Written by: Shenchao TechFlow
As of November 3, 2026, 15:28 (Beijing time, UTC+8), the Bitcoin address balance of Binance's SAFU fund (Secure Asset Fund for Users) is approximately 7,500 BTC, only half of the amount transferred in this February. Calculated at CoinGecko's price of $76,639 at the same moment, this balance is worth approximately $574.8 million, about $225 million below Binance's self-set $800 million rebalancing line. The other half was transferred out on October 31 to fill the approximately $6.3 billion gap caused by the hot wallet hack.
When were the 7,499 BTC in the SAFU address transferred out, and where did they go
According to Shenchao TechFlow's query of the mempool.space block explorer, the SAFU public address received 15,000 BTC in 5 transactions between February 2 and February 12, 2026, with individual amounts of 1,315, 1,315, 3,600, 4,225, and 4,545 BTC respectively. The transfer out on October 31 was the first transfer out from this address since approximately 16,277 BTC was transferred out on April 18, 2024.
| Beijing time (UTC+8) | Block height | Action |
|---|---|---|
| 2026-10-31 22:45 | 973,983 | Transferred 1 BTC to an intermediary address starting with 165Eurv as a test |
| 2026-10-31 22:51 | 973,984 | Transferred 7,499 BTC to the same address |
| 2026-11-03 13:56 | 974,354 | The intermediary address transferred 7,500 BTC to an address starting with bc1qhp7n |
The test transfer and the large transfer of 7,499 BTC were 6 minutes apart. Binance subsequently confirmed on X: "The SAFU fund transfer has been completed, and this is that large transfer of 7,499 BTC."
The second transfer on November 3 emptied the intermediary address. The receiving address has accumulated 1,888 transactions, commonly consolidation transactions with more than 60 inputs, and has no public identity label.
The top-up rule only covers price declines, not drawdowns
The hack occurred in the early morning of October 30, Beijing time. Binance estimates the impact at approximately $6.3 billion, of which about $3 billion has been frozen on-chain, and the U.S. Federal Bureau of Investigation (FBI) attributed the attack to the North Korean hacker group TraderTraitor. Binance's Recovery Progress Announcement No. 3 on October 31 stated that the company had set aside more than $6.34 billion of its own funds, of which $5 billion was originally held in the affected tokens. The top-up funds came from SAFU, part of the contract insurance fund, and company funds, with SAFU used to purchase the remaining tokens outside the top ten with lower liquidity.
SAFU is custodied by Nest Clearing and Custody Limited, an institution licensed by the Abu Dhabi Global Market (ADGM). The rule on the SAFU FAQ page states verbatim: "If the fund's market value falls below $800 million due to BTC price fluctuations, Binance will rebalance it to restore it to $1 billion."
The rule only sets a top-up line for price declines, and does not set a top-up deadline for drawdowns of the fund.
According to Shenchao TechFlow's calculations, if the 15,000 BTC remained untouched, BTC would need to fall below $53,333, i.e., a 30.4% drop from the current price, for the fund to hit the line. At $76,639, restoring to $1 billion would require approximately 13,048 BTC, still about 5,548 BTC short, or about $425 million. Binance has promised to restore SAFU to approximately $1 billion but has not given a timetable, nor disclosed how much of the contract insurance fund was used. CoinDesk estimates that the BTC SAFU provided this time is worth about $580 million, approximately 9.1% of the $6.34 billion set aside.
Coverage rises to 95%, more networks resume withdrawals
Binance's Recovery Progress Announcement No. 5 released on November 2 shows that the coverage ratio of the affected amount rose from 90% to approximately 95%. The remaining 5% consists of tokens outside the top ten with lower liquidity. For the ten assets BTC, ETH, USDT, BNB (Binance Coin), SOL, USDC, XRP, USD1, RLUSD, and ZEC, the zero-knowledge proofs for the proof-of-reserves snapshot at 00:00 (UTC) on October 31 have been completed, and users can verify 1:1 reserves themselves.
According to Cointelegraph, Binance began opening withdrawals on more networks in batches from 12:00 (Beijing time) on November 3. DefiLlama data shows that Binance had a net outflow of $2.57 billion on November 2 (Monday), compared with $6.1 billion the previous day.
Binance plans to take a new snapshot covering more tokens on November 4, and generating the complete zero-knowledge proof is expected to take approximately another 40 to 50 hours.
