Binance draws on futures insurance fund to cover $6.3 billion hack

What happened

Binance has confirmed that it drew on part of its futures insurance fund while replacing assets stolen in the October 29 breach, using a reserve normally kept to absorb losses from bankrupt trading positions. The exchange's recovery update, published October 31 at 14:24 UTC, lists three sources for the replacement programme: its Secure Asset Fund for Users, known as SAFU, a portion of the futures insurance fund, and company treasury money.

Binance said the funds released from the futures reserve sat above its required protection level and that the transfer did not push coverage below that threshold. The exchange describes the futures pools as company reserves rather than user-owned assets, and says it tests the required minimum against historical stress scenarios using a 99.9% confidence interval, with review at least quarterly. It has not disclosed how much each of the three sources contributed, nor the minimum balance each affected pool must hold.

Customer access is returning. Bitcoin withdrawals resumed on November 1, the same day Binance said it had replenished 95% of affected assets. Its earlier replacement holdings included roughly $5 billion in the stolen cryptocurrencies, with the remainder slower to obtain because it was less liquid.

Why it matters

An insurance fund is the layer that stands between a failed position and the forced unwinding of other traders' positions, so its size is a risk measure customers cannot easily verify for themselves. Binance's published guide allows excess balances identified in a periodic review to be used for other purposes at the exchange's discretion, and provides for company top-ups when a pool falls below its minimum as well as rebalancing between pools. The 95% replacement figure does not identify the futures fund's share, leaving traders with public snapshots rather than a direct accounting of what the hack response cost the reserve.

What the data shows

Data collector Swolecharts listed approximately $1.85 billion across the Binance insurance funds it tracks at 09:00 UTC on November 1, down 24.96% over 24 hours, with balances divided among pools covering different contracts. An October 17 snapshot published by FeeØtter recorded 791,125,863 USDT and 499,980,384 USDC in the pool covering BTCUSDT. The reports caution that the readings cover different dates and do not isolate the transfer made for the hack response, since they span ordinary liquidation activity and possible reallocations. Binance publishes fund history split between USDⓈ-M and COIN-M records, refreshed daily at 00:00 UTC, but has not provided a pool-by-pool reconciliation.

Background

The breach surfaced on October 29. Binance put the affected total at about $6.3 billion; Chainalysis said unauthorized transfers from hot wallets began around 4:20 p.m. ET and came to about $6.4 billion, with freezes starting by 5:14 p.m. ET and roughly $2.8 billion secured. TRM Labs estimated about $6.36 billion moved across 10 blockchains, most of it within roughly 20 minutes. The FBI's October 31 alert attributed the theft to hackers it tracks as TraderTraitor, tied to North Korea, and published 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. Binance's early investigation suggested a DevOps engineer's laptop may have been compromised, giving access to an internal service used to send withdrawal transactions; the exchange said it found no evidence of leaked private keys and revoked the access. Liquidations across crypto topped $1.5 billion on October 30 as bitcoin and major altcoins fell.

What to watch

Chainalysis said on November 1 that launderers had moved more than $500 million through over 1,000 TRON addresses and had begun shifting funds onto Solana, after flagging an automated pattern in which many addresses received exactly 1 TRX before passing funds along. The FBI has asked infrastructure providers, from node operators to instant exchanges and DeFi platforms, to refuse transactions touching the listed wallets. What remains unresolved is the fund's real cushion: Binance has not matched its withdrawal to a pool-level breakdown, and the final cost of the replacement programme depends on how much of the stolen assets is recovered. Changpeng Zhao, the exchange's founder, thanked the Secret Service and other agencies in a November 2 post, saying they responded within minutes.

Questions readers ask