Binance Users Can Now Verify The Bitcoin They Own Via Merkle Tree

[o_e_l_e_o]

merkle_hash = "46dc2ebaa7cf3d253dedd10084399efce7b1ac8db9b6b5edf55f0c1ae7dec483 BTC:1.0,D.BTC:0.0,N.BTC:1.0"
red =hash   blue= balance in clear text
that user has 1btc

Well, maybe I'm massively mistaken since I don't own a Binance account to check, but everything I have read on their website, blog, Twitter, etc., says that you can only see that data for yourself and not for the several million other Binance users (and the screenshots they have shared seems to confirm that too). It would be a massive privacy breach for Binance to start sharing the account balance of every user with every other user. Yes, I can check that my balance is correctly included in the Merkle tree, but I cannot verify that anyone else's balance is included correctly or indeed included at all.

because you see your transaction hash is included in the merkle tree which totals up and matches the merkle root of the blockheader

And knowing the Merkle root or indeed the entire Merkle tree tells me exactly nothing about the value of the other transactions in that Merkle tree. All I know is that my transaction is included in it.

[franky1]

im not a binance user either

..
point is you should be more worried if
a. your leaf was not in the tree
b. the tree total exceeded reserve total

obviously if everyone can find their leaf. they they all know individually that they are in the tree..

if their individual totals dont exceed the reserves. then..

one last time
the company has enough reserves to match the tree total
and users can see their balance is part of the tree total

.. anyway. i think its time i say the usual
stop forming an opinion first, then looking for confirmation bias..

actually do the research of whats included and excluded from the hash+ clear text. and how merkles work. and then form your opinion on the technique. not the social drama echos you read else where

now to draw a line in the sand while you go do some research away from social media quotes
screw it ill push you in the right direction
https://www.binance.com/en/support/faq/how-to-verify-merkle-tree-819fadc1c16b499d85bc3a3d0fab76bc

they can download the tree and then find your leaf in the tree..
(i and you personally are not binance customers.. but it clearly says they can)

oh and before you say anything. the tree file can be read anf the program used to verify it is open source


now.. moving on..
nothing stops CZ from just taking the 575k coins to some exotic island and sip cocktails while pressing a bankruptcy button

[o_e_l_e_o]

actually do the research of whats included and excluded from the hash+ clear text. and how merkles work. and then form your opinion on the technique.

Yup, done all that. Here's the page I've read directly from Binance which explains their process: https://www.binance.com/en/proof-of-reserves#proof-of-reserves

Each user uses their unique account code, a salt, and the audit ID, concatenates all this, and then SHA256s it to create their "record ID". The record ID is then concatenated with all their balances, hashed again, and the first 16 characters (8 bytes) taken as that user's individual Merkle leaf.

Great. So I can verify that my balances are accurately hashed in to my Merkle leaf, and I can verify that my Merkle leaf is contained with the Merkle tree. Now, here is the bit you seem to be missing, I can verify absolutely nothing about any one else's balances or leaves. I have no idea if your balances are accurately reflected in your leaf. I don't even know if your leaf is even included. I don't know if CZ has included a fake account with -10,000 BTC to balance the books. The screenshot on the page I linked above even shows "Balance" and "Debt" at the time of the audit with a final negative equity in the account in question, so the process to have negative accounts already exists.

Here's an example to illustrate. I'll take you as an example customer with 50 BTC on your account. Your hash input will be "franky1,BTC:50". For the sake of simplicity of this example, everything is single hashed as simple text.
User 1 - 828ab4dea3944c2aae12c2e4faa3cc7d7c79d2f1903323c0d1110cc233d02855
franky1 - bdf65086e0f247c9fd0a14368833b65530750fcb79128a5e7186de313589c25c
User 3 - dccf02131c89244750fffc1bc647c5e1cd8bb536b98700d6f002066497e73893
User 4 - ad3d8ae71b24929d1eb84fd10f25c1ea2e159dc1ddf453d3832c78899a08b419

User 1 + franky1 = 38fd94e48ec804a3616fe20a4c2bc4f9a3d9c0b0812d5c421bc49ce9784a4b95
User 3 + User 4 = 6a712e021ef304ae0c8226602ffe934e1ea8868771ef429d43d73029e3205b5d

Merkle root = fa45368d13a36054cca1db862adfde5ae1c6f0bf6c479ad54c799fee47e3fdd1

Now, you have this Merkle tree, and you see Binance have posted a wallet with 200 BTC in it. Are they backed up 1:1? You have absolutely no idea. Is that 4 users with 50 BTC each? Or are there 2 users with 100 BTC and one fake account with -50 BTC? Who knows. Only Binance. You have verified that your balances are within the Merkle tree, but the Merkle tree itself tells you absolutely nothing about whether or not Binance are solvent. The whole thing is a sham.

[franky1]

OMG

you realy need to read.

one more time just for the idiot

users can download the entire tree..

and guess what. it does not just have the hashes. it has the clear data balance

and yes you can do kindergarden based maths to ass up the balances to get a total

THATS THE WHOLE POINT

how is it that every time you come out with some silly narrative not backed up by fact. i have to repeat myselg X times over to correct you

i even tell you the link to look and read that shows you examples and also where you are wrong
you say you read it.. then you go 100% opposite to what you have read and go back to your sily mis-understanding

seriously

please just take a break from  your ill conceived brain of social drama filled drivel. and instead use some time to research and learn from actual sources. not the idea's passed to you from social media

please. understand this. and really take your time..
sit back and have a coffee while you think about it and let it settle in

1. the merkle tree file that can be downloaded..

2. users merkle hash is not just hashes. its hash+clear text balance

EG
not just
46dc2ebaa7cf3d253dedd10084399efce7b1ac8db9b6b5edf55f0c1ae7dec483
but instead
46dc2ebaa7cf3d253dedd10084399efce7b1ac8db9b6b5edf55f0c1ae7dec483,BTC:1.0,D.BTC:0.0,N.BTC:1.0

got it ?

3. the tree is a large file which take a program upto 20 minutes to read through probably 26m entries that are merkled to a root

4. the program to read the file is standard node.js open source tool

5. the script to tell node.js how to read is standard open source javascript

6. each user can find their own leaf on the tree

7. all leafs dont reveal other users names but have a balance that can be counted and there are 3rd party auditors that can count. better then a todler

..
now tell me which point confuses you or you do not understand

a few years ago i thought you were a doctor in real life. someone that maybe knew how to do research and investigate and diagnose.. now you are sounding more like badecker

[o_e_l_e_o]

Feel free to at least try and keep the discussion civil.

users can download the entire tree..

and guess what. it does not just have the hashes. it has the clear data balance

That's not what their website says, but as I said above, I am more than willing to admit that I am wrong. Nothing in the link you have provided makes it clear that you can see other user balances in plain text, only that you can see each user's Merkle leaf, which as per the code I linked to above, contains a hashed representation of their balances. If someone with a Binance account could download and then share the Merkle tree, that would be very helpful.

But regardless, even in such a case the Merkle root does not prove solvency. Binance could quite easily look for every account which hasn't been active in (for example) 6 months, and set their balance to zero or just exclude them entirely, being relatively sure that these inactive users are not going to check and expose their fraud. And given that Binance already show on their screenshots that accounts can have a negative balance due to things like leverage, margins, loans, etc., then again nothing stopping Binance from padding the books with several thousand negative balance accounts which don't really exist.

One way or the other, the only thing the Merkle tree proves is that you have an entry on their spreadsheet. It does not prove they are solvent.