Written by: Deep Tide TechFlow

As of 15:28 on November 3, 2026 (Beijing time, UTC+8), the Bitcoin address balance of Binance’s SAFU Fund (Secure Asset Fund for Users) was approximately 7,500 BTC—just half the amount transferred in this February. At CoinGecko’s price of $76,639 at the same time, this balance was worth about $574.8 million, roughly $225 million below Binance’s self-imposed $800 million rebalancing threshold. The other half was transferred out on October 31 to fill an approximately $6.3 billion shortfall caused by a hot wallet theft.

When and where will the 7,499 BTC at the SAFU address be transferred?

According to Deep Tide TechFlow’s query of the mempool.space block explorer, the publicly disclosed SAFU address received 15,000 BTC in five transactions between February 2 and February 12, 2026: 1,315, 1,315, 3,600, 4,225, and 4,545 BTC, respectively. The transfer out on October 31 was the address’s first since it sent out approximately 16,277 BTC on April 18, 2024.

Beijing time (UTC+8) | Block height | Action: 2026-10-31 22:45 | 973,983 | Sent 1 BTC as a test to an intermediary address beginning with 165Eurv; 2026-10-31 22:51 | 973,984 | Sent 7,499 BTC to the same address; 2026-11-03 13:56 | 974,354 | The intermediary address transferred 7,500 BTC to an address beginning with bc1qhp7n

The test transfer and the large transfer of 7,499 BTC were six minutes apart. Binance later confirmed on X: “The SAFU Fund transfer is complete. This was the large transfer of 7,499 BTC.”

The second transfer on November 3 emptied the intermediary address. The receiving address has accumulated 1,888 transactions, including frequent consolidation transactions with more than 60 inputs, and has no publicly disclosed identity label.

The top-up rule only covers price declines, not funds being spent

The theft occurred in the early hours of October 30, Beijing time. Binance estimated the amount affected at approximately $6.3 billion, with about $3 billion frozen on-chain. The U.S. Federal Bureau of Investigation (FBI) attributed the attack to the North Korean hacking group TraderTraitor. Binance’s No. 3 recovery update announcement on October 31 said the company had set aside more than $6.34 billion in its own funds, of which $5 billion was already held in the affected tokens. The shortfall was made up using SAFU, part of the contract insurance fund, and company funds. SAFU was used to purchase the remaining tokens outside the top ten, which have lower liquidity.

SAFU is custodied by Nest Clearing and Custody Limited, a licensed institution in the Abu Dhabi Global Market (ADGM). The SAFU FAQ states: “If the fund’s market value falls below $800 million due to fluctuations in the price of BTC, Binance will rebalance it to restore its value to $1 billion.”

The rule sets a top-up threshold only for price declines; it does not set a deadline for replenishing funds used from the fund.

According to Deep Tide TechFlow’s calculations, if all 15,000 BTC remain untouched, BTC would have to fall below $53,333—down 30.4% from its current price—for the fund to hit the threshold. At $76,639 per BTC, restoring the fund to $1 billion would require approximately 13,048 BTC, leaving a shortfall of about 5,548 BTC, or approximately $425 million. Binance has pledged to restore SAFU to approximately $1 billion but has provided no timeline, nor disclosed how much of the contract insurance fund was used. CoinDesk estimates that the BTC SAFU used this time was worth approximately $580 million, or 9.1% of the $6.34 billion in funds set aside.

Coverage rises to 95% as withdrawals resume on more networks

Binance’s No. 5 recovery update announcement, published on November 2, showed that coverage of the affected amount had risen from 90% to approximately 95%. The remaining 5% consists of tokens outside the top ten with lower liquidity. Zero-knowledge proofs for the October 31, 00:00 UTC proof-of-reserves snapshot have been completed for ten assets: BTC, ETH, USDT, BNB (Binance Coin), SOL, USDC, XRP, USD1, RLUSD, and ZEC. Users can independently verify the 1:1 reserves.

According to Cointelegraph, Binance began reopening withdrawals on more networks in phases from 12:00 Beijing time on November 3. DefiLlama data shows that Binance recorded net outflows of $2.57 billion on Monday, November 2, compared with $6.1 billion the previous day.

Binance plans to take a new snapshot covering more tokens on November 4. Generating the complete zero-knowledge proof is expected to take approximately 40 to 50 more hours.