On-chain data shows the attacker behind the $6.3 billion Binance theft depositing about $4 million into three Binance deposit addresses. At the same time, Binance's first post-hack reserve snapshot shows its biggest assets covered with buffers as small as 2.7 ETH and $6 of USDT. Binance's full zero-knowledge proof of those figures is due by Tuesday. Some of the money stolen from Binance has started going back to Binance. Blockchain intelligence firm Arkham has flagged the entity it tracks as "Binance Hacker" depositing about $4 million into three Binance deposit addresses . Arkham says those addresses "likely represent nested service(s)." These are third-party exchanges that use Binance for liquidity and custody, giving their own customers deposit addresses that sit on Binance's infrastructure. If Arkham is right, the hacker isn't depositing into an ordinary Binance account. The money would be going to smaller platforms that operate through Binance. Exchanges have long known this is a weak point for stolen funds moving into normal trading. Either way, Binance is now receiving stolen funds at its own deposit addresses while it works to show customers it has replaced what was taken. The FBI has attributed the October 29 theft to North Korea. The deposits come at a sensitive moment. Binance has just published its first reserve snapshot since the hack and has promised a full cryptographic proof of it by Tuesday. What The Hacker's Deposits Mean $4 million is a small slice of a theft worth about $6.3 billion, but it matters for two reasons. It shows how the laundering works. Nested services are a common way into the regulated financial system. A third-party platform that relies on Binance for custody may run weaker identity checks on its own users. Funds deposited there can be swapped and withdrawn without the hacker ever opening a Binance account. Binance can act on it. Binance can't freeze bitcoin and ether sitting in wallets nobody controls, and it doesn't control the stablecoins that issuers like Tether and Circle have frozen. Deposits that land at its own addresses are different: they are on Binance's platform, so Binance can freeze them itself. One of the first tests of how Binance handles the money still in the hacker's hands is whether it freezes these funds and identifies the services that own the addresses. What The October 31 Snapshot Shows While the hacker's funds move, Binance has been rebuilding its reserves. Its proof-of-reserves page now shows: Snapshot date: October 31, 2026, 00:00:00 UTC, at Bitcoin block height 973,895. Verification method: zk-SNARKs. Merkle root: 169dd7e2300fabd4f7a8d11d745fe24f4c31ae1ccac6c4391fbd47b548740ad0 . The first page covers Binance's six largest assets. Customer balances are what users hold. Reserves are on-chain wallet balances, including assets held with outside custodians. BTC (100.04%): 692,488.864 BTC in reserves against 692,186.737 BTC owed to customers. Surplus: 302.127 BTC. ETH (100.00%): 3,654,921.842 ETH against 3,654,919.15 ETH. Surplus: 2.692 ETH. USDT (100.00%): 29,483,062,748.463 against 29,483,062,742.4. Surplus: about 6.06 USDT. SOL (100.00%): 24,636,962.108 against 24,636,959.409. Surplus: 2.699 SOL. BNB (101.30%): 43,192,045.152 against 42,638,275.565. Surplus: about 553,770 BNB. USDC (106.08%): 6,525,162,638.928 against 6,150,945,132.288. Surplus: about 374.2 million USDC. The second page has four more assets, and two of them stand out: XRP (100.99%): 2,541,393,612.546 in reserves against 2,516,373,182.286 owed. Surplus: about 25.02 million XRP. USD1 (100.04%): 2,439,495,268.943 against 2,438,555,978.253. Surplus: about 939,291 USD1. ZEC (103.23%): 1,075,208.121 against 1,041,540.546. Surplus: about 33,668 ZEC. All of it is held in Binance's own exchange wallets. RLUSD (100.83%): 203,562,524.587 against 201,892,535.916. Surplus: about 1.67 million RLUSD. Why USD1 and RLUSD matter: these are two of the stablecoins whose issuers froze stolen funds after the attack. World Liberty Financial froze $27 million of USD1, and Ripple began freezing RLUSD the same night. Both now show reserves above what Binance owes customers. Assets with outside custodians: part of several reserves sits with outside custodians rather than in Binance's own exchange wallets: Asset | Held with third-party custodians XRP 82.7 million ETH 61,385 USDT about 313.2 million BTC 10,824 USD1 10.6 million RLUSD 669,228 A Buffer Measured In Single Coins The striking part isn't that the ratios reach 100%. It's how closely they stop there. Compared with October's report: Binance's previous monthly report, published in early October before the hack, showed BTC at 100.35% and USDT at 103.88% . ETH was already at exactly 100.00% . After the theft: BTC: down to 100.04%. USDT: a buffer of almost 4% has shrunk to about six dollars. ETH and SOL: each covered with fewer than three coins to spare. For ether, that is about $6,000 of buffer on more than $8 billion of customer holdings. Not every asset is that tight. USDC, ZEC and BNB carry buffers of 1.3% to 6%. The thinnest buffers are in BTC, ETH, USDT and SOL, which are among the assets the attacker took in the largest amounts. How Binance says it got here: the pattern fits Binance's account of replacing the stolen assets in stages. It reported 80% replaced on Friday, 90% on Saturday and 95% on Sunday. The remaining 5% is in less-liquid tokens it is still buying. The money came from: its Secure Asset Fund for Users (SAFU), its Futures Insurance Fund, its Bitcoin reserve, its corporate treasury. Binance confirmed taking 7,499 BTC from SAFU and has pledged to refill the fund to about $1 billion . What the snapshot can't show: it was taken a little over a day after the theft, once the rebuild was under way. It shows the balance sheet after the replacement, not how large the gap was on October 29. What The Zero-Knowledge Proof Will And Won't Confirm Binance says the full proof takes 40 to 50 hours to compute. Its latest update says it will be ready "by Tuesday, 2026-11-03 (UTC)." The system is open source, in Binance's zkmerkle-proof-of-solvency repository. How it works: Every customer account becomes a leaf in a single Merkle tree. The tree compresses millions of balances into the one root hash shown on the page. A zero-knowledge proof, built with gnark and Groth16, shows the tree followed strict rules without revealing any individual balance. What the proof guarantees, according to the project's circuit design document : Collateral covers debt: each user's collateral covers their debts, after haircuts that vary by asset. No negative balances: every value is range-checked, so negative balances can't be used to shrink the totals. Totals add up: each declared asset total equals the sum of all user balances. The design also guards against a "dummy user attack" identified by Ethereum Foundation researcher Enrico Bottazzi. In that attack, fake accounts holding cheap tokens are used to offset debts in major assets. What it doesn't prove: the reserve side. The project's verifier config describes the totals as information "published by CEX, it represents CEX's liability." The reserve figures are checked a different way, against the wallet addresses Binance publishes through the page's "Download All Address" option. That leaves three gaps: The reserve side rests on Binance's own address list, including the holdings with outside custodians. The proof doesn't cover debts outside the customer tree. A missing balance is only caught if users check their own inclusion. What To Watch This Week Around Tuesday's proof : The Merkle root. The published proof should match 169dd7e2…740ad0 from the October 31 snapshot. The buffers. ETH has 2.7 coins to spare, USDT $6 and SOL 2.7 coins. Binance has disclosed about $3.6 billion in net outflows since the hack, so small withdrawals after the snapshot could tip a ratio below 100% until the next update. The less-liquid tokens. The next snapshot should show whether the smaller assets Binance is still buying are fully covered. The SAFU wallet. Its balance will show whether Binance has refilled the fund to about $1 billion. The hacker's deposit addresses. The question is whether Binance freezes the $4 million and names the nested services behind it. What customers can do: each user can get a Merkle proof for their account and check it against the published root. They can use the verifier code in Binance's repository rather than Binance's own interface. That doesn't prove Binance is solvent, but it confirms the user's balance was counted. Binance has rebuilt its reserves to 100% across its ten largest assets, but on several of them the buffer is only a few coins. Meanwhile, stolen funds are reaching its deposit addresses through platforms that run on its infrastructure. Tuesday's proof can confirm customer balances. It can't show how Binance handles the stolen money arriving at its own door. Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. Follow us on X @nulltxnews

NEAR was unable to hold on to $4.30 in the face of recent selling pressure and could slide toward $2.81 in the coming weeks.