Binance Taps SAFU and Futures Insurance Funds After $6.3B Hack

Binance draws on SAFU and futures insurance

Binance said replenishment combines corporate treasury, SAFU and futures insurance reserves. It described the insurance portion as excess above required coverage and said the fund remains above its risk-management minimum. It did not disclose the contribution from each source.

This advances the earlier corporate allocation and replacement-purchase announcement, which described more than $6.34 billion set aside. The new disclosure identifies additional reserve mechanisms being used, rather than merely increasing a running replacement count.

SAFU is an emergency protection pool. Futures insurance serves a different function: absorbing deficits from liquidated trading positions. Drawing on both makes the allocation between breach response and protection against trading losses relevant to customers using derivatives.

The company’s assurance about remaining insurance coverage is its own assessment. Without the amounts transferred, readers cannot calculate how much of each reserve is being consumed or independently compare the resulting cushion with the pre-incident balance.

Funding a replacement also differs from buying the exact token owed. A customer holding a less liquid asset depends on the exchange obtaining that asset in sufficient quantity, even when money has already been allocated to do so.

Binance hack losses remain distinct from replenishment

The loss-impact review, checked at 23:07 UTC October 31, found differing attributed estimates rather than one final recovery total. TRM Labs traced approximately $6.36 billion across ten blockchains at transfer-time prices; its investigation reflects observations as of October 30 at 00:30 UTC.

TRM described an initial burst beginning at 20:05 UTC October 29 and a second wave affecting Avalanche and Polygon around 23:05 UTC that day. Those are stages of the original incident, not evidence of a newly confirmed October 31 breach.

Elliptic’s separate analysis estimated $6.43 billion stolen across eleven chains and verified $2.85 billion frozen or seized. Its October 31 update uses a freeze-and-seizure snapshot around 04:30 UTC. Different coverage and valuation cutoffs mean those figures should not be combined into a single calculation.

Elliptic also identified a large Ethereum transfer and 18,270 stolen BTC, supporting actual exploitation rather than a vulnerability-only account. Its October 31 laundering update reported approximately $93.5 million distributed from a main Tron wallet to around 150 wallets as of 08:48 UTC.

Those receiving wallets are not a count of affected customers. The reviewed disclosures do not establish a unique customer-victim total or final net loss after recoveries. Frozen funds are restricted assets; they are not automatically funds returned to Binance.

The earlier initial hack coverage described Binance’s pledge to absorb losses. Replenishment measures progress toward honoring that pledge, while the laundering evidence concerns assets still moving beyond the exchange’s control.

Reserve snapshot precedes full November 3 proof

Binance says 90% of affected assets are replenished and ten named tokens are fully backed. The remaining assets are less liquid. Its new snapshot is dated October 31 at 00:00 UTC, but the full cryptographic proof is estimated for November 3 UTC; withdrawals remain targeted for November 1.

The reserve portal describes a mechanism for checking customer asset backing. A dated balance record and the completed verification process answer related questions at different stages. Neither alone demonstrates that a particular withdrawal has settled in a receiving wallet.

The PCAOB’s investor advisory explains that proof-of-reserve reports are not financial-statement audits. Such reports may omit liabilities, legal rights and the effectiveness of internal controls. That is general guidance, not a finding about this specific snapshot.

Alternative.me’s Fear & Greed Index read 30, or Fear, unchanged from the previous day. It measures sentiment rather than reserve adequacy.

The next tests are a confirmed withdrawal reopening, completion of the proof and disclosed balances after reserve transfers. The amount drawn from each funding source and the final recovery of stolen assets remain unresolved.