The 7,500 BTC that left Binance’s Secure Asset Fund for Users, or SAFU, on Oct. 31 moved again early on Nov. 3, according to Unchained’s review of public blockchain data.
After Binance converted the fund in February, the SAFU wallet held 15,000 BTC. The remaining 7,500 BTC now represent half of that balance.
Binance had said SAFU was partially used
On Oct. 31, Binance said a partial deployment of SAFU was part of how it was covering losses from the roughly $6.3 billion hot-wallet hack. It also cited part of its Futures insurance fund and its corporate treasury. The exchange did not say how much came from each source.
CoinDesk reported the drawdown on Nov. 3.
What the blockchain data shows
At 05:56 UTC on Nov. 3, the intermediate address that had received the outgoing SAFU bitcoin sent all 7,500 BTC in a single transaction to an unlabeled address. That wallet has handled heavy volume over its lifetime, with more than 2,400 transactions. TechFlow reported the transfer earlier on Nov. 3.
At 06:46 UTC, that unlabeled address split the coins into 150 outputs of about 50 BTC each.
Ninety-six of those outputs, totaling 4,800 BTC, were later used as inputs in a 9,346 BTC transfer to another address at 14:53 UTC. The other 54 outputs each went into separate transactions that same day, with 15 to 41 outputs per transaction.
The coins had reached the intermediate address on Oct. 31 from Binance’s published SAFU bitcoin address, 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD, in two transactions: 1 BTC at 14:45 UTC and 7,499 BTC at 14:51 UTC.
That SAFU address received 15,000 BTC across five deposits between Feb. 2 and Feb. 12. Since the Oct. 31 transfers, it has received only dust. As of 20:53 UTC on Nov. 3, the address held just over 7,500 BTC. At mempool.space’s 20:40 UTC price of $77,798, that balance was worth about $583 million.
Binance’s refill rule
Binance says in its SAFU FAQ that it will rebalance the fund back to $1 billion if the fund’s value falls below $800 million because of BTC price fluctuations. At $77,798 per BTC, $800 million works out to about 10,283 BTC.
In its Oct. 31 update, Binance separately said it was committing to replenish SAFU and return the fund to approximately $1 billion. It did not provide a date.
Binance’s Nov. 3 incident report traced the attack to a tainted developer install. That report did not mention SAFU.
Nov. 3 flows and proof of reserves
Binance said on Nov. 3 that by 03:00 UTC, hourly deposits were exceeding withdrawals. The exchange also said a second phase of withdrawals would begin at 04:00 UTC that day, after withdrawals resumed on Nov. 1.
DefiLlama data pulled by Unchained at 20:45 UTC on Nov. 3 showed $3.22 billion of net inflows to Binance over 24 hours, against net outflows of $12.17 billion over seven days.
Binance also published a zero-knowledge proof of reserves for BTC, ETH, and eight other tokens on Nov. 2.
