shock. Binance's replacement purchases add another market force: buying affected tokens may support demand, while low liquidity can make restoring exact token balances slower or more expensive.

Tim Sun, a researcher at HashKey (3887.HK), warned the breach could further reduce risk appetite and prompt investors to reassess centralized-exchange custody. Moody's (MCO) analyst Cristiano Ventricelli said wider credit consequences depend on ultimate losses, affected counterparties, recoveries and whether confidence deteriorates across the digital-asset ecosystem.

The financial issue is liquidity as well as loss absorption. Binance's emergency Secure Asset Fund for Users, or SAFU, is described as a roughly $1 billion bitcoin reserve — substantially smaller than the reported theft. Company resources and recoveries therefore matter alongside the emergency fund.

A Reserve Report Is Not an Audit

Binance's reserve reporting has precedent. In December 2022, a Mazars assessment reported 101% bitcoin collateralization; accounting expert Francine McKenna emphasized at the time that the exercise was not a full financial audit — a distinction that remains relevant to Monday's promised disclosure. Proof-of-reserves can help verify specified customer backing but does not establish a company's complete liabilities, profitability or unrestricted liquidity.

A CoinDesk review of Binance's October 1 reserve disclosures found that affected wallets backed customer balances and estimated ether backing could have fallen to roughly 94% before replacement — an analysis based on a pre-attack snapshot, not a verified current ratio.

The attack also has precedents closer at hand. TRM says the Binance breach resembles the 2025 attack on Bybit that the FBI attributed to North Korea. In September 2026, approximately $350 million was reportedly stolen from Bitget, and Chainalysis says proceeds from that attack are being mixed with funds from the Binance breach. Tether, Circle (CRCL), Ripple and World Liberty Financial helped freeze substantial sums in the current incident, demonstrating the recovery value of issuer controls while highlighting that some crypto assets can be centrally restricted.

Binance remains the world's largest cryptocurrency exchange, with Reuters (TRI) reporting approximately 335 million registered users and about $162.8 billion in assets under custody in its 2025 annual report — customer assets that are distinct from company-owned capital available to absorb losses. The 2025 report disclosed $34 trillion in trading volume, including more than $7.1 trillion in spot trading; these are activity measures, not revenue or profit. The sources reviewed do not establish a recent, independently audited consolidated earnings figure.

Teng and co-founder Yi He serve as co-CEOs, with Yi He appointed to the role in December 2025. Both are leading public communications on replacement assets and customer protection. No new leadership departure or restructuring directly resulting from the attack has been reported.

The compliance backdrop is already complicated. Binance's 2023 U.S. settlement imposed extensive oversight commitments, and reporting published October 23 describes a Justice Department investigation into whether the exchange breached that agreement. Separately, the SEC dismissed its civil case in May 2025 — a dismissal that did not resolve every other regulatory or criminal-compliance issue.

What Monday Needs to Show

For customers, the distinction is between a promise to honor account balances and the present ability to withdraw assets. Binance's compensation pledge is significant, but withdrawal restoration and demonstrable replacement of stolen assets are the practical tests.

In the short term, the most consequential evidence will be whether withdrawals actually resume and remain operational; whether affected balances are fully backed token by token; whether replacement assets are available rather than merely earmarked; whether frozen funds have been returned rather than simply immobilized; and the report's snapshot date, scope and independent verification arrangements.

Longer term, the likely pressure points are stronger transaction-authorization controls, more demanding reserve disclosures and renewed scrutiny of centralized custody. Those consequences remain conditional: successful replenishment and normal withdrawals could limit the damage, while incomplete backing or prolonged restrictions would deepen the confidence problem flagged by HashKey and Moody's.

This is a developing incident. Loss estimates, recovery figures and service availability may change.

Correction: An earlier version of this article misstated the timing of Yi He's appointment as co-CEO. It was December 2025, not December 2024.