Binance SAFU Fund Bitcoin Balance Halved, Replenishment Rules Have No Set Time Limit for Activation

By: TechFlow

As of 15:28 Beijing Time (UTC+8) on November 3, 2026, the Bitcoin address balance of Binance's SAFU fund (Security Asset Fund for Users) stands at approximately 7,500 BTC, exactly half of the amount transferred in February this year. Valued at $76,639 per CoinGecko at the same time, this balance is worth approximately $574.8 million, falling short of Binance's self-imposed $800 million rebalancing threshold by roughly $225 million. The other half was transferred out on October 31 to cover the approximately $6.3 billion shortfall resulting from the hot wallet theft.

When and Where Were the 7,499 BTC from the SAFU Address Transferred?

According to TechFlow's query on the mempool.space block explorer, the public SAFU address received 15,000 BTC in five transactions between February 2 and February 12, 2026, with individual amounts of 1,315, 1,315, 3,600, 4,225, and 4,545 BTC respectively. The October 31 transfer marks the first outflow from this address since approximately 16,277 BTC were sent out on April 18, 2024.

Beijing Time (UTC+8)Block HeightAction

2026-10-31 22:45973,983Test transfer of 1 BTC to an intermediate address starting with 165Eurv

2026-10-31 22:51973,984Transfer of 7,499 BTC to the same address

2026-11-03 13:56974,354Intermediate address transfers 7,500 BTC to an address starting with bc1qhp7n

The test transaction preceded the large-scale transfer of 7,499 BTC by six minutes. Binance subsequently confirmed on X: "The SAFU fund transfer is complete. This is that large-scale transfer of 7,499 BTC."

The second transfer on November 3 drained the intermediate address. The receiving address has accumulated 1,888 transactions, commonly characterized by consolidation transactions with over 60 inputs, and lacks publicly identifiable labels.

Rebalancing Rules Only Address Price Drops, Not Fund Utilization

The theft occurred early on October 30 Beijing Time. Binance estimates the impact at approximately $6.3 billion, with about $3 billion already frozen on-chain. The FBI attributes the attack to the North Korean hacking group TraderTraitor. In its Recovery Update #3 on October 31, Binance stated that the company has allocated over $6.34 billion in own funds, of which $5 billion was originally held in the form of affected tokens. The replenishment capital comes from SAFU, a portion of the futures insurance fund, and corporate funds. SAFU will be used to purchase the remaining lower-liquidity tokens outside the top ten.

SAFU is custodied by Nest Clearing and Custody Limited, a licensed entity in the Abu Dhabi Global Market (ADGM). The original rule on the SAFU FAQ page reads: "If the fund's net asset value falls below $800 million due to BTC price fluctuations, Binance will rebalance it back to $1 billion."

The rules only set a replenishment trigger for price declines, not for periods of active fund utilization.

According to calculations by TechFlow, if the original 15,000 BTC remained untouched, the fund would only be triggered to replenish if BTC fell below $53,333, representing a 30.4% drop from current levels. At $76,639, restoring the fund to $1 billion would require approximately 13,048 BTC, leaving a shortfall of roughly 5,548 BTC, valued at approximately $425 million. Binance has pledged to restore SAFU to around $1 billion but has provided no timeline and disclosed neither how much of the futures insurance fund has been utilized. CoinDesk estimates that the BTC drawn from SAFU this time is worth approximately $580 million, accounting for about 9.1% of the $6.34 billion reserved capital.

Coverage Rate Rises to 95%, More Networks Restore Withdrawals

Binance's Recovery Update #5, released on November 2, shows that the coverage ratio of affected funds has increased from 90% to approximately 95%. The remaining 5% consists of lower-liquidity tokens outside the top ten. Zero-knowledge proofs for the proof-of-reserves snapshot at 00:00 UTC on October 31 have been completed for the ten assets: BTC, ETH, USDT, BNB (Binance Coin), SOL, USDC, XRP, USD1, RLUSD, and ZEC. Users can independently verify the 1:1 reserves.

According to Cointelegraph, Binance began phasing in withdrawals across more networks starting at 12:00 Beijing Time on November 3. DefiLlama data indicates that Binance recorded a net outflow of $2.57 billion on Monday, November 2, following a $6.1 billion outflow the previous day.

Binance plans to conduct a new snapshot covering additional tokens on November 4. Generating complete zero-knowledge proofs is expected to take another 40 to 50 hours.