AriLeon

Fellow Binancians,
Our last update explained that Binance had set aside more than $6.34B in company funds to cover hacked losses, and we had already covered approximately 80% of the impacted amount of the hacked loss at that time.
That covered amount is now up to 90%.
All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%. We will continue to buy the remaining relevant token assets through market and OTC channels until the covered amount reaches 100% for all tokens. Binance will absorb the financial impact of these stolen funds, not our users.
The replenishment employed:
A partial deployment of the Secure Asset Fund for Users (SAFU). This is expected to happen over the next 24 hours; users can view the updated balance here.A portion of our Futures insurance fund. The remaining balance of the Futures insurance fund is a regulatory requirement. Users can check the updated balance of the fund here. Binance's own corporate treasury.
We continue purchasing the remaining affected stolen assets through market and OTC channels. The outstanding 10% consists of tokens outside the top ten listed above. These assets are less liquid, which means they may take longer to source in the required amounts. We are working with industry partners to complete the remaining acquisitions and will provide further updates as progress continues.
Separately, we have taken a new Proof of Reserve (PoR) snapshot at 2026-10-31 00:00 (UTC), and this has already been updated on the PoR website. The snapshot provides an updated view of assets that are fully accounted for and is part of our ongoing commitment to transparency. The full zero-knowledge proof takes approximately 40 to 50 hours to generate due to the computational workload, so users holding any of these ten tokens can independently verify that their assets are at a minimum 1:1 backed once the full proof is generated, estimated to be by Tuesday, 2026-11-03 (UTC).
Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions.
Our next milestone in focus is resuming the withdrawal services for users. We remain on track to reopen withdrawals within our previously stated timeframe (on Sunday, 2026-11-01) and will provide a further update as soon as details are confirmed.
FAQs
What is the Secure Asset Fund for Users (SAFU)?
SAFU is an emergency reserve fund established by Binance in July 2018 to protect user assets in extreme cases, such as security breaches or platform-level incidents. Binance allocated a percentage of trading fees to grow the fund to a substantial level over time.
The SAFU fund is held and managed by Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the Abu Dhabi Global Market (ADGM) Financial Services Regulatory Authority. A portion of the funds serves as capital reserves as part of Binance regulatory obligations in the ADGM.
Will Binance replenish the SAFU fund?
Binance is committing to replenishing the SAFU to return the fund size to approximately US$1 billion. We are replenishing SAFU to ensure it remains fully resourced and ready to protect users, consistent with its purpose as an emergency user-protection reserve.
If BTC is already 100% covered (as shown in the latest PoR snapshot), why are you still deploying the SAFU fund?
We are utilizing part of the SAFU fund to acquire the remaining 10% of outstanding assets in order to reach 100% coverage for all tokens.
Can a user view the SAFU Fund?
The SAFU wallet address is at:
BTC: 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD
It can be publicly viewed with blockchain explorers, such as: https://www.blockchain.com/explorer/addresses/btc/1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD
What are Futures Insurance Funds?
Futures Insurance Funds are safety nets provided by Binance that limit the impact of liquidations. Their primary purpose is to reduce the occurrence of counterparty liquidations (commonly referred to as ADL), protect futures traders from deficit losses resulting from bankrupt positions, and help ensure profitable positions are paid out in full. Futures Insurance Funds are funded by Binance, including Liquidation Clearance Fees collected by the platform, and are not part of user assets.
Binance has rebalanced its Futures Insurance Funds to move a portion of the balance to cover the affected assets.
Is there a higher risk of Auto-Deleveraging (ADL)?
The Futures Insurance Funds remain above the coverage level required under Binance’s established risk-management framework, helping ensure the fund remains available to support users during extreme market conditions. We monitor fund size continuously against historical stress scenarios reflecting extreme but plausible market conditions, and top it up when required. Due to volatility, no exchange can completely avoid auto-deleveraging, but we always strive to keep occurrences to a minimum.
Will Binance replenish the Futures Insurance Funds?
The funds are maintained above their required size. When the balance falls below the level our framework requires, Binance tops them up from company funds, as we have done previously. What was released was excess above that level, which is why it could be reallocated without affecting coverage.
Can a user view the Futures Insurance Funds on Proof of Reserves (PoR)?
No, not on PoR. The fund itself is publicly viewable here and refreshes daily at 00:00 (UTC).
PoR serves a different purpose: each user verifies that their own assets are fully backed. The Futures Insurance Funds are Binance’s own reserve and users can only view their own assets on PoR.
Can a user verify their assets are fully backed on Binance?
Yes. Users can verify their assets are fully backed on Binance. Learn more here.
Note: There may be discrepancies between this original content in English and any translated versions. Please refer to the original English version for the most accurate information, in case any discrepancies arise.
Thank you for your support!
Binance Team
2026-10-31

Binance co-CEOs Yi He and Richard Teng said the exchange has already covered about 80% of the roughly $6.3 billion lost in its security incident and will absorb the full cost itself. In a letter to users dated Friday, October 30, they said Binance’s hot wallets were compromised at about 20:05 UTC on October 29.
“Binance will absorb the financial impact of these stolen funds, not our users,” they wrote.
About 80% Already Covered
Binance will cover all stolen funds through its Secure Asset Fund for Users (SAFU) and its corporate treasury, the co-CEOs said. The exchange has set aside more than $6.34 billion, $5 billion of which is held in the exact tokens that were stolen, including USDC, USDT, BTC, ETH and BNB. That covers about 80% of the loss, and Binance is buying the remaining tokens through market and over-the-counter channels.
What Binance Has Done So Far
Since identifying the incident, Binance has:
Contained the compromised infrastructure, revoked affected authorizations and added controls to prevent further unauthorized activity.Frozen about $3 billion on-chain with help from law enforcement, blockchain intelligence firms, asset issuers and industry partners.Strengthened security checks across affected systems.Paused withdrawals for security reviews, while keeping deposits and other unaffected services running.
What the Investigation Has Found
Binance’s initial investigation pointed to a compromised laptop, and further work has uncovered additional points of breach. The exchange said it has found no evidence that wallet private keys were leaked. It is working with internal and external security experts to map the full attack sequence and expects to share further verified technical findings in about 48 hours.
Withdrawals and Proof of Reserves
Binance said in Friday’s letter that it aimed to start resuming withdrawals within about 34 hours, in phases, once security checks are complete. It also planned an initial Proof of Reserves snapshot within 12 hours, with results by Monday, November 2, so users can verify their balances and how they are backed.
The exchange will also publish a post-mortem report covering what happened, lessons learned and new safeguards. “We take full responsibility for addressing this security incident, strengthening our security infrastructure, and ensuring our users are protected,” the co-CEOs wrote.