Binance said on Saturday that it has now covered 90% of the roughly $6.3 billion in tokens stolen from its hot wallets, up from about 80% a day earlier, after drawing on its SAFU emergency fund, part of its futures insurance fund and its own corporate treasury. The exchange repeated that users will not carry the loss and said it remains on track to reopen withdrawals on Sunday, November 1.
The figure needs careful reading. “Covered” means Binance has put replacement assets in place with its own money. It does not mean 90% of the stolen funds have been taken back from the attacker.
What Binance said in Update #3
In its third security incident update, on Saturday, Binance said: “All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%.” It added: “Binance will absorb the financial impact of these stolen funds, not our users.”
The missing 10% sits in tokens outside that top-ten list. Binance described them as less liquid and said they may take longer to source. It plans to keep buying them through market and OTC channels until coverage reaches 100%.
The money came from three places, according to the post:
SAFU: a partial deployment of the Secure Asset Fund for Users, which Binance set up in July 2018. The fund is held by Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the Financial Services Regulatory Authority of Abu Dhabi Global Market. Binance said it will refill SAFU to about $1 billion.
Futures insurance fund: a portion of the pool that normally absorbs losses from liquidations. Binance said the balance left behind is a regulatory requirement and stays above the required level.
Corporate treasury: Binance’s own balance sheet.
Half of the SAFU bitcoin address moved in six minutes
About two hours after the update, Binance said the SAFU transfer was finished. “Update: SAFU fund transfer is complete – this was the large 7,499 $BTC transfer visible here,” the exchange said, linking to the transaction.
AltcoinReporter checked the public SAFU address that Binance names, 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, on a block explorer. On Saturday afternoon it sent 1 BTC to a new address, then 7,499 BTC to the same destination six minutes later. That is 7,500 BTC in total, worth roughly $580 million at Saturday prices near $77,500. The SAFU address held about 7,500 BTC afterwards, so Saturday’s draw took roughly half of the bitcoin it held.
Binance has not said what share of the fund’s other assets was used. The post said only that part of SAFU is going toward the remaining 10%.
Covered is not the same as recovered
The amount actually stopped on-chain is much smaller. In Update #2 on Friday, Binance’s co-CEOs, who signed the post as Yi and Richard, put the loss at about $6.3 billion and said about $3 billion had been frozen on-chain with help from law enforcement, analytics firms, token issuers and other partners. Binance dates the breach to the evening of October 29 and said investigators had found additional points of breach beyond a compromised laptop, with no evidence that wallet private keys leaked.
Blockchain analytics firm Chainalysis puts the theft at about $6.4 billion. It attributes the attack to North Korea’s TraderTraitor group and says about $2.8 billion is frozen. Binance itself has not named an attacker.
CNBC noted that the 90% figure does not mean Binance has recovered 90% from the attacker. CNBC also reported that co-CEO Richard Teng later said the attack involved a more complex process than the misuse of a single engineer’s permissions.
For context, the Bybit theft in February 2025 was about $1.5 billion. The Binance figure is more than four times that. AltcoinReporter covered how Bybit later sued North Korea and won a freezing order over its stolen funds.
Proof of reserves slips a day
Binance took a new proof-of-reserves snapshot at the start of October 31, and the snapshot is already on its proof-of-reserves page. The full zero-knowledge proof takes 40 to 50 hours to generate, and Binance now expects it by Tuesday, November 3. On Friday it had pointed to results by Monday.
Binance says the proof will let holders of the ten fully covered tokens verify for themselves that their assets are backed at least 1:1. Until it is published, the coverage figures rest on Binance’s own statement.
What to watch on Sunday
Withdrawals are the next test. Update #2 described a phased reopening, and deposits have stayed open throughout. Large outflows in the first hours would show how much users trust the coverage claim.
Three other items remain open: the pace at which Binance buys the illiquid long-tail tokens, the refill of SAFU back to about $1 billion, and the post-mortem report the exchange has promised. Readers comparing exchange safeguards can also see our earlier Binance vs OKX comparison, which includes the SAFU fund among Binance’s safeguards.
FAQ
Has Binance recovered 90% of the stolen crypto? No. Binance says it has covered 90% using SAFU, part of its futures insurance fund and its corporate treasury. About $3 billion has been frozen on-chain, according to Binance.
When do Binance withdrawals reopen? Binance says it is on track to reopen withdrawals on Sunday, November 1, in phases.
How much bitcoin left the SAFU fund? Binance said the SAFU transfer was a 7,499 BTC transaction. On-chain data shows a separate 1 BTC transfer to the same address six minutes earlier.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
