Binance has spent half its SAFU bitcoin: about 7,500 BTC left on-chain, with no date for a refill

What the chain shows

The SAFU (Secure Asset Fund for Users) bitcoin address Binance publishes is 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD. When BlockBlah checked it on mempool.space at 4:06 p.m. Taipei time on November 3, it held about 7,500.0014 BTC, with no pending transactions.

The address received 15,000 BTC in five transfers between February 2 and 12, 2026, matching Binance's switch of the roughly $1 billion fund from stablecoins into bitcoin. On October 31, at 10:45 p.m. and 10:51 p.m. Taipei time, it sent out 1 BTC and then 7,499 BTC, 7,500 BTC in total, exactly half the original amount. Two more transactions in the following hours netted to zero.

What Binance has said

Binance's October 30 announcement put the estimated impact of the security incident at about $6.3 billion, said partners had frozen around $3 billion on-chain, and said losses would be covered by SAFU and company funds. It said the initial investigation pointed to a compromised DevOps engineer's laptop and found no evidence of a wallet private key leak.

Its October 31 update said about 90% of the stolen assets had been replaced using the corporate treasury, part of the futures insurance fund and a partial SAFU deployment, and that only the insurance fund's surplus above its required level was moved. Binance pledged to bring SAFU back to about $1 billion but gave no timeline and did not say how much of the insurance fund it used.

The fifth update, on November 2, put the replenished share at about 95%. The remaining 5% consists of less liquid tokens Binance is still buying.

The $800 million rule does not cover this

Binance's SAFU FAQ says that if the fund's market value falls below $800 million "due to BTC price fluctuations," Binance will rebalance it back to $1 billion. That rule is written for price declines. This time the balance fell because the fund was spent, which the wording does not cover.

At $76,604, 7,500 BTC is about $575 million. Getting back to $1 billion at that price would take roughly another 5,550 BTC. Binance's refill pledge is a separate commitment from the FAQ rule, and there is no date to hold it against yet.

BlockBlah's view: the address is public and anyone can check it. Incoming transfers on-chain will show whether a refill has happened more reliably than any statement.

What the proof of reserves does and does not show

Binance said on November 2 that the zero-knowledge proof of reserves for its snapshot at 00:00 UTC on October 31 was complete, with reserve ratios of 100% or more for 10 assets: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Users can download an open-source tool to confirm their own balances were included.

The proof covers that single moment and only those 10 assets; the 5% of tokens not yet replaced are outside it. It is also not an audit of the company's overall finances. Binance says it will take another snapshot covering more tokens on November 4, and co-CEO Yi He said the proof takes about 40 to 50 hours to compute after a snapshot.

Back to the market

Coinbase quoted bitcoin at $76,604 at 4:07 p.m. Taipei time on November 3. Investing.com reported that bitcoin had fallen earlier that day to its lowest level since early September.

According to data cited by TokenPost and TechFlow, US spot bitcoin ETFs had net outflows of $398.6 million on November 2, including $405.3 million out of BlackRock's IBIT. Investing.com linked the outflows to the Binance incident. BlockBlah cannot verify that causal link, since a tech-stock sell-off and the US midterm elections were in play at the same time.

Three things are worth checking next: whether any bitcoin flows back into the SAFU address, when the proof for the November 4 snapshot arrives and which tokens it covers, and whether Binance discloses how much of its futures insurance fund it used.