Binance will use half of the money in its Secure Asset Fund for Users (SAFU) to cover losses from the $6.3 billion hack that hit the world’s largest cryptocurrency exchange on October 29, co-founder Yi He has said, while keeping the remaining half in the fund.
The statement, reported in The Times of India’s November 1 live blog, is the clearest detail yet of how much of Binance’s dedicated emergency reserve will be spent on the incident. It does not change Binance’s wider pledge: the company says it will cover all losses, and that user funds are safe.
SAFU is only part of the funding plan. Binance has said it set aside more than $6.34 billion in company funds, including the SAFU amount, to restore affected balances. About $5 billion of that was already held in the same cryptocurrencies that were stolen, with the rest being bought through market and over-the-counter channels.
Why the SAFU share matters
SAFU was set up in 2018 as Binance’s emergency reserve for exactly this kind of incident. It is held in bitcoin, and reporting before this weekend put its value at roughly $1.1 billion to $1.23 billion – well under a fifth of the estimated $6.3 billion total impact.
That arithmetic is why the 50% figure matters. Using half of SAFU leaves a reserve for a future incident, while the bulk of the bill is carried by Binance’s corporate funds and revenue. Yi He has separately told co-founder Changpeng Zhao that the company’s annual revenue is sufficient to cover the remaining losses, and that Binance does not yet need to sell its SpaceX-linked shares.
An on-chain trace reported by Fathom News said a Saturday transfer moved 7,499 bitcoin, about $581 million, out of a SAFU address. That report itself noted Binance has not explained in detail how the on-chain figures fit together, so the exact remaining SAFU balance is not independently confirmed. This article therefore reports the 50% allocation as Yi He’s stated plan, not as a verified balance sheet.
What happened in the hack
Binance estimates the total impact at around $6.3 billion. Its initial investigation points to a compromised DevOps engineer’s laptop giving an attacker access to a service container, from which unauthorised withdrawal transactions were submitted. Binance says it has found no evidence that wallet private keys leaked.
About $3 billion of the stolen assets has been frozen on-chain with help from stablecoin issuers and other firms, including Tether and Circle. Frozen is not the same as returned: the frozen funds still have to be released back to Binance before they can be used to restore balances.
Withdrawals were suspended after the hack, while deposits and trading continued. Binance has targeted a phased restart of withdrawals from Sunday, November 1, subject to security checks, and has promised an updated proof-of-reserves snapshot, with results expected on Monday, November 2.
Related coverage on Emadan: Binance Says 90% of $6.3 Billion Stolen Crypto Replenished, Withdrawals Set to Resume November 1 (https://emadan.store/binance-replenishes-90-percent-stolen-crypto-hack-withdrawals-november-1/); US Secret Service Hunts Binance Hackers After $6.3 Billion Crypto Heist (https://emadan.store/us-secret-service-binance-hack-stolen-funds-trace/); Binance Says $6.3 Billion Hack May Have Started With a Compromised DevOps Laptop (https://emadan.store/binance-hack-devops-laptop-6-3-billion-frozen/).
What is still unknown
Binance has not published a detailed breakdown of the SAFU balance before and after the payment, nor a final figure for what remains frozen versus recovered. Blockchain analytics firms have attributed the theft to North Korea-linked actors, but Binance itself has not named a culprit, and attribution is a separate developing story.
Users should also note the distinction Binance itself draws: the promise that balances will be honoured is a company commitment, not deposit insurance.
Frequently asked questions
What is SAFU? The Secure Asset Fund for Users, Binance’s emergency reserve set up in 2018 to protect users in security incidents, held in bitcoin.
Does using half of SAFU mean users lose money? No, on Binance’s account: SAFU is one funding source among several, and the company says it will cover all losses from SAFU plus company funds.
When do withdrawals resume? Binance targeted a phased restart from Sunday, November 1, subject to security checks.
Sources: The Times of India live blog, November 1 (https://timesofindia.indiatimes.com/india/india-international-breaking-news-today-november-1/liveblog/135410608.cms); Fathom News on-chain trace (https://medium.com/@fathomnews.infra/binance-hacker-sits-on-484m-in-ether-launders-the-rest-074e2cc7f4de); Wall Street Journal on Binance covering losses
(https://www.wsj.com/finance/currencies/how-binance-is-scrambling-to-cover-losses-in-the-biggest-heist-in-crypto-history-babbfe90); CoinDesk, October 29-30 (https://www.coindesk.com/business/2026/10/29/ptential-multi-billion-binance-hack-hitting-cryptomarkets); Nacionale SAFU explainer (https://www.nacionale.com/en/articles/binance-hack-users-funds-safu-what-happens-next).
