Mentioned in This Article
1. What happened to the SAFU bitcoin on November 3?
The 7,500 bitcoin (BTC) that left Binance's SAFU emergency fund on October 31 was moved a second time in the early hours of November 3, public blockchain records show. The coins went in a single transaction to an unlabeled address with a long transaction history. The 7,500 BTC still held by the SAFU address was worth about $583 million on the evening of November 3, which is half of the 15,000 BTC the fund held in February.
The movement matters because Binance has described the October 31 withdrawal as part of how it is covering losses from a hot-wallet theft of roughly $6.3 billion. Each additional transfer of those coins draws attention from analysts who track where the exchange's money goes, and so far the exchange has not said who controls the receiving address or why the coins were sent there.
2. Why does Binance keep a SAFU fund?
SAFU is a reserve that Binance set aside to reimburse users if the exchange suffers a security failure. Exchange operators in the industry have long kept similar emergency pools, because custodial platforms hold customer assets in pooled wallets, and a breach of those wallets can leave an exchange owing more than it holds. A dedicated reserve is meant to close that gap quickly, so that customers are made whole without waiting for lengthy recovery efforts or investigations to run their course.
The design carries a trade-off. A reserve that is large enough to absorb a serious loss ties up capital that the company could otherwise use in its business, while a reserve that is too small may not restore customer balances after a major theft. Binance's own rule, which calls for topping the fund up to $1 billion whenever its value dips under $800 million, reflects an attempt to keep the buffer within a defined range even as bitcoin's price rises and falls.
Because the fund is publicly visible on the blockchain, any outflow is immediately observable. That transparency is part of the appeal of such a reserve, and it is also why a movement of half its holdings, followed by further transfers of the same coins, is scrutinized so closely by analysts and by customers waiting for the exchange to finish compensating those affected.
3. How the October 31 withdrawal unfolded
The first leg of the journey took place on October 31. From the SAFU address that Binance publishes openly, two transfers were sent to an intermediate address: 1 BTC at 14:45 UTC, followed by 7,499 BTC at 14:51 UTC. The sequence looks like a test transaction followed by the main transfer, a habit common among operators who want to confirm that a destination address works before committing a large balance.
Binance addressed the withdrawal the same day. In an update posted on October 31, the exchange said a "partial deployment" of SAFU formed one part of its plan to cover the losses from the theft. It named two other sources: the insurance fund that backs its Futures business, and the company's own corporate treasury. Binance did not say how much would come from each of the three sources, so the share of the loss borne by the SAFU reserve remains unknown to outsiders.
The SAFU address had been funded entirely in February. It received 15,000 BTC across five deposits between February 2 and February 12, a build-up that followed Binance's decision to convert the fund into bitcoin. Since the October 31 outflow, the address has received only dust, the tiny residual amounts that often arrive on public addresses without any intent behind them.
4. Where the coins went on November 3
At 05:56 UTC on November 3, the intermediate address that had received the SAFU withdrawal sent all 7,500 BTC onward in one transaction. The recipient is an unlabeled address with more than 2,400 transactions in its history, a volume that suggests it is used for routine, high-throughput movement rather than being a freshly created wallet. Blockchain analytics firms usually attach labels to addresses once they can tie them to an exchange, a custodian or a known entity, and this one carried no such label.
About an hour later, at 06:46 UTC, the recipient split the balance into 150 separate outputs of roughly 50 BTC each. Splitting a large balance into uniform pieces is a standard step in moving funds between wallets or preparing them for distribution, and it is also a technique associated with obscuring a trail, although the records alone cannot show which purpose applied here.
The pieces then took different paths. Ninety-six of the 150 outputs, totaling 4,800 BTC, were used as inputs to a transfer of 9,346 BTC to another address at 14:53 UTC. The remaining 54 outputs were each spent in separate transactions the same day, with each of those transactions combining between 15 and 41 outputs. In effect, the coins were pooled into larger transfers and partly recombined with other funds, which makes it harder to follow any single coin back to its origin.
5. Why do repeated transfers draw attention?
Moving coins from one address to another is not unusual in itself, and exchanges routinely shuffle balances between cold storage, hot wallets and reserve addresses. What draws attention in this case is the combination of size, speed and destination. The coins left a clearly labeled reserve, passed through an intermediate address, landed on an address with no public identification and were then broken into 150 equal parts within about an hour.
Analysts who follow large movements typically look for three things: whether the receiving address can be tied to a known exchange or custodian, whether the amounts are consolidated again later, and whether the coins eventually reach a service where they can be sold. None of those questions has a confirmed answer for the SAFU bitcoin yet. The recombination of 4,800 BTC into a single 9,346 BTC transfer shows that the funds are being merged with other coins, which complicates any attempt to separate the SAFU portion from the rest.
Binance has not claimed that the transfers are anything other than part of its loss-coverage plan, and nothing in the public records establishes that the funds have left the company's control. The blockchain shows where coins moved, not who ordered the movement, and that distinction is the reason the lack of a label on the receiving address leaves the picture incomplete.
6. What does the SAFU fund hold now?
As of 20:53 UTC on November 3, the SAFU address held just over 7,500 BTC. Valued at the 20:40 UTC price of $77,798 per bitcoin, that comes to about $583 million. SAFU stands for Secure Asset Fund for Users, a reserve that Binance created to compensate customers in the event of a security incident, and it has long been presented as a backstop of last resort for the exchange's users.
The reduction is substantial. The fund held 15,000 BTC after the February conversion, so the October 31 outflow removed exactly half of it in a matter of minutes. Because the reserve is held in bitcoin rather than in a stable currency, its dollar value moves with the market, and the lower the bitcoin price, the smaller the cushion in dollar terms.
7. What has Binance promised about refilling the fund?
Binance has made two commitments that bear on the fund's size. The first is written into its SAFU FAQ: if the value of the fund falls below $800 million because of changes in the bitcoin price, the exchange will rebalance it back to $1 billion. At $77,798 per bitcoin, $800 million corresponds to about 10,283 BTC, so the roughly 7,500 BTC now in the address sits well below that threshold.
The second commitment came in the October 31 update, in which Binance said it was "committing to replenishing the SAFU" to about $1 billion. The exchange did not give a date. The FAQ rule covers shortfalls caused by price swings, whereas the present shortfall stems from a deliberate withdrawal, which is why the separate pledge matters. Neither promise has been accompanied by a timeline, and the address has shown no meaningful deposits since the outflow.
Binance's incident report published on November 3 traces the attack to a tainted developer installation, but it does not mention SAFU at all. That leaves the explanation for the fund's use confined to the brief statement of October 31.
8. How are customer flows at the exchange behaving?
The exchange has been trying to show that customers are returning. Binance said that by 03:00 UTC on November 3, hourly deposits had begun to exceed hourly withdrawals. A second phase of withdrawals was scheduled to start at 04:00 UTC, following the restart of withdrawals on November 1.
Aggregate data pulled at 20:45 UTC on November 3 told a more mixed story. It showed net inflows of $3.22 billion over the previous 24 hours, but net outflows of $12.17 billion over the previous seven days. In other words, the most recent day was positive, while the week as a whole still reflected the heavy withdrawals that followed the theft.
On November 2, Binance also published a zero-knowledge proof of reserves covering BTC, ether (ETH) and eight other tokens. Proofs of this kind let customers check that their balances are included in the exchange's reported liabilities without disclosing every account, and they have become a common response by exchanges seeking to rebuild confidence after a security event.
9. What to watch next
Several questions remain open. Observers will be looking for any deposit into the SAFU address that signals the start of the promised refill, and for any statement from Binance on who controls the unlabeled address that received the coins and what purpose the movements serve. The exchange has not provided either.
The next signals are likely to come from the chain itself. If the 150 outputs continue to be recombined and sent onward, analytics firms may eventually attach labels to the destinations. Until then, the only confirmed facts are the size of the fund, the timing of the transfers and Binance's pledge to restore the reserve to about $1 billion without a date attached.