The most reassuring number to come out of the biggest crypto theft on record was also the thinnest. After the world's largest exchange lost roughly $6.3 billion on October 29 and rushed out a reserve proof, its main Ethereum wallets showed 3,654,922 ETH held against 3,654,919 ETH owed to customers. Three coins of slack, on a book of more than 3.6 million.
That proof did exactly what it was designed to do. It also showed, if you read it as a balance sheet, how little room was left once the hole had been plugged.
Twenty Minutes, Ten Chains, One Laptop
The attack itself was fast. Funds started leaving at 20:05 GMT on October 29 and moved across ten blockchains, most of it within about 20 minutes, according to blockchain analysts quoted by LBC, who attributed it with high confidence to TraderTraitor, the North Korean unit the FBI later named as well. The previous record, set early last year, was about $1.5 billion. This one is four times that.
The entry point is the part worth remembering. The exchange's first account blamed a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container that could submit withdrawals, and it later said its investigation had "uncovered additional points of breach," as Asia Financial reported. It also said it found no evidence that any wallet private key had leaked. The cold storage held up fine, and what the attacker actually exploited was the hot wallet's own plumbing, persuaded to pay out on command.
Stablecoin issuers froze around $3 billion within hours, which helped, and roughly $2.4 billion in BTC and ETH stayed under the attacker's control.
What the Reserve Proof Actually Measured
The exchange then did the responsible thing and published. It replenished about 80% of the stolen assets by October 30, 90% by October 31 and around 95% by November 1, drawing on its user protection fund, part of its futures insurance fund and corporate treasury. A snapshot taken at 00:00 UTC on October 31 was proven with a Merkle tree plus zero-knowledge proofs, letting each user check their balance was counted without exposing anyone else's. Ten assets were covered: BTC, ETH, USDT, USDC, SOL, XRP, ZEC, USD1, RLUSD and the exchange's own token. Another snapshot covering more assets is due on November 4.
Most coverage stopped at "fully backed" and moved on. Here is what that verdict covers and what it leaves out:
| The snapshot proves | The snapshot does not show |
|---|---|
| Customer balances in ten assets were matched at least 1:1 at one instant | How much surplus sits above 1:1 (the ETH margin was under three coins) |
| Your own balance was included, via a Merkle proof | Assets outside the ten, where the last ~5% is still being bought back |
| The hole was filled | Where the filling came from, and what those buffers look like now |
| Reserves existed on October 31 | Whether the withdrawal controls that failed on October 29 have been fixed |
The third row is the one traders should care about. The user protection fund reportedly held 15,000 BTC before the hack, and about 7,499 of them left it over the weekend, roughly $584 million. Part of the futures insurance fund went the same way, with the exchange saying it only took the portion above what its own rules require. Those funds exist to absorb the next shock. Spending them on this one makes the 1:1 proof true and the cushion beneath it thinner at the same time.
A 100% reserve ratio after a top-up is a solvency photo with the safety margin cropped out.
The LeveX Take
Reserve proofs have spent three years being treated as a pass-fail badge, and this week shows why that framing is too generous. The cryptography worked perfectly and answered a narrow question: were customer balances matched on one specific night? The questions that decide how an exchange survives its next bad day are the size of the surplus above 1:1 and the health of the funds that sit behind it, and a post-hack snapshot is the moment those two numbers are at their weakest. Anyone who lived through the 2022 collapses remembers how many platforms were "fully backed" right up until the week they weren't, so a ratio of exactly 100% deserves a raised eyebrow, even when it comes with a zk-SNARK attached.
For futures traders there is a less obvious cost. An insurance fund that has been partly spent on a hack has less capacity to absorb liquidation losses in a fast market, and when that capacity runs out, auto-deleveraging is what closes winning positions to cover the gap. A thinner fund raises that risk at exactly the moment volatility is elevated. This is why LeveX publishes its Proof of Reserves as a ratio with headroom: the September 30 snapshot showed BTC at 112%, ETH at 132% and USDT at 105%. Those surpluses are the part of the number that matters, because they are what absorbs a shock without draining something else. No exchange is immune to an operational breach like this one, and the most credible promise any of them can make is a visible buffer, which you can check for yourself rather than take on trust.
Reading the November 4 Snapshot
The next proof is the real test. If it shows ratios meaningfully above 100% across a wider set of assets, the exchange has rebuilt its margin. If it shows another row of numbers clustered at 1:1, it has rebuilt its liabilities and nothing more. It is also worth watching whether the user protection fund address climbs back toward its stated target of about $1 billion, since that is the clearest public signal of the cushion being restored. The broader pattern of record crypto hacks this year suggests the next shock will not wait for anyone's buffers to refill.
Bitcoin slipped toward $76,000 as the market digested the theft. You can trade it on LeveX spot or perpetual futures, and the Crypto in a Minute series covers reserve proofs, insurance funds and auto-deleveraging in short reads.