Binance, one of the world’s largest cryptocurrency exchanges, has reduced the balance of its Secure Asset Fund for Users (SAFU) wallet from approximately 15,000 BTC to 7,500 BTC following a recent $6.3 billion hack. The emergency wallet, intended as an insurance fund to cover user losses, underwent two large transfers on October 31, dramatically cutting its reserves in response to hack-related payouts.
Large fund transfers after historic hack
On October 31, at 14:45 UTC, 1 BTC was moved from Binance’s SAFU wallet, followed six minutes later by a much larger transfer of 7,499 BTC. Blockchain records show these transactions occurred in blocks 973983 and 973984. Later that day, two small dust deposits were recorded.
The wallet now holds just over 7,500 BTC, a sum worth roughly $577 million at the prevailing price of $77,000 per Bitcoin. Binance confirmed the outflows, identifying them as a partial deployment of the SAFU reserve to address losses from the hack, which is considered one of the largest in the crypto industry.
Binance explained that part of the SAFU fund was used to help cover the $6.34 billion set aside for users affected by the hack.
In February, Binance had shifted the entirety of its SAFU from stablecoins to Bitcoin, leaving a balance of 15,000 BTC at the wallet address. Since its creation, the SAFU address has processed nearly 32,918 BTC in total flow.
Mini dictionary: SAFU (Secure Asset Fund for Users) is Binance’s emergency insurance fund established in 2018 to protect user assets. The fund is managed and periodically rebalanced, often held in major cryptocurrencies to maintain value stability.
Commitment to replenish the fund, but timeline unclear
On October 30, Binance stated that all user losses from the hack would be covered using a combination of SAFU and company reserves. After initiating the major transfer from SAFU, the exchange pledged to restore the fund back up to approximately $1 billion. However, no schedule or specific payout figure was provided.
Binance’s official documentation specifies that the SAFU fund is supposed to be rebalanced back to $1 billion if its value drops below $800 million due to fluctuations in the BTC price. With the current balance at about $577 million, the fund is now below this threshold. However, these rules apply only to value reductions caused by price swings, not by payouts related to hacks, and there is no set deadline for restoring the fund in these cases.
Binance has not stated how much of SAFU remains available or when the next refill might happen following the hack-related disbursement.
Reserves, withdrawals, and actions after the incident
Shortly after the funds were moved, Binance completed a proof of reserves using zero-knowledge technology, taking a reserve snapshot at 00:00 UTC on October 31, based on Bitcoin block 973895. The assessment indicated that Bitcoin and ten other tokens had 100% backing on the platform.
Withdrawals, which had been temporarily paused, resumed on November 1. In total, users withdrew approximately $7.4 billion, with inflows of $2.7 billion, resulting in a net outflow of $4.72 billion, equal to about 3% of Binance’s platform assets.
| Metric | Amount |
|---|---|
| Initial SAFU balance | ~15,000 BTC |
| Post-hack SAFU balance | 7,500 BTC |
| BTC price (approx.) | $77,000 |
| Value of SAFU after draw | $577 million |
| Total user withdrawals | $7.4 billion |
| Net outflows | $4.72 billion |
The multi-billion-dollar attack on Binance has been linked by the FBI to North Korea’s TraderTraitor group, though Kim Yo Jong has denied these claims. Blockchain analytics firm Elliptic’s Tom Robinson stated that $2.85 billion connected to the hack has been frozen or seized, while around $3.25 billion remains in addresses tied to the incident.
According to Binance, approximately 95% of affected digital assets have been replaced. The company is working to repurchase less liquid assets for users through both market orders and over-the-counter transactions. An expanded proof of reserves snapshot covering more tokens is scheduled for November 4, with the results expected in roughly two days.
