Skip to content
Blockchain Posts

exploit

Binance SAFU bitcoin wallet drops to 7,500 BTC, roughly half spent

Binance's SAFU bitcoin address 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD now shows ~7,500 BTC (~$580M) after four Oct 31 outflows cut the balance in half; refill timeline unspecified.

by 4 min read
exploitbinancebitcoinon-chaininfrastructure

Binance's publicly disclosed SAFU bitcoin wallet, address 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, now holds 7,500.00136678 BTC — about $580 million at roughly $77,000 per coin — after four outgoing transactions on October 31, 2026 cut the balance from the roughly 15,000 BTC Binance published in February. The exchange had said on Oct 31 it would partially deploy SAFU to cover losses from the Oct 29 hot-wallet hack, alongside corporate treasury and part of its futures insurance fund. Primary source: on-chain history on mempool.space. Coverage: CoinDesk.

What happened

The SAFU address shows 31 total transactions, with the four most recent dated 2026-10-31 between 14:45 and 18:29 UTC, at fee rates ranging from 1.00 to 20.18 sat/vB. Total sent across the address's lifetime is roughly 25,418 BTC against 32,918 BTC total received. Before the Oct 31 outflows, the previous transaction on this address was dated 2026-08-09.

Binance finished converting the $1 billion SAFU reserve from stablecoins into bitcoin in February 2026, bringing holdings to about 15,000 BTC. The Oct 31 withdrawals removed roughly half of that pile.

Mechanism — what SAFU covers and what the FAQ says

SAFU — Secure Asset Fund for Users — is Binance's self-insurance pool created in 2018. The publicly stated rule in Binance's SAFU FAQ triggers a rebalance to $1 billion only when the fund's value falls below $800 million due to BTC price fluctuations. The FAQ does not address spending from the fund.

Binance's Oct 31 user note itemised three funding sources for the breach-replenishment programme: corporate treasury ($6.34 billion set-aside, including about $5 billion in affected tokens), a portion of the futures insurance fund, and the portion of SAFU above its required size — with a commitment to restore SAFU to roughly $1 billion afterward (no timeline).

The on-chain record shows the four Oct 31 outflows left the address at 7,500 BTC, well below $1 billion at today's $77,000 BTC price. Binance has not disclosed how much of the futures insurance fund it used, or how much of the breach the SAFU withdrawals covered specifically.

Numbers

  • SAFU wallet starting balance (Feb 2026): ~15,000 BTC
  • SAFU wallet current balance (Nov 3, 2026): 7,500.00136678 BTC
  • Portion spent since February: ~7,500 BTC (~50%)
  • Four outflows on 2026-10-31 between 14:45 and 18:29 UTC
  • USD value at $77,000/BTC: **$580 million** remaining
  • Breach-replenishment set-aside (per Oct 31 Binance update): $6.34 billion total, including ~$5 billion in affected tokens
  • Source: mempool.space address page, Binance Oct 31 user note (via CoinDesk)

What to watch

  1. Whether Binance publishes a dated commitment to refill SAFU to its 15,000-BTC February peak, versus to the FAQ's $1 billion threshold.
  2. The next SAFU-wallet inflows on 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, including size and the source address.
  3. The Nov 3 full Merkle proof-of-reserves attestation Binance scheduled for today — whether the attestation covers the shortfall or lists SAFU balances separately.
  4. Any update to Binance's post-mortem on the "additional points of breach" co-CEO Richard Teng flagged earlier in the incident.
  5. Whether Binance publishes an itemised breakdown of futures-insurance-fund spend vs. SAFU spend vs. corporate treasury contributions.

Context

The size of the SAFU drawdown is a first for the fund. SAFU's 2019 payout to cover the 7,000 BTC Binance hot-wallet drain used stablecoin and SAFU-held BNB; the February 2026 conversion to a BTC-denominated fund followed CZ's public commitment to anchor the pool in bitcoin.

The spending disclosed here does not include the roughly $3 billion that stablecoin issuers and other partners froze on-chain in the hours after the breach (see our Oct 31 freeze post), nor the Arbitrum DAO's Oct 30 security-council movement of about $30 million tied to the attacker.

The pattern — a self-insurance fund visibly drawn down after a nine-figure incident, before any user payout — is the clearest on-chain proof of the point Binance made on Oct 31: the exchange is absorbing the shortfall, not the users. Readers tracking recovery can watch the address directly.

Related stories