In this article5 sections
Binance’s emergency Bitcoin wallet held roughly half its prior balance on Monday after the exchange drew on its user protection fund to cover losses from last week’s theft, Cointelegraph reported. The Secure Asset Fund for Users (SAFU) address held about 7,500 BTC, worth $583 million, after a transfer of 7,499 BTC confirmed on Saturday. Before the transfer it held around 15,000 BTC. Cointelegraph noted the fund has no stated deadline for being restored.
Key facts
- The SAFU wallet dropped to about 7,500 BTC from roughly 15,000 BTC following the 7,499 BTC transfer.
- The October 29 breach involved about $6.3 billion in cryptocurrency, the largest theft in crypto history; the FBI attributed it to North Korea and named the hackers TraderTraitor.
- Binance said roughly 95% of affected assets had been replenished by November 1, up from 90% the day before.
- Binance’s November 2 recovery update said the cryptographic proof for its October 31 snapshot was ready, a day ahead of the previously estimated November 3 completion.
- The snapshot covered ten tokens: Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash, each backed at least 1:1, crypto.news reported.
Proof of reserves goes live for users
Customers holding any of the ten covered assets can now check their balances against the October 31 snapshot through Binance’s proof-of-reserves site. The system pairs a Merkle Tree with zk-SNARK proofs: the tree shows a user’s balance was recorded, while the proof establishes reserves of at least 1:1 without revealing individual account figures, according to crypto.news. Users must log in and download the open-source verifier from the exchange’s official page; the code sits on GitHub and has been independently audited.
Also read: Binance probes wallet breach; $1.8B stablecoins frozen
SAFU’s stated policy calls for the fund to be rebalanced back to $1 billion if market swings push its value below $800 million, but it sets no deadline for topping up money spent after a security incident. Cointelegraph said Binance did not immediately answer questions about the fund’s remaining reserves, further deployments or refill plans.
Where the recovery stands
The remaining 5% of affected assets are tokens outside the ten covered in the reserve report. Binance has said these have thin liquidity, making large purchases slow, and is sourcing them through market trades, over-the-counter deals and industry partners. The exchange said it is using its corporate treasury, SAFU and part of its futures insurance fund to cover the shortfall, and that customers will not bear the losses.
Withdrawals resumed in stages on November 1, starting with 15 networks including Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Arbitrum, Base, Optimism and Avalanche C-Chain. A further phase is due to begin November 3, though the exchange has not announced which tokens and networks it will cover or when each goes live. A second snapshot covering more tokens is set for November 4, with its proof expected to take another 40 to 50 hours to generate.
The two reports differ in timing detail. Cointelegraph described withdrawals as reopening in phases on Sunday, while crypto.news dated the first phase to November 1 and placed the next phase on November 3. Both accounts agree the October 31 snapshot proof arrived ahead of schedule. crypto.news also reported that a compromised DevOps engineer’s laptop was identified as a possible entry point, that roughly $3 billion in assets were frozen with industry help, and that Binance plans a detailed post-incident report. Binance has said it will publish that report when its investigation concludes.
Why it matters
SAFU is one of the few publicly disclosed backstops an exchange holds for customer losses, so its halving is a visible measure of how much of this hack Binance is absorbing itself. The proof-of-reserves release shifts part of the verification burden onto users, who can now test the exchange’s claims rather than take published totals on trust. For traders, the staged withdrawal reopening is the practical test of whether operations have returned to normal.
What to watch
The November 3 withdrawal phase and the November 4 snapshot will show whether the exchange can keep pace with its own schedule. Two open questions remain: when SAFU returns to its $1 billion target, and which less-liquid tokens still make up the final 5% of unreplaced assets.
Reported by Cointelegraph.
Sources: Cointelegraph, crypto.news