
Exchange taps Secure Asset Fund for Users (SAFU) to replenish stolen assets after record-breaking theft
AI-generated summary
Binance suffered a $6.3 billion hack, the largest in crypto history, leading to a temporary suspension of withdrawals. The FBI identified the North Korean group TraderTraitor as the perpetrator.
Binance’s publicly disclosed emergency Bitcoin wallet held roughly half its previous balance on Monday after the exchange tapped its user protection fund to cover losses from Thursday’s $6.3 billion hack.
The exchange confirmed a transfer of 7,499 Bitcoin (BTC) on Saturday, linking it to the partial deployment of its Secure Asset Fund for Users (SAFU).
As of Monday, the wallet held about 7,500 BTC, worth $583 million, down from about 15,000 BTC before the transfer.
The theft, the largest in cryptocurrency history, forced Binance to suspend withdrawals while it worked to replace the stolen assets. The FBI attributed the attack to North Korea on Saturday, identifying the hackers as TraderTraitor.
Binance began reopening withdrawals in phases on Sunday and said it had replenished approximately 95% of the affected assets, up from 90% a day earlier. It continued buying the remaining, less-liquid tokens through market and over-the-counter transactions.
The exchange is using its corporate treasury, SAFU and part of its futures insurance fund to cover the losses.
SAFU policy sets no deadline to replace funds used after hacks
Binance’s SAFU policy outlines regular monitoring and rebalancing of the fund’s market value.
“If the fund’s market value falls below US $800 million due to BTC price fluctuations, Binance will rebalance the fund to restore its value to $1 billion,” it states.
The policy does not specify a timeline for replenishing funds withdrawn following a security incident.
Binance did not immediately respond to Cointelegraph’s questions about SAFU’s remaining reserves, further deployments and plans to replenish the fund.
Binance releases verification proof for post-hack reserves
Binance said Monday that users could now verify their balances against its Saturday proof-of-reserves snapshot after it completed the accompanying cryptographic proof.
The exchange said the snapshot showed customer holdings in 10 cryptocurrencies, including Bitcoin, Ether and USDT, were backed at least 1:1.
The exchange plans to take another snapshot covering more tokens on Wednesday, with the accompanying proof expected to take another 40 to 50 hours to generate.
AI outlook — possibilities, not facts
Binance will conduct a new proof-of-reserves snapshot on Wednesday.
Very likely · Within days

Attackers stole $6.4 billion from Binance hot wallets, triggering FBI and Secret Service investigations. The event caused $643 million in Bitcoin ETF outflows on Friday, flipping October's net flows to negative as Binance works to reimburse users.

Strategy resumed Bitcoin acquisitions, purchasing 811 BTC for $65.5 million between October 26 and November 1. The firm now holds 849,327 BTC, funded by recent stock sales, while also increasing preferred stock buybacks.

The Financial Action Task Force (FATF) is initiating a targeted review of jurisdictions with significant virtual asset service provider activity to address anti-money laundering enforcement gaps. Findings are expected in June and October 2027.

Hackers behind the $6.3 billion Binance theft are converting stolen Solana tokens into Bitcoin following the emptying of Tron laundering wallets, while US law enforcement urges crypto services to block transactions tied to North Korea's TraderTraitor group.

Bitcoin climbed to $78,724 amid falling oil prices and a weaker dollar, but OPEC+'s decision to hold oil production targets steady through December leaves the cryptocurrency exposed to renewed inflation pressures and Federal Reserve tightening.

BTCPay Server urged operators to shut down instances running software older than version 2.4.2 after reports emerged that unauthorized attackers were draining connected hot wallets.