What Binance's SAFU actually covers, and what it does not

Binance’s Secure Asset Fund is a pool of money the exchange itself funds and controls. We found no published payout rule, eligibility condition or stated balance that an individual account holder could point to and invoke, and we cannot describe the fund as insurance, because we hold no policy for it.

That distinction only becomes visible when a fund is actually used, which is what happened at the end of October 2026. The figures below all come from a compiled account of the 2026 Binance hack that cites CNBC, the BBC, The Guardian, Reuters, The New York Times, Sky News and Deutsche Welle. We read that compilation and its citations on 1 November 2026, and we have dated every figure to the outlet and day the compilation attributes it to. None of the timeline below is our own investigation.

What happened on 29 October 2026

On 29 October 2026 roughly 6.3 billion US dollars in crypto assets left Binance wallets. Reported estimates range from 6.3 to 6.4 billion dollars, attributed by CNBC on 30 October. The compilation records the incident as the largest of its kind, surpassing the 1.5 billion dollar Bybit hack of 2025.

The assets moved across ten blockchains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon, per CNBC on 30 October. CNBC reported the first transaction on the XRP Ledger at 4:05 p.m. ET and the final Ethereum transaction at 7:56 p.m. ET, with roughly 6.36 billion dollars leaving ten blockchains within a window of about 20 minutes according to Deutsche Welle and CNBC.

Stablecoin issuers moved within the hour. CNBC reported on 29 October that Tether froze wallets at 5:01 p.m. ET and Circle followed three minutes later, and that Binance removed the attackers’ permissions from its hot wallet at 8:10 p.m. ET. Binance halted trades and suspended withdrawals on 29 October, as reported by The New York Times and CNBC. The Guardian reported on 1 November that withdrawals resumed, starting with Ethereum, USDT, USDC and some tokens on Binance’s own chain.

Of the assets taken, CNBC reported the position as at 30 October: about 3 billion dollars in stablecoins frozen by issuers and partners, about 1.5 billion dollars in bitcoin that could not be frozen, and about 1.8 billion dollars in other assets remaining with the attackers. Binance put the frozen figure at about 3 billion, Chainalysis at about 2.8 billion and TRM Labs at about 2.7 billion. The US Secret Service said it was working to track, freeze and recover the stolen funds, per the BBC on 30 October.

The promise Binance made, in its own words

On 31 October Binance said it would absorb the losses. The BBC quoted the statement as: Binance will absorb the financial impact of these stolen funds, not our users. Binance also said user funds were completely safe. A day earlier, on 30 October, the BBC reported that Binance said it had set aside 6 billion dollars to cover losses. On 31 October Binance said it had replenished 90 per cent of the losses, and that the remaining 10 per cent were less liquid tokens, per the BBC and Reuters.

That is a company statement about one incident. It is not a published rule, and we hold no document that turns it into one.

The loss was not covered by one fund, it was covered by four

This is the part worth sitting with. The Guardian reported on 1 November that Binance used its Secure Asset Fund, its Futures Insurance Fund, a bitcoin reserve and its corporate treasury to buy tokens to cover the losses. Four separate pots.

The composition tells a reader something the word “fund” obscures. The cover did not come from a single dedicated pool. It came from four pots, all of them the exchange’s own money, used to buy tokens in response to this incident. We hold no payout rule, eligibility condition or balance for the Secure Asset Fund or the Futures Insurance Fund, so we cannot tell you how either was meant to work on its own. That is not a criticism of how Binance responded; it is a description of what the record shows.

What a self-insurance pool does not come with

Stated plainly, as facts about the mechanism rather than as warnings:

1. No published payout rules. We have not read Binance’s own terms covering the Secure Asset Fund or the Futures Insurance Fund, and we hold no payout rule, eligibility condition or claims process for either. Where this page says nothing about how a payout would work, that is why.
2. No stated size. The only figures we have are the 6 billion dollars Binance said it had set aside, per the BBC on 30 October, and the 90 per cent replenishment Binance reported on 31 October. We hold no balance for either fund on any date, before or after the incident.
3. Funded and controlled by the exchange. The money in these pots is the exchange’s money. We found no published scheme, regulator or government standing behind it, and we also hold nothing that establishes it is outside any such arrangement. We are telling you what we have and what we do not.

On how the attack happened, we hold very little and will not stretch it. Binance initially said the attack began with a compromised software engineer’s laptop used to make unauthorised withdrawals, per Deutsche Welle and Sky News. The BBC reported Binance chief executive Richard Teng saying the attackers used a multi-signature protocol, EIP-7702, against the hot wallet. Sky News reported the attackers likely prepared at least 36 hours in advance. On attribution, the compilation records that TRM Labs linked the hack to North Korean hackers, as reported by the BBC, Deutsche Welle and The Guardian, and that the hack is attributed to TraderTraitor, which Euronews describes as appearing to be part of the Lazarus Group. That is reported attribution by named firms via named outlets, not our finding.

A fund and a reserve attestation answer different questions

Readers conflate these constantly, so it is worth separating them.

A reserve attestation is about holdings: does the venue hold assets against the customer balances on its books, at the moment someone looked. An insurance or self-insurance pool is about liability: who pays when assets go missing. A venue can publish a clean reserve snapshot and still have no published rule about who bears a loss, and it can promise to absorb a loss without that promise saying anything about reserves.

Our page on reading a venue’s published reserve figures sets out what a per-asset reserve ratio does and does not establish, and why the date a reader checked it is part of the figure. It is built the same way as this page: from what the venue published and the date we read it. On Binance, the only sourced fact we have is that the BBC reported on 30 October that Binance intended to publish proof of reserves on 2 November.

What we could not confirm

• Any balance, size, history or payout rule for the Secure Asset Fund or the Futures Insurance Fund. We have not read Binance’s terms covering either.
• The TRM Labs and Chainalysis findings directly. The TRM Labs page returned HTTP 403 to us on 1 November 2026, so every attribution statement here is reported attribution.
• Whether the proof of reserves was published or what it contained. Our reading date was 1 November 2026, the day before the date the BBC reported Binance intended to publish.

Education only, not financial advice, and trading carries a risk of loss.