Binance's $572M SAFU Bitcoin Lands in Unlabeled Wallet, Then Splits

The 7,500 bitcoin Binance yanked out of its emergency user fund is moving again. At 05:56 UTC on Nov. 3, the intermediate address holding the coins fired all of them off in a single transaction to an unlabeled wallet — one that has chewed through more than 2,400 transactions over its life. Fifty minutes later, that wallet split the stack into 150 outputs of roughly 50 BTC apiece.

Then came the recombination. Ninety-six of those chunks, 4,800 BTC in total, got bundled into a 9,346 BTC transfer, while the other 54 pieces left in separate transactions that same day. Chopping a large holding into 50 BTC slices and gluing some back together is the classic signature of an exchange routing coins to market makers or over-the-counter desks to buy back tokens it owes. But nothing in the data names the receiving address, and Binance hasn't explained the transfers.

Rewind to Oct. 31, when the coins left Binance's published SAFU address, 1BAuq7Vho2…, in two transactions: 1 BTC at 14:45 UTC and 7,499 BTC at 14:51 UTC. They parked at an intermediate address for three days before the Nov. 3 move. Binance called it a “partial deployment” of the Secure Asset Fund for Users, one of three pots — alongside part of its futures insurance fund and its own corporate treasury — covering losses from the hot-wallet breach. It never said how much came from where.

At bitcoin's current price of about $77,700, the moved coins are worth well over $572 million. SAFU held 15,000 BTC back in February, after Binance finished converting the roughly $1 billion fund from stablecoins into bitcoin. Now it holds just over 7,500 BTC — half of what it had — which puts it below a line Binance drew itself. The SAFU FAQ says the exchange will rebalance back to $1 billion if the fund's value “falls below $800 million due to BTC price fluctuations.” The catch: that rule covers price drops, not spending.

Binance says it is “committing to replenishing the SAFU to return the fund size to approximately US$1 billion,” but it hasn't given a timeline. Its Nov. 3 incident report, which traced the attack to a tainted developer install and an abused internal wallet service, doesn't mention SAFU at all. According to Bitcoin.com News, the post-mortem tied the breach to a fake job interview and compromised AI tools. Binance says it has carried the full cost and replenished 98% of impacted assets as of Oct. 31, with less liquid tokens still being bought.

Meanwhile, the exit has steadied. Binance posted that by 03:00 UTC on Nov. 3, hourly deposits were outpacing withdrawals, with $3.22 billion of net inflows over 24 hours against $12.17 billion of net outflows over seven days. That flip followed a brutal stretch — a $7 billion post-hack exodus set against the $6.3 billion breach itself. All eyes now sit on that unlabeled wallet, and on whether SAFU gets topped back up.