Binance SAFU Fund Halved After Hack as Proof of Reserves Lands

By Nodora News · 3 November 2026

Binance's SAFU fund sent 7,499 BTC to cover the $6.3B hack, leaving about 7,500 BTC, as its new proof of reserves shows 10 key tokens backed 1:1.

Binance has spent roughly half of the Bitcoin (BTC) held in its public emergency fund to help cover last week's record hack, and has now finished the cryptographic proof behind its latest reserve snapshot. The exchange confirmed that a 7,499 BTC transfer out of its Secure Asset Fund for Users (SAFU) wallet on Saturday, Oct 31, was part of its recovery effort, leaving about 7,500 BTC, worth roughly $584 million, in the address. On Monday, Nov 2, Binance said users holding Binance Coin (BNB), BTC and eight other major tokens could now check that their balances were backed at least 1:1.

Key takeaways

• Binance's public SAFU Bitcoin wallet sent 7,499 BTC on Oct 31, about half of its roughly 15,000 BTC balance.
• About 7,500 BTC remains in the wallet; Binance has pledged to rebuild SAFU to about $1 billion but has given no date.
• The zero-knowledge proof for the Oct 31 proof-of-reserves snapshot is complete, covering 10 tokens including BTC, ETH, USDT and BNB.
• Binance says it has covered about 95% of the assets affected by the roughly $6.3 billion hack.
• Another reserve snapshot covering more tokens is planned for Nov 4.

Binance SAFU Fund: What Happened

SAFU is an emergency reserve Binance set up in July 2018, funded over time from a share of trading fees. Its purpose is to protect customers in extreme events such as hacks. Binance says the fund is held by Nest Clearing and Custody, a clearing house regulated in Abu Dhabi Global Market.

After attackers drained Binance hot wallets on Oct 29 in what is now the largest theft in crypto history, the exchange said it would absorb the loss rather than pass it to users. The FBI has attributed the attack to North Korea's TraderTraitor group. You can catch up on the original incident in our earlier report on the record $6.3 billion Binance hack.

On Oct 31 Binance said it would deploy part of SAFU, alongside a portion of its futures insurance fund and its own corporate treasury, to replace the stolen tokens. Hours later it confirmed the SAFU move was complete, pointing to the 7,499 BTC transaction.

The Numbers Behind the SAFU Drawdown

Public blockchain data shows the SAFU address (1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD) sent 7,499 BTC in block 973,984 at 14:51 UTC on Oct 31, about six minutes after a 1 BTC transfer to the same receiving address. Whale Alert valued the main transfer at about $581 million at the time.

The wallet now holds just over 7,500 BTC. Binance co-founder Yi He said half of the funds in the SAFU address would be used to cover losses, with the rest staying in the fund.

Binance's published SAFU policy says the fund will be topped back up to $1 billion if price swings push its value below $800 million. It does not set a deadline for refilling the fund after a security incident, and Binance has only said it is committed to restoring it to about $1 billion.

Why It Matters: What Proof of Reserves Shows

Proof of reserves (PoR) is a way for an exchange to show it holds enough assets to cover what customers have deposited. Binance builds a Merkle tree, a structure that compresses every account balance into a single fingerprint called a Merkle root. Each user can check that their own balance is included without seeing anyone else's.

Binance pairs this with zero-knowledge proofs (zk-SNARKs), a type of cryptography that proves a statement is true, such as "no account has a negative balance and all balances add up to the stated total", without revealing the underlying data.

The Oct 31 snapshot, taken at 00:00 UTC, lists reserve ratios of 100.04% for BTC, 100.00% for ETH and USDT, and 101.30% for BNB. The snapshot counted about 692,187 BTC, 3.65 million ETH, 29.48 billion USDT and 42.64 million BNB in customer balances. The full proof took roughly 40 to 50 hours to generate.

There are limits. The report covers 10 tokens, down from 55 in the Oct 1 snapshot, and USDT coverage fell from 103.88% to exactly 100%. PoR figures are published by Binance itself rather than produced by an independent audit, and a snapshot shows one moment in time, not liabilities that sit off the report.

Market Reaction: BNB and BTC Prices

Binance reopened withdrawals in phases on Nov 1. It reported $4.65 billion in withdrawals against $1.01 billion in deposits in the first nine and a half hours, a net outflow of about $3.64 billion, or 2.1% of its $171 billion in assets. Wallet tracking by DefiLlama later put 24-hour outflows from Binance-linked addresses at about $6.1 billion, while rival OKX saw roughly $450 million of net inflows.

Prices have been calmer. On OKX, BNB traded at about $704.47, down roughly 1.5% over 24 hours, while BTC sat near $77,903, essentially flat on the day. You can follow more coins on the Nodora charts page.

What to Watch Next for Binance

The next reserve snapshot is planned for Nov 4 and is meant to cover more tokens, with its proof expected to take another 40 to 50 hours. Binance also plans to reopen withdrawals for more networks and assets in further phases.

The remaining 5% of affected assets consists of less liquid tokens that Binance is still buying through markets and over-the-counter deals. Further SAFU moves, any timeline for refilling the fund, and whether outflows keep slowing will be the key signals for users weighing their trust in the exchange.

This article is for information only and is not financial advice.

#Binance Coin #Binance #Bitcoin #Proof of Reserves #Hack

This article is general information, not financial advice.