Binance said on Friday that it expects to publish a full proof-of-reserves report by Monday 2 November, with preliminary results possibly earlier, as part of its response to the roughly $6.3 billion theft that began on 29 October (Winbuzzer, citing Binance’s statements; Cointelegraph). The company has also said it set aside more than $6.34 billion in company funds to cover customer losses, about $5 billion of it already held in the same tokens that were stolen. A reserves report is exactly the kind of document people will read as a verdict on whether customers’ money is safe. This guide explains what such a report can and cannot show, gives five checks to apply to any exchange’s version, and sets out in advance what we will look for in Binance’s, so that we are not tempted to grade it after seeing it.
What a proof-of-reserves report is, and what it is not
A proof-of-reserves report is a claim that an exchange holds at least as much of an asset as its customers collectively own. Done well, it has two halves: a list of blockchain addresses the exchange controls, with balances at a stated moment, and a record of customer balances, usually committed in a Merkle tree so that each customer can check that their own balance was included without seeing anyone else’s. Binance introduced a system of this kind for bitcoin holdings in November 2022, in the weeks after the FTX collapse (TechCrunch). It is a snapshot of solvency in one asset class at one time. It is not an audit of the company, a guarantee against future hacks, or a statement about how well keys, laptops and signing systems are protected. The 29 October incident is an example: by Binance’s own account, an attacker gained execution authority over a hot wallet using an Ethereum EIP-7702 delegation that bypassed its normal approval controls (Cointelegraph). A reserves report would not have shown that weakness in advance. It can only show whether, afterwards, customers’ claims are covered.
Check 1: Who verified it, and what exactly did they do?
Start with the author. A report published by the exchange itself is a claim; a report by an independent accounting or audit firm is a claim about a claim, and the wording of the firm’s engagement matters. Look for the phrases “agreed-upon procedures”, “attestation” and “audit”: they describe very different levels of assurance, and the first two usually cover only the procedures the exchange requested on one date. Ask whether the verifier saw the signing of the wallet addresses themselves, whether it had access to the customer ledger, and whether it states any limitation. A report with no named verifier, or a verifier whose scope statement is a single sentence, should be scored as unverified.
Check 2: Does it show liabilities as well as assets?
A list of wallets with a large balance proves only that the exchange holds a large balance. To prove reserves the report must also show what the exchange owes: total customer balances for each asset. The ratio is the number that matters. A reserve ratio of 1.00 means the exchange holds exactly what customers are owed; 1.05 means a 5% cushion; anything below 1.00 is a shortfall. The same asset can be a different story on each line: an exchange can hold 110% of customers’ bitcoin and 90% of their ether. For a hack where, according to Binance’s own timeline, 18,270 BTC left the bitcoin hot wallet and a transaction of about 167,464 ETH and 1.615 billion USDT followed (Winbuzzer), the key lines are those per-asset ratios after the theft, not the grand total.
Check 3: Can the exchange prove it controls the addresses?
Publishing an address is not the same as controlling it. Credible reports ask the exchange to sign a message with the key for each address, or to move a small, pre-announced amount, so an outside party can verify control. Without that, an exchange could list a wallet belonging to a partner or even a competitor. A related risk is borrowing: assets can be moved in for the snapshot and out again afterwards. Look for the same addresses appearing in reports across several dates, and compare exchange wallet balances in the days before and after the snapshot using a public block explorer. Sudden round-number deposits just before a snapshot are the classic warning sign.
Check 4: When is the snapshot, and what has happened since?
Every report is a photograph with a timestamp. The first question for Binance’s report is whether the snapshot falls before the theft (in which case it describes a balance sheet that no longer exists), after it (in which case it should reflect the losses and the replacement purchases), or in between. Binance has said it is buying the remaining tokens on the open market and over the counter to make customers whole, and has warned that thin liquidity and settlement times could delay some purchases (Winbuzzer). That makes the snapshot date decisive. A report dated before the replacement purchases will show a gap by design; a report dated after them is only as good as the proof that the new assets are real and held by the exchange. In either case, the date should be stated to the minute and in UTC.
Check 5: What is in the reserves, and who is on the hook?
The last check looks at the composition and at the loss allocation. Is a large share of the reserves the exchange’s own token, which may fall in value precisely when the exchange is under stress? Are customer assets segregated from company funds, or does one pool back both? Are any assets encumbered by loans, pledged as collateral, or frozen? The Binance case is full of the last category: Binance said verified freezes had reached about $3 billion, Tether said it froze more than 1.567 billion USDT, Circle froze 823 million USDC, and TRM Labs estimated that the attacker still held about $2.4 billion in ether and bitcoin (Winbuzzer; TRM Labs). Frozen is not recovered, and several third-party estimates of the stolen total differ (TRM about $6.36 billion, Chainalysis about $6.4 billion, Binance $6.3 billion). A trustworthy report states which of these are counted as assets, and at what value. Finally, ask who bears the loss. Binance has pledged to cover all losses from its emergency reserve (SAFU, which held 15,000 BTC, about $1 billion, after a February 2026 conversion) and company funds; a report should show that pledge as assets and liabilities, not only as a press-release sentence.
| Check | What good looks like | Red flag | What we know on 31 October about Binance |
|---|---|---|---|
| 1. Verifier | Named independent firm, scope and limits stated | Self-published, no scope | Report promised; verifier and scope not yet published |
| 2. Liabilities | Per-asset customer balances and ratios; Merkle-tree user check | Assets only; one total ratio | Not yet published |
| 3. Control of addresses | Signed messages or test transfers; stable addresses | Unverified address list | Not yet published |
| 4. Snapshot date | Stated in UTC; clear whether before or after the theft | Vague “recent” date | Binance has said “by Monday”; date unknown |
| 5. Composition and loss allocation | Own-token share, frozen assets, encumbrances and SAFU shown | Frozen or stolen coins counted at full value | $6.34B set aside, about $5B in the same tokens (Binance); frozen amounts overlap across sources |
Video: Coin Bureau’s explanation of how the Binance hack unfolded, published 30 October 2026.
Video: CNN’s report with expert reaction to the Binance theft, published 30 October 2026.
How to apply this on Monday
When the report appears, open it and answer five questions in order: who signed it, whether it lists customer liabilities by asset, whether the addresses were proved with signatures, what the snapshot date is, and how the losses, frozen coins and the pledged $6.34 billion appear. Write down the answers before reading any headline about it. Score each check as clear, partly clear or unclear, as we did in Field Guide #70 on exchange-hack headlines (Binance scored 0 of 5 clean on the numbers in the first 24 hours). We will publish the score for the Binance report once it is out. For stablecoin reserves, which have their own attestation conventions, see Field Guide #33; for how to vet a custodian before you hand it coins, see Field Guide #61; and for what happened to bitcoin after similar exchange halts, see our study of eight exchange hacks and halts.
What a good report still cannot do
Even a clean report is a point-in-time statement. It does not show how the company is run, whether withdrawals are honored in a crisis, or whether the next incident will arrive through a laptop, a delegated signature or a vendor. Binance has said withdrawals could resume within about 40 hours of Richard Teng’s Friday update, which would be around Sunday 1 November, and that a full technical post-mortem will follow when the investigation ends. Those events, not the reserves report alone, will tell you whether the exchange is operating normally. The practical lessons stay the same: do not keep more on any exchange than you can afford to have frozen, withdraw what you do not need to trade, and prefer self-custody for long-term holdings. Binance’s trading day on Friday and the market’s reaction are covered in today’s market report.
Sources: Winbuzzer, Cointelegraph, TRM Labs, Elliptic, TechCrunch (2022). Figures attributed to Binance are its own statements and had not been independently verified when we wrote this.
Method: bitcoin prices, highs, lows and closes are Coinbase Exchange candles (UTC day or UTC hour) pulled by Bitcoin Mastery at about 07:05 UTC on Saturday 31 October 2026; the 31 October candle is still open at that time, so any daily close quoted is the 30 October close (77,180.42) unless stated. Index, gold and monthly figures are Yahoo Finance daily closes (US cash-session closes for the Nasdaq Composite, Friday 30 October). Third-party figures are attributed to their source and date. This guide describes a method; the Binance column in the table reflects public reporting up to the morning of 31 October and will change when the report is published.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.