Namespace
← Back to Blog
newsbinancebitcoinsafusecurity

Binance confirms 7,499 BTC SAFU transfer after hack

November 6, 2026

Binance has confirmed that 7,499 bitcoin left its Secure Asset Fund for Users (SAFU) on Oct. 31, a transfer blockchain tracker Whale Alert valued at about $581.4 million. The exchange said the movement was a planned use of its emergency reserve while it covers losses from an Oct. 29 hack it has estimated at roughly $6.3 billion.

What happened

The transaction was recorded at 14:51 UTC on Saturday. The coins moved from the SAFU bitcoin address Binance publishes, 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, to 165EurvYDfNNYFQCtdT6LEPJrCeX3SMmee, an address Whale Alert had not labeled. Whale Alert put the notional value at $581,377,429, using a bitcoin price of $77,518.50. The on-chain record, hash 774fcb97827d7ed2389447cc3ef3e1abcd024574cd745d2182cc0ec58e7914bd, took 3,600 BTC and 4,225 BTC from the SAFU wallet and returned 325.99 BTC to that same address as change.

About an hour and a half later, Binance’s official account said the “SAFU fund transfer is complete” and identified the 7,499 BTC movement as that transfer. In a recovery update the same day, Binance said coverage of stolen assets had risen from about 80% to 90%. It said holdings of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed, and that the remaining 10% was less liquid tokens it was still buying in public markets and over the counter.

The notice listed three funding sources: a partial SAFU deployment, a portion of the futures insurance fund above the level Binance says its risk rules require, and corporate treasury. A question in the same notice said part of SAFU was being used to buy the outstanding 10% of assets. Co-founder Yi He later wrote that Binance was allocating 50% of the funds in the SAFU address to cover the loss and keeping the other half in the fund.

Why it matters

SAFU is Binance’s emergency reserve, created in July 2018. The exchange says it is held by Nest Clearing and Custody Limited, a clearing house regulated in Abu Dhabi Global Market, and is meant for events such as security breaches. Drawing on it matches that purpose, but it also shrinks the buffer until the fund is refilled. Binance has said it will restore SAFU to about $1 billion.

The Oct. 29 incident is, by Binance’s estimate, the largest crypto theft on record, at about $6.3 billion, according to CoinDesk. Binance has said it set aside more than $6.34 billion in company resources, separate from about $3 billion in stolen assets that partners had frozen. It has repeated that the exchange, not users, will absorb the financial impact. CoinDesk has also reported that TRM Labs attributed the theft with high confidence to North Korea’s TraderTraitor group, while noting that Binance had not identified the attacker. Binance’s Oct. 31 recovery notice did not name one.

The alert briefly looked like an unexplained outflow because Whale Alert marked the destination unknown. Binance then tied the transaction to a transfer it had already said would occur within 24 hours. A large wallet movement is not, by itself, evidence of a new theft.

What's next

Binance said on Oct. 31 that it remained on track to reopen withdrawals on Sunday, Nov. 1, the timetable it set after suspending them for a security review. As of early Sunday UTC, this report had not independently confirmed that withdrawals had resumed.

The exchange said it took a proof-of-reserves snapshot at 00:00 UTC on Oct. 31. It said a full zero-knowledge proof, which takes about 40 to 50 hours to generate, was expected by Tuesday, Nov. 3, so holders of the ten fully backed assets could check at least one-to-one backing. Binance said it would keep buying the remaining affected tokens until coverage reaches 100% for every asset involved, and that it would post further updates as that work continues.

Sources

More from the Namespace blog