Binance SAFU Bitcoin Reserves Fall by Half as Exchange Reopens Withdrawals

Binance says it has restored about 95% of assets affected by Thursday’s $6.3 billion hack. That recovery figure is up from 90% the previous day, but it doesn’t settle a separate question: the exchange’s emergency Bitcoin reserve has fallen by roughly half, and Binance hasn’t said when it will replenish it.

On Saturday, the exchange confirmed a transfer of 7,499 Bitcoin (BTC), linking it to a partial deployment of its Secure Asset Fund for Users (SAFU). By Monday, the publicly disclosed wallet held about 7,500 BTC, worth $583 million. It had held around 15,000 BTC before the transfer.

Those figures show a sizable draw on a fund Binance presents as a user protection measure. They don’t, by themselves, establish how much of the hack’s losses SAFU covered, how much remains available elsewhere, or how quickly the reserve could be rebuilt. The exchange’s account of asset recovery and the publicly visible wallet balance answer different questions.

Restoring affected assets

Binance began reopening withdrawals in stages on Sunday, after suspending them while it worked to replace the stolen assets. The exchange said it had replenished approximately 95% of affected assets, compared with 90% the previous day. The remaining tokens are less liquid, it said, and Binance is continuing to acquire them through market and over-the-counter transactions.

That last portion may take more work than the headline percentage suggests. Less-liquid assets can be harder to source in the quantities needed, and buying them through different channels means restoration is a process rather than a single transfer. Binance hasn’t given a timeline for completing the purchases, so users are left with a progress figure rather than a firm endpoint.

The exchange is drawing on its corporate treasury, SAFU and part of its futures insurance fund to cover losses. That mix indicates the response isn’t being funded from a single pool. It also makes it harder for outsiders to assess the reserve’s condition from the SAFU wallet alone, since the wallet balance doesn’t describe the contributions from the other sources.

The theft, described in the source as the largest in cryptocurrency history, prompted Binance to suspend withdrawals as it worked to replace stolen assets. The FBI attributed the attack to North Korea on Saturday, naming the hackers TraderTraitor. That attribution identifies who the FBI says was responsible; it doesn’t, on its own, explain how Binance will account for the incident or restore its emergency reserve.

SAFU’s policy describes routine monitoring and rebalancing. “If the fund’s market value falls below US $800 million due to BTC price fluctuations, Binance will rebalance the fund to restore its value to $1 billion,” it says. That language addresses a fall caused by Bitcoin price movements. The policy doesn’t set a schedule for replacing funds used after a security incident, leaving the current replenishment question unanswered.

This is more significant than it looks. A reserve can serve as a public signal of preparedness, but the usefulness of that signal depends on whether users can understand its size, the conditions under which it’s used, and what happens afterward. Binance has disclosed a policy for price-driven rebalancing; the gap is what users can expect after a security-related drawdown.

Related: Binance hackers begin swapping stolen Solana tokens for Bitcoin: Chainalysis

Proof of reserves

Binance said Monday that users could verify their balances against a Saturday proof-of-reserves snapshot, after completing its cryptographic proof. The snapshot covered customer holdings in 10 cryptocurrencies, including Bitcoin, Ether and USDT, and showed those balances backed at least 1:1.

Proof of reserves gives users a way to compare reported customer liabilities with assets included in a snapshot. That can provide useful information about the holdings covered by the exercise, but the stated scope matters: this snapshot covered 10 cryptocurrencies. It doesn’t answer every question about the exchange’s finances, the SAFU wallet’s future balance, or how the losses from this incident are being divided among funding sources.

Binance plans another snapshot on Wednesday covering more tokens. Generating the accompanying proof is expected to take 40 to 50 hours, so users won’t see the expanded results immediately. Binance hadn’t immediately responded to questions about SAFU’s remaining reserves, any further deployments or its plans to restore the fund.

If you're working in this space, the distinction to watch is between account recovery and reserve recovery. The first concerns whether affected assets are being replaced; the second concerns the capacity Binance says it keeps for future user protection. The reported 95% progress is encouraging for customers waiting on asset restoration. It doesn’t resolve how the depleted reserve will be rebuilt.

What the remaining questions mean

For users, the next useful disclosures would be straightforward: how much SAFU remains after the transfer, whether Binance expects to make additional deployments, and what plan it has for replenishment. The exchange’s policy describes a target after a price-driven decline, while the current situation involves a security incident. That difference leaves room for uncertainty about when the fund will return to its prior level.

And yet, the wallet balance is only one part of the picture. Binance says it’s also using its treasury and part of its futures insurance fund, and it’s continuing to source less-liquid tokens. Those details matter, but without a fuller accounting, users can’t easily connect the recovery percentage to the resources spent or remaining.

Here’s the thing: a reserve’s credibility depends not only on what it holds before an incident, but also on how clearly the exchange explains its use afterward. (and this is the part most people overlook) A large recovery figure can coexist with unanswered questions about the safety net meant to absorb losses. For now, Binance has described the draw and its recovery work; the replenishment timetable is still missing. A question left open.

Magazine: THORChain founder rejects freeze request, CZ thanks Secret Service: Hodler’s Digest

Cointelegraph says it produces news, reviews and analysis with journalistic independence. Its standards and processes are outlined in its Editorial Policy.