Binance Moves 7,499 BTC Out of SAFU Reserve After $6.3 Billion Hack

Binance's publicly disclosed emergency wallet held about 7,500 bitcoin on Monday, worth roughly $583 million, after the exchange confirmed a transfer of 7,499 BTC out of the fund on Saturday. The movement was a partial deployment of the Secure Asset Fund for Users, the reserve Binance keeps to absorb customer losses, and it cut the wallet's balance to about half of the close to 15,000 BTC it held beforehand, Cointelegraph reported. Binance tapped the reserve to help cover losses from the $6.3 billion hack carried out on Thursday, the largest such theft in cryptocurrency history, which pushed the exchange to suspend withdrawals while it worked to replace what was taken.

The fund operates under a written policy that sets a $1 billion target and requires a rebalance whenever the fund's market value slips below $800 million because of bitcoin price movements. "If the fund's market value falls below US $800 million due to BTC price fluctuations, Binance will rebalance the fund to restore its value to $1 billion," the policy text quoted in the report states. What the policy does not do is set a deadline for restoring money withdrawn during a security incident. Binance did not immediately respond to questions about the fund's remaining reserves, further deployments or plans to refill it, the same report said.

The 7,499 BTC movement happened on or around Oct. 31, Coin Courier reported, and Binance described the transfer as completed while leaving the reserve's refill schedule unstated. Hot wallets, which exist for day-to-day withdrawal liquidity, exposed a larger share of assets during the breach, and the exchange moved internal funds before drawing on the user-protection reserve, the same report says. Cointelegraph lists three pools of money behind the recovery: Binance's corporate treasury, SAFU and part of its futures insurance fund.

The exchange has committed more than $6.34 billion of company funds to the incident, and roughly $3 billion of the affected assets are still frozen on-chain, Coin Courier reported. Those frozen tokens limit further movement and require separate sourcing before user balances can be made whole, the report says. The corporate allocations sit apart from the SAFU withdrawal, which the exchange disclosed separately after the fact. Coin Courier's report frames the 7,499 BTC movement as a specific deployment rather than a change in total holdings or an assessment of overall platform solvency, and it notes that initial breach details were confirmed across Binance announcements dated Oct. 29 through 31. The policy text, for its part, commits the exchange only to regular monitoring and rebalancing of the fund's market value, with no promise about how fast an incident withdrawal gets replaced.

Recovery has moved in stages. Official updates on Oct. 31 put about 90% of the stolen assets back, with bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC shown at full reserves at that point, the report says. The ordering let the major assets reach full backing first while sourcing continued for the rest. The same account noted that its later 95% figure rested on secondary reporting rather than a fresh Binance announcement before its publication cutoff at 18:10 UTC on Nov. 2. By Monday the exchange itself said it had restored roughly 95%, up from 90% a day earlier, and was still buying the remaining lower-liquidity tokens through market and over-the-counter trades. Binance began reopening withdrawals in phases on Sunday. The FBI attributed the attack to North Korea on Saturday and identified the group behind it as TraderTraitor, Cointelegraph reported.

The transfer came alongside a separate reserves check. On Monday, Binance said users can verify their balances against its Saturday proof-of-reserves snapshot now that the matching cryptographic proof is finished, and that the snapshot shows customer holdings in 10 cryptocurrencies, including bitcoin, ether and USDT, backed at least 1:1. The exchange plans to take another snapshot covering more tokens on Wednesday, with the proof expected to take another 40 to 50 hours to generate.