When Binance was hacked, its users could still check what it held. Customers of African crypto venues can't. So we built an outside view of where their money sits, and where we lose sight of it.
On 29 October, attackers drained about $6.3 billion from Binance, the largest crypto theft on record (Irish News, Free Press Journal). Binance froze withdrawals, set aside more than $6.3 billion to cover losses (CoinMarketCap), and promised a fresh proof of reserves (Cointelegraph).
What kept the panic contained was that Binance publishes the wallets that hold customer funds. Anyone could look at them and see what was left. That is what a proof of reserves is for. It turns "trust us" into "look for yourself."
Only one can show you
AfriFlux tracks 15 African crypto venues on its reserves page. One of them publishes a current proof of reserves: VALR. Luno published one until December 2025, and its report page now returns a 404. The other 13, all in Nigeria, have never published one. The chart at the top of this page shows what each holds in wallets we can tie to it.
* Quidax's figure leaves out $4.7M held in an OTC wallet linked to Quidax whose ownership we couldn't confirm.
These are not small businesses. Between them, the 15 venues have taken in $39.10bn in stablecoin deposits, and $7.49bn has left them in the last 90 days alone. Billions of dollars pass through platforms whose customers have no way to check where the money is.
VALR shows this isn't a technology problem or an African problem. It's a choice.
So we built the outside view
If venues won't show their reserves, the only option left is to look from the outside. The AfriFlux reserves page does that for all 15 venues, every day:
- What each venue holds in wallets we can tie to it.
- What flows in and out: customer deposits, liquidity, payouts and settlement.
- Where the money goes next, and whether that destination publishes anything you could check.
It isn't a proof of reserves. A real one comes from the venue, covers every wallet it holds, and sets it against what it owes customers. Ours is what anyone can see from outside, and the place where the trail ends is a finding in itself.
Where the money goes dark
A customer's money is visible while it sits in a venue's own wallets. Then it moves on, and where it goes decides whether anyone can still check it.
Of the $7.49bn that left these venues in the last 90 days:
- About half (48%) went to exchanges and issuers that publish proof of what they hold: Binance, Bybit, OKX, KuCoin and others, and redemptions at Circle and Paxos.
- Four in ten (42%) went to shared OTC desks and to counterparties we can't identify. A desk pools many clients' money and publishes nothing. An unidentified counterparty is the end of the trail.
- The rest went to exchanges with no current proof, to other African venues, and to smaller recipients, most of them individuals.
Sending money to an exchange that publishes proof doesn't make it safe. Binance was hacked. But someone, somewhere, is showing what is held. Past a desk or an unknown wallet, nobody is.
What the tracker already caught
The biggest venue we track changed course three weeks before the hack.
From May to September, 98–99% of Obiex's outflows went to its own accounts at Binance, about $650M a month. On 8 October, that stopped. Its Binance accounts last received money on 14 October. Obiex kept moving the same volume, about $23M a day, but now 17% goes to its own Bybit accounts, 9% to shared OTC desks, and most of the rest directly to thousands of counterparties we can't identify.
That one switch moved the whole market.
Across the 15 venues, the share of outflows going to desks and unidentified counterparties was 31–36% a week in September. It jumped to 50% in the week of 5 October and stayed at 53–60% through the hack. Without Obiex, the rest of the market was already sending about half its money somewhere nobody can check. In October, the most checkable large venue joined them.
We don't know why Obiex changed its settlement, and the timing alone doesn't tell us.
For some users, proof is two steps away
Not every venue settles with an exchange. Many settle with each other.
Spenda sends 99% of its outflows to Quidax. Divest, Jeroid, Breet and Daya Pro all pay into Obiex, which also takes money from Quidax. None of these venues publishes a proof of reserves. For a Spenda customer, the money is one venue away from the app they use, and two venues away from anyone who might be able to prove it is there.
What our data can't see
- Cold storage. Venues may hold reserves in wallets we haven't linked to them. We can't see everything they hold, so "we can't see it" never means "it isn't there."
- Pooled accounts. Once money reaches an exchange or a desk, it joins that firm's books. We see the venue send it, not what the account holds afterwards.
- Customer withdrawals. Venues that let customers withdraw crypto send some money to customers' own wallets. That isn't dark money, but large withdrawals can't always be told apart from desks, so part of the "unidentified" share is customers.
- Fiat. Naira, rand and dollar balances in banks, including dollars redeemed at Circle, are off-chain.
- Liabilities. Even a complete picture of holdings wouldn't prove solvency without knowing what each venue owes.
None of this is an accusation. Settling through exchanges, desks, issuers or each other is how a high-turnover business works. The point is that customers can't check any of it, and from the outside, neither can anyone else.
Show the receipts
The fix isn't better guessing from the outside. It's disclosure from the inside:
- Publish your wallets: hot, cold and settlement.
- Name your settlement partners: which exchanges, desks and venues hold or process customer funds.
- Ask your partners to publish. A venue's proof is only as good as the next link's.
- Attest to off-chain balances and show what you owe.
- Keep it current. A report that stopped ten months ago proves nothing about today.
Until then, we'll keep publishing what we can see. And to the 14 venues without a current proof of reserves: send us your wallets, and we'll mark you as verified alongside VALR.
You can see what all 15 venues hold today on the AfriFlux reserves page. For the detail behind it, including each venue's wallets, payees and large transfers, apply for AfriFlux Terminal access.
Get the next investigation in your inbox. The Sweep is our Monday newsletter — one attributed on-chain number a week, with the method attached. Subscribe →
Methodology & limits
This is the flow across the 15 venues on the AfriFlux reserves page, not a census of every African crypto venue or of each venue's full balance sheet.
Data: AfriFlux reserves and flow tracing. Holdings are read daily from wallets proven to belong to each venue, priced at spot, as of 5 November 2026. Quidax's holdings exclude one OTC wallet ($4.7M) linked to it by its funding but not proven to be Quidax's. Flows are USDT and USDC outflows from those wallets, 7 August – 4 November 2026. "Exchanges that publish proof of reserves" publish monthly or quarterly reports according to public sources (Binance, Bybit, OKX, KuCoin, Gate, Bitget, MEXC, Kraken, VALR); Binance's post-hack report was promised for 2 November. "Unidentified" counterparties each received at least $100k in the period.
Sources for the Binance hack: Irish News (Binance's $6.3bn estimate, 29 October), Free Press Journal (withdrawals halted; largest on record), CoinMarketCap ($6.34bn set aside, 30 October) and Cointelegraph (proof-of-reserves report promised by 2 November).
