Binance has used roughly half of the Bitcoin held in its Secure Asset Fund for Users as part of the exchange’s effort to replace assets lost in its $6.3 billion security breach. In an official October 31 recovery update, the exchange confirmed a partial SAFU deployment alongside its corporate treasury and Futures Insurance Fund. Binance subsequently identified a 7,499 BTC onchain transfer, worth about $581 million when executed, as the completed SAFU movement.
The publicly disclosed SAFU Bitcoin address shows a second 1 BTC outflow six minutes earlier, bringing the combined October 31 reduction to approximately 7,500 BTC. The wallet now holds 7,500.001 BTC, roughly half the approximately 15,000 BTC it held after Binance converted SAFU entirely into Bitcoin in February 2026. At Bitcoin prices around $77,000 on November 3, the remaining balance is worth roughly $580 million.
SAFU Becomes One Part of a Broader Recovery
The deployment followed the October 29 Binance breach that affected roughly $6.3 billion in assets. Binance initially said SAFU and company funds would absorb the losses, later specifying that replenishment was drawing from three separate resources: a partial SAFU deployment, part of the Futures Insurance Fund and Binance’s corporate treasury. The exchange said more than $6.34 billion in company funds had been set aside for the response.
That distinction matters because the Bitcoin leaving SAFU does not represent stolen assets being recovered from the attacker. It represents replacement capital being deployed by Binance to restore the assets backing customer balances. Replenishment and recovery are separate accounting events: approximately $3 billion of attacker-controlled assets had been frozen onchain, while Binance separately acquired replacement assets through market and OTC channels.
By November 1, Binance said approximately 95% of the affected assets had been replenished, up from 90% when the SAFU transfer occurred. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were reported as fully backed, while the remaining 5% consisted primarily of less-liquid tokens. The replenishment progressed as Binance simultaneously reopened withdrawals and subsequently experienced more than $7 billion in tracked net outflows during one rolling 24-hour period. That separate withdrawal response is detailed in Binance’s post-hack exchange flow data.
Binance Pledges to Restore SAFU to $1B
The drawdown puts SAFU below the valuation threshold referenced in Binance’s standing fund policy. Since converting the reserve to Bitcoin, Binance has said it will rebalance SAFU to $1 billion if its market value falls below $800 million because of BTC price fluctuations. That automatic rebalancing language specifically addresses market-price movements rather than funds deliberately spent during a security incident.
Binance has nevertheless made a separate commitment to restore SAFU following the breach. Its October 31 update says the company will return the fund to approximately $1 billion so that it remains available for future user-protection events. No deadline or funding mechanism for that refill has yet been disclosed, leaving the current 7,500 BTC wallet balance as the observable post-incident reserve.
The reduction comes while investigators continue tracking the stolen assets, including the 18,270 BTC still associated with attacker-linked addresses. SAFU has now performed the emergency function for which Binance created it, but doing so has materially reduced the immediately visible reserve available for another incident. The next measurable development is whether Binance restores that fund to its stated $1 billion target and how quickly the remaining affected tokens reach full backing.
