Binance has drawn down half of its Secure Asset Fund for Users (SAFU) in Bitcoin, with two on-chain transfers on Oct. 31 cutting the emergency fund's balance to 7,500 BTC. The move comes as the exchange taps the insurance fund to help cover losses from its $6.3 billion hack. Insurance funds like SAFU are designed to absorb user losses when an exchange suffers a breach or shortfall.

Two transfers six minutes apart halved the emergency fund

The SAFU address 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD sent out 1 BTC at 14:45 UTC, followed six minutes later by a 7,499 BTC payment at 14:51 UTC, according to mempool.space data. The transfers were included in Bitcoin blocks 973983 and 973984. Two dust deposits were later detected at 18:23 and 18:29 UTC.

The address's confirmed balance now stands at 7,500.00136678 BTC, roughly $577 million at about $77,000 per coin — under a tenth of the $6.3 billion in losses tied to the hack. In February, Binance completed converting the roughly $1 billion fund from stablecoins into Bitcoin, leaving 15,000 BTC on the address. Over its lifetime, the wallet has received approximately 32,918 BTC. SAFU stands for Secure Asset Fund for Users.

Binance confirmed the 7,499 BTC transfer, describing it as a partial deployment of the fund.

Binance pledges a $1 billion refill with no timeline

On Oct. 30, Binance said SAFU and company reserves would cover every dollar of user losses. A day later, it said part of SAFU would go toward the $6.34 billion it set aside for hack losses. The exchange promised to restore SAFU to around $1 billion, but gave no timeline and did not specify how much of the insurance fund was paid out.

Binance's SAFU FAQ states that the fund will be rebalanced to $1 billion if its market value falls below $800 million "due to BTC price fluctuations." The wallet now sits below that threshold at roughly $577 million. However, the rule applies only to price declines, and no deadline exists for replenishing the fund after a hack payout.

Binance has not disclosed how much SAFU remains, whether further withdrawals will follow, or when it plans to refill the fund.

Reserve proof and withdrawal flows

According to Cryptopolitan, on Nov. 2 Binance completed a zero-knowledge proof of its reserve snapshot as of Oct. 31 — a cryptographic method that lets outside parties verify reserves without exposing individual user balances. The snapshot was taken at 00:00 UTC and benchmarked against Bitcoin block 973895. With Bitcoin at 100.04%, 10 tokens have cleared the 100% mark.

Withdrawals resumed on Nov. 1, and gross withdrawals hit about $7.4 billion, a company spokesperson said. Some $2.7 billion flowed back in, leaving net outflows at $4.72 billion, or roughly 3% of platform assets.

The Oct. 29 hack has been attributed by the FBI to North Korea's TraderTraitor group, though Kim Yo Jong denied the accusations. Elliptic's Tom Robinson said $2.85 billion had been frozen or seized, while about $3.25 billion remained in addresses associated with the hack — making that remainder the largest outstanding piece of the stolen funds.

Binance says approximately 95% of affected assets have been replaced. The remaining tokens are less liquid, and the exchange is purchasing them through market and over-the-counter trades.

A more comprehensive reserve snapshot covering more tokens is planned for Nov. 4, with its proof expected to take another 40 to 50 hours to produce — making it the next scheduled checkpoint in the exchange's post-hack reserve disclosures.