Exchange hacked? 5 steps: proof of reserves, withdrawals and address whitelists

If your exchange gets hacked, work through five steps: confirm what happened through official channels and ignore offers of compensation or recovery; check the exchange's proof of reserves and on-chain data; see which networks are open before you withdraw; lock down your account with an address whitelist, a passkey, an anti-phishing code and tight API permissions; then decide where your funds should live.

The example is Binance. In the early hours of October 30, attackers drained Binance hot wallets, and Binance's preliminary estimate, published that morning, put the total impact at about US$6.3 billion. I have been tracking the incident on a dedicated page, Binance hacked for US$6.3 billion: timeline and latest status (in Chinese). In a thread on PTT, Taiwan's largest forum, one person asked whether USDT could still be moved out of Binance, and another asked: "Is a cold wallet safer?" The incident is not over. Every number below is what was published at the time, and the incident page has the latest on which withdrawals are open and how much has been replenished. All times are Taiwan time (UTC+8).

1. Confirm what happened through official channels, and ignore "compensation" and "recovery" offers

Even the size of the loss came in several versions. For this one incident, Binance estimated about US$6.3 billion, TRM Labs counted US$6.36 billion, Elliptic US$6.43 billion, and Decrypt at least US$5.57 billion. They differ because each one counts something different: some count only hot-wallet outflows, others everything the attacker's wallets received. Before you repeat a number, check who calculated it and what it covers.

Scams showed up at the same time. In its first statement, at 05:24 on October 30, Binance told users not to click unofficial links and not to answer messages asking for account details. On the evening of November 1 a screenshot circulated claiming Binance would pay every user US$150 for the withdrawal halt. Binance's official X account replied that this was false and the screenshot had been doctored, and co-CEO Yi He said there was no cash-voucher campaign and warned about phishing and scam links.

If a direct message, a support phone number or a Telegram account claims to be Binance, look it up in Binance Verify first. It checks whether a URL, email address, phone number, Telegram account or social media account is official. The page also states that Binance will never ask for funds or tokens through private messages. So a DM offering to "recover" your funds or pay out compensation, as long as you send crypto or a verification code first, needs no reply.

2. Check the exchange yourself: proof of reserves and on-chain flows

Read the reserve ratio per coin, with its snapshot time

Proof of reserves compares what the exchange holds with what it owes users. At 100% or more, every unit of customer assets was matched by at least one unit at the time of the report. On November 3, the latest report on Binance's proof-of-reserves page was the snapshot taken at 08:00 on October 31: BTC 100.04%, ETH 100%, USDT 100%, USDC 106.08%.

A report is a snapshot. Anything that happened after it, and any coin it does not cover, is outside it. Binance's recovery update at 20:49 on November 2 said the full zero-knowledge proof for the 08:00 October 31 snapshot was ready, and that holders of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC could use the verification tool to confirm their balances were backed at least 1:1. The next snapshot is on November 4.

Use the official tool to confirm your balance is counted

Every one of these exchanges uses a Merkle tree, which lets you confirm your own balance is included without seeing anyone else's. I checked the official instructions of four exchanges on November 3, 2026:

• Binance: log in on the website, go to Wallet → Verification and pick a date. You see your Merkle Leaf, your Record ID, the assets covered and your balances at that time.
• OKX: on the PoR reports page click "Details", then "Copy data", and save it as a file whose name ends in _inclusion_proof.json. Put OKX's open-source zk-STARK Validator in the same folder and run it. The result reads "Inclusion constraint validation passed" or "failed".
• Bybit: the "Verify My Account" page shows your Merkle path. To compute it yourself, use "Copy Data" on the proof-of-reserves page, save it as myProof.json and run the Java code Bybit publishes on GitHub. Bybit notes that if your account was opened after an audit, or you held none of the audited tokens, that audit has no record for you.
• Bitget: log in, open the proof-of-reserves page and click "My proof of assets", then "Verify" to see the Merkle tree. If the root hash matches the one Bitget published for that month, your assets are in the snapshot. You can also "Download data" and run the open-source MerkleValidator.

A Merkle check answers one question: is my entry included? Whether the total adds up and no account is negative is checked separately with zero-knowledge proofs at Binance and OKX. OKX lets you run that check too, with a file from its "Liability report" tab and the same Validator. Binance's proof-of-reserves page names no audit firm, so it rests on cryptography and on users checking for themselves.

Know what an on-chain number measures

The on-chain assets that DefiLlama tracks for an exchange are what can be seen in its public wallet addresses. It is not everything the exchange owns, and nothing owed to users is subtracted from it.

For Binance, the public wallets held US$171.66 billion before the incident and US$150.07 billion at 06:56 on November 3, about US$21.6 billion less. That drop mixes stolen assets, customer withdrawals and falling prices, so it is not the amount stolen. Net flow counts only coins moving in and out, but an exchange moving funds between its own wallets, for example to new addresses, can show up there too, so a net outflow figure on its own does not tell you what happened. On November 1 Binance announced that newly generated wallets had been added to its proof-of-reserves address list and that all withdrawals would go out from those new addresses.

3. Whether and how to withdraw: check which networks are open

Binance reopened withdrawals on the Bitcoin network at 14:04 on November 1, and by 20:36 that day 15 networks were open. USDT could be withdrawn on Ethereum, BSC, OP, Arbitrum, Tron, Solana, Polygon, Avalanche C-Chain and TON. Other assets and networks open in stages after security checks, and the November 2 update said more would open from November 3.

So whether USDT could be moved out of Binance depends on when you asked. From October 30 to the afternoon of November 1, no. After 20:36 on November 1, yes, on those nine networks.

Withdrawals surged when they reopened. Binance reported US$4.649 billion in withdrawals and US$1.01 billion in deposits between 14:00 and 23:30 on November 1, a net outflow of about US$3.64 billion, which Binance put at 2.1% of its US$171 billion in total assets under management, based on proof-of-reserves data as of October 28.

If you decide to withdraw, Binance's withdrawal guide sets out the rules:

• Pick the same network the receiving platform uses. Binance states that sending to the wrong network results in permanent loss.
• On networks that need a Memo (or Tag), fill it in. Binance says that without it, the address cannot be identified.
• On a first withdrawal to a new address, send a small amount first to confirm the address is right.
• Before you confirm, check the network fee and the amount that will actually arrive.

4. Lock down the account: whitelist, passkey, anti-phishing code, API keys

• Withdrawal address whitelist: once enabled under Settings → Withdrawal, you can withdraw only to whitelisted addresses. Turning it on or off needs a passkey or 2FA. Changing the whitelist can suspend withdrawals for 24, 48 or 72 hours. A separate "Whitelist Withdrawal Limit" blocks withdrawals to newly added addresses for a period you choose, and Binance recommends leaving it on.
• Passkey: Binance says that once you add a passkey, you can use it for 2FA on all your linked devices.
• Anti-phishing code: once set, it appears in every genuine email and SMS from Binance. If the code is wrong or missing, the message may be phishing. It is 6 to 8 characters long.
• API keys: an HMAC key without IP restrictions can only read. Withdrawal permission requires an IPv4 allowlist first. If a key does not need to withdraw, don't give it that permission.

5. Where your funds live from now on: exchange and self-custody carry different risks

Binance said it would cover all losses from its SAFU fund and company funds, and its fourth update on November 1 said about 95% of affected assets had been replenished. During that time, though, withdrawals were paused from early October 30 until they reopened in batches on the afternoon of November 1, and when you could withdraw was up to the exchange to announce.

Self-custody swaps one risk for another. In my Lab I published a 3D teardown of the Ledger Nano X implant: a tampered device eavesdrops on the screen's SPI line and steals the 24-word recovery phrase as it is shown during setup. Ledger's genuine-check only verifies the secure chip, so tampered units still pass. These units were bought through channels including Lazada, Amazon, Yahoo Auctions Japan, MediaMarkt and Ozon. The implant data comes from original research by Karpelès Lab (the Ledger implant OSINT report and the GitHub repository). The teardown is my own write-up and is not affiliated with or endorsed by Karpelès Lab.

So "Is a cold wallet safer?" has no single answer, because the risks differ. On an exchange, the risk sits in the platform's security and its withdrawal controls. In self-custody, it sits in where the device came from, how the recovery phrase is stored, and your own mistakes.

This is not investment advice. Crypto prices are volatile; weigh the risks yourself.