Binance's Secure Asset Fund for Users (SAFU) deployed 7,500 Bitcoin on Oct. 31 to help cover a $6.3 billion hot-wallet breach. These funds, representing half of the SAFU's former size, moved again on Nov. 3, landing in an unlabeled wallet with a history of processing more than 2,400 transactions.
The initial movement saw one BTC at 14:45 UTC and 7,499 BTC at 14:51 UTC leave Binance's published SAFU address on Oct. 31. These 7,500 BTC then sat in an intermediate address for three days before their latest transfer.
On Nov. 3 at 05:56 UTC, the intermediate address sent the entire 7,500 BTC in a single transaction to the new unlabeled wallet. Approximately 50 minutes later, this receiving wallet fragmented the stack into 150 distinct outputs, each containing about 50 BTC.
Later that day, 96 of these outputs, totaling 4,800 BTC, were bundled into a larger 9,346 BTC transfer. The remaining 54 chunks of Bitcoin were sent out in separate transactions, according to on-chain data.
This pattern of breaking a large holding into smaller pieces and then recombining some of them typically indicates an exchange routing coins to market makers or over-the-counter desks. Such movements are used to buy back missing tokens following a security incident.
Binance has not publicly explained these specific transfers, nor has any named entity been tied to the receiving address. The 7,500 BTC holds a current value exceeding $587 million, based on Bitcoin's price of $78,321.
The SAFU, established to protect users during extreme events, held 15,000 BTC in February after Binance converted the roughly $1 billion fund from stablecoins. Following this deployment, the fund now holds just over 7,500 BTC.
This current balance places the fund below a threshold Binance previously set. The exchange's SAFU FAQ states the fund will rebalance to $1 billion if its value falls below $800 million due to BTC price fluctuations. However, this rule specifically addresses price drops, not spending.
Binance stated a commitment to replenish the SAFU to approximately $1 billion but has not provided a timeline. The exchange's Nov. 3 incident report, which traced the hack to a tainted developer install and an abused internal wallet service, does not mention the SAFU's deployment or replenishment plans.
Binance confirmed on Oct. 31 that a partial deployment of SAFU, alongside its futures insurance fund and corporate treasury, would cover losses from the hot-wallet breach. It did not specify the exact contribution from each source.
As of Oct. 31, Binance reported it had covered the full cost of the hack and replenished 98 percent of its impacted assets, with less liquid tokens still in the process of being acquired. Withdrawals have stabilized since reopening, with Binance reporting steady hourly deposits by 03:00 UTC on Nov. 3.
