Binance Moves 50% of SAFU Bitcoin, Publishes Reserve Proof

Binance’s emergency Bitcoin wallet showed a sharp drop over the weekend as the exchange used part of its Secure Asset Fund for Users (SAFU) to help cover losses tied to Thursday’s massive hack. On Monday, the wallet held about 7,500 BTC—down from roughly 15,000 BTC prior to the transfer—after Binance confirmed it had moved 7,499 BTC on Saturday.

The attack led Binance to suspend withdrawals while it worked to replace stolen assets. The FBI later attributed the hack to North Korea, naming the alleged attackers as “TraderTraitor.” Binance says withdrawals have since reopened in stages and that it has replenished the affected assets in near-total measure.

Key takeaways

• Binance confirmed a Saturday transfer of 7,499 BTC to a wallet that now holds roughly 7,500 BTC, indicating SAFU deployments after the hack.
• After the Thursday incident, Binance suspended withdrawals and then restarted them in phases starting Sunday, reporting about 95% replenishment by Monday.
• Binance’s SAFU policy describes rebalancing triggers (including a $800 million threshold for BTC price moves) but does not set a specific deadline to replace funds after security events.
• Binance says customers can verify balances against its Saturday proof-of-reserves snapshot, and it plans an expanded snapshot later.

SAFU deployed after Binance-linked wallet transfer

Binance publicly connected the Saturday move to its SAFU coverage. According to Binance’s confirmation, the exchange transferred 7,499 BTC as part of the partial deployment of the user-protection fund.

Blockchain explorer data linked to the wallet indicates that by Monday it contained approximately 7,500 BTC, valued at around $583 million—about half the balance reported before the transfer.

In practical terms, the shift illustrates how Binance is funding replenishment in real time rather than waiting for a single one-off replacement. For traders and users, that matters because it provides an on-chain window into the exchange’s immediate liquidity response following the theft.

Replenishment progress and the reopening of withdrawals

The hack was reported as the largest in cryptocurrency history, and it immediately disrupted customer access by forcing Binance to suspend withdrawals. Following the incident, Binance began reopening withdrawals in phases on Sunday.

Binance stated that it had replenished approximately 95% of the affected assets by Monday—up from about 90% a day earlier. The exchange also said it continued acquiring remaining, less-liquid tokens using a mix of market purchases and over-the-counter transactions.

Binance’s coverage plan includes the exchange’s corporate treasury, SAFU, and part of its futures insurance fund. That multi-fund approach is significant because it spreads the replacement burden across different reserve pools rather than concentrating all replenishment in a single source.

SAFU policy: rebalancing triggers, but no replacement deadline

Binance’s SAFU documentation lays out how the fund is meant to be monitored and rebalanced. The policy states that if the market value of SAFU falls below $800 million due to Bitcoin price fluctuations, Binance will rebalance the fund to restore it to $1 billion.

Notably, the policy does not spell out a timeline for replenishing SAFU after assets are withdrawn because of a security incident. That gap can be consequential for stakeholders trying to assess how quickly funds used in emergency coverage will be fully restored.

Binance did not immediately provide additional details when asked about remaining SAFU reserves, further deployments, and replenishment plans—leaving parts of the timetable unclear beyond the operational milestones the exchange has already communicated through replenishment percentages and withdrawal resumption.

Proof-of-reserves update and expanded snapshots

As part of its post-hack verification effort, Binance said Monday that users could now verify their balances against the proof-of-reserves snapshot the exchange provided on Saturday, after it completed the accompanying cryptographic proof.

Binance said the snapshot indicates that customer holdings in 10 cryptocurrencies—including Bitcoin, Ether, and USDT—are backed at least 1:1. That claim is central to the verification process because it aims to demonstrate that the exchange’s assets cover customer liabilities across the listed tokens.

The exchange also plans a follow-up snapshot covering more tokens on Wednesday. Binance said the cryptographic proof for the expanded snapshot is expected to take an additional 40 to 50 hours to generate.

For customers, this staged approach means verification should continue to get more comprehensive rather than ending with a single limited snapshot. For investors, it also provides a framework to monitor how well Binance’s reserves align with customer holdings as the token set expands.

Looking ahead, readers should watch whether Binance’s next snapshot confirms consistent 1:1 backing across the expanded set of assets, and how quickly—or slowly—fully replenishing SAFU and related coverage pools progresses after this emergency deployment. The absence of an explicit SAFU replacement deadline makes the follow-up replenishment updates and reserve proofs especially important in the weeks to come.