By comparing the balances on October 1st and October 31st, it is possible to see the changes in this exchange's liabilities and reserves after being attacked on October 29th: at that time, hackers transferred approximately $6.3 billion from their wallets across 10 blockchains.
After the attack, Binance immediately suspended withdrawals and deposits. Therefore, the increase in the balance of Ripple related assets occurred before the hacker incident. The data for October is as follows:
XRP: Customer liabilities increased by 20.84 million coins in the current month, from 2,495,533,677 coins to 2,516,373,182 coins. Binance wallet and custodians currently hold 2,541,393,612 XRP coins.
RLUSD: The most significant inflow came from this new stablecoin, with user balances increasing from 139.53 million to 201.89 million RLUSD. Binance increased its reserves to 203.56 million RLUSD.
How does Binance fill the gap?
An even more important point in the report is that Binance confirmed that all ten of the most actively traded assets, including BTC, ETH, USDT, BNB, and SOL, were fully covered, and this confirmation was made just two days after the hack attack.
With the assistance of partners including Tether, Circle, and Ripple, approximately $3 billion of the stolen funds were quickly frozen directly on the blockchain. To compensate for the losses and restore the reserves to a 1:1 ratio, Binance utilized over $6.34 billion of its own capital. This reserve includes the SAFU fund, the Binance Futures insurance fund, as well as retained earnings.
The remaining approximately 5% of losses involve tokens with lower liquidity: Binance is quietly repurchasing these tokens through over-the-counter (OTC) trading (OTC) to avoid impacting spot prices.
Each customer can verify their own balance: This report is built on Merkle trees and zero-knowledge proofs ( zk-SNARKs ). The article argues that this case sets a new standard for the market: when evaluating an exchange, it is no longer sufficient to see if it has been hacked, but rather how quickly it can stop the attack and whether it has sufficient own funds to cover the gap.
