Binance SAFU Transfers Show Movement, Not Completed Recovery
Two Bitcoin transactions show 7,500 BTC leaving Binance's declared SAFU wallet on 31st October, separately from its replenishment claims.
Binance's declared emergency reserve sent 7,500 Bitcoin (BTC) to one address in two transactions on 31st October 2026. The ledger provides a concrete record of funds moving after the exchange announced partial use of its Secure Asset Fund for Users (SAFU). It does not establish what the recipient subsequently bought or whether customers received those funds.
Our earlier incident report covers the theft and Binance’s initial recovery commitments.
Binance described replacement using several funding sources. Its 31st October company announcement put coverage of affected assets at 90%. Its 1st November recovery update raised that claim to approximately 95%, while describing phased withdrawal reopening.
Our report on the 95% coverage update details the company’s phased withdrawal plan.
What The Transactions Establish
The first transaction sent 1 BTC to the recipient. It was included in block 973983, timestamped 14:45:31 UTC on 31st October. The second transaction, in the next block at 14:51:41 UTC, sent another 7,499 BTC to the same address. These are the containing blocks' timestamps, not the transactions' first submission times.
Both transactions spent outputs associated with the Bitcoin address Binance named as SAFU. Each also returned a separate output to that sending address. Adding the two recipient outputs gives 7,500 BTC; counting every output would include the funds returned to the sender and overstate the amount sent elsewhere.
Binance's announcement supplies the reserve label. The public transaction records establish the addresses and amounts, without naming the recipient's owner. They also contain no record of an exchange purchase or a customer reimbursement. A transfer from the declared reserve therefore cannot, by itself, verify the percentage of affected assets Binance says it has replaced.
The Reserve Was One Funding Source
Binance described SAFU as an emergency fund for protecting user assets. Its 31st October announcement identified three resources for replenishment: a partial SAFU deployment, part of its futures insurance fund and its corporate treasury. It said the SAFU allocation would help purchase the remaining affected assets.
The 1st November update described the outstanding 5% as less liquid tokens that took longer to acquire in the required quantities. That is the company's explanation of the remaining purchases, rather than a conclusion supplied by the Bitcoin transfers.
Binance also committed on 31st October to rebuilding SAFU to approximately $1 billion after its use. That reserve commitment is separate from its promise to replace the assets affected by the incident.
