BTC $78,441 
ETH $2,325 
MGLOEURO $111,813 
USDT $0.9988 
BNB $701.80 
XRP $1.29 
USDC $0.9994 
SOL $93.38 
TRX $0.3208 
FIGR_HELOC $1.03 Hacks & Security · Explained
Binance SAFU's 7,500 BTC moves again to unlabeled wallet
The bitcoin withdrawn from Binance's emergency user fund on Oct. 31 was sent onward three days later and split into 50 BTC outputs.
Key takeaways
- Half the fund. SAFU's bitcoin holdings fell from 15,000 BTC to just over 7,500 BTC after the Oct. 31 deployment.
- Unlabeled recipient. The 7,500 BTC went to an address with no public owner and more than 2,400 lifetime transactions.
- No timetable. Binance says it will restore SAFU to about $1 billion but has not said when.
What happened
The 7,500 BTC withdrawn from Binance's Secure Asset Fund for Users on Oct. 31 moved again early on Nov. 3. Public blockchain data reviewed by Unchained, along with reporting from Bitcoin.com News and TechFlow, shows an intermediate address sent the entire amount at 05:56 UTC to an unlabeled address that has handled more than 2,400 transactions.
At 06:46 UTC, that address split the coins into 150 outputs of about 50 BTC each. Ninety-six of those outputs, 4,800 BTC, were among the inputs to a 9,346 BTC transfer at 14:53 UTC; the other 54 went into separate transactions that day, each with 15 to 41 outputs.
The coins had arrived at the intermediate address on Oct. 31 from Binance's published SAFU address, 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, in two transfers: 1 BTC at 14:45 UTC and 7,499 BTC at 14:51 UTC. They stayed there about three days. Binance has not explained the purpose of the transfers.
First $85.8KLatest $78.3K-8.7% over the period
Points are daily observations, not closing prices.
Why it matters
SAFU is Binance's emergency reserve for customers, and the withdrawal halved its bitcoin holdings. The fund held 15,000 BTC after Binance converted it from stablecoins in February; it now holds just over 7,500 BTC. At the price cited in Unchained's review, the remainder was worth about $583 million, below the $800 million level in Binance's SAFU FAQ.
The FAQ says Binance will rebalance SAFU to $1 billion if its value falls below $800 million because of bitcoin price movements. That trigger is framed around price declines, not spending. Binance separately said on Oct. 31 that it would restore the fund to roughly $1 billion but gave no date. The transfers also provide the clearest public view so far of where the deployed coins went.
What the data shows
The SAFU address received 15,000 BTC across five deposits between Feb. 2 and Feb. 12 and has received only dust since Oct. 31. At 20:53 UTC on Nov. 3 it held just over 7,500 BTC, worth about $583 million at mempool.space's 20:40 UTC price of $77,798. At that price, $800 million equals about 10,283 BTC.
Bitcoin.com News valued the moved coins at well over $572 million. The 150 outputs of about 50 BTC, the 4,800 BTC used in the 9,346 BTC transfer and the 54 separate follow-on transactions together document how the stack was broken up on Nov. 3.
Background
Binance said on Oct. 31 that it was using a partial deployment of SAFU as part of covering losses from a hot-wallet hack of roughly $6.3 billion. It said the response also drew on part of its futures insurance fund and corporate treasury, without specifying the split. CoinDesk reported the SAFU drawdown on Nov. 3.
Binance's Nov. 3 incident report traced the breach to a tainted developer install and an abused internal wallet service; it does not mention SAFU. Bitcoin.com News reported that the post-mortem tied the attack to a fake job interview and compromised AI tools. Binance said it had replenished 98% of affected assets as of Oct. 31, with less liquid tokens still being bought.
After restarting withdrawals on Nov. 1, Binance said hourly deposits exceeded withdrawals by 03:00 UTC on Nov. 3. DefiLlama data cited by Unchained showed $3.22 billion of net inflows over 24 hours against $12.17 billion of net outflows over seven days. Binance published a zero-knowledge proof of reserves for BTC, ETH and eight other tokens on Nov. 2.
What is still unclear
The public data does not identify who controls the unlabeled address or why it received the coins. Binance has not explained the transfers or broken down how much of the hack coverage came from SAFU, the futures insurance fund and its treasury. It is also unconfirmed whether the 9,346 BTC transfer and smaller follow-on transactions relate to buying back missing tokens, as the routing pattern might suggest. Binance's pledge to restore SAFU has no stated timeline, and its FAQ trigger covers price-driven declines rather than spending.
What to watch
The next signals are whether Binance announces a replenishment schedule or says more about the deployed coins, and whether the unlabeled address is identified by the exchange or blockchain analysts. Further movement from the address that received the 9,346 BTC transfer would also be notable, as would updates to Binance's proof-of-reserves disclosures and the durability of recent net inflows.
Questions readers ask
What is Binance's SAFU fund?
SAFU is Binance's Secure Asset Fund for Users, an emergency reserve intended to protect customers in extreme events. Binance converted it to bitcoin in February, when it held about 15,000 BTC.
Where did the 7,500 BTC go?
It moved from Binance's published SAFU address to an intermediate address on Oct. 31, then to an unlabeled high-volume address on Nov. 3. That address split the coins into 150 outputs of about 50 BTC each and later used 4,800 BTC in a 9,346 BTC transfer.
Has Binance said it will refill SAFU?
Yes. Binance said on Oct. 31 that it is committing to replenishing SAFU to about $1 billion, but it did not give a date. Its FAQ's $800 million rebalancing trigger is tied to bitcoin price declines, not spending.
