Binance ordered to pay billions after historic hack: inside the SAFU fund

The crypto world has been rocked by the huge hack at Binance. On 29 October, about $6.3 billion in crypto disappeared from wallets belonging to the world’s largest crypto exchange. An estimated $3 billion has now been frozen, and Binance has promised to cover the remaining losses itself. Notably, the amount left after the freezes and the use of the emergency fund represents just 1.4% of the customer reserves Binance reported in early October.

Hackers drain billions from Binance wallets

According to CryptoQuant, the attack began at 20:24 UTC on 29 October with suspicious transactions from a wallet known as Binance 14.

Among the assets taken were 167,464 Ethereum, about $1.6 billion in USDT and dozens of other cryptocurrencies.

The stolen funds were then spread across several blockchains. CryptoQuant estimates the split as follows:

• Ethereum: $3.53 billion

• Bitcoin: $1.45 billion

• Tron: $628 million

• Arbitrum, Optimism and Base: $38 million

Binance suspects that the attackers gained access through a hacked laptop belonging to a DevOps employee. This allowed them to reach a system responsible for processing withdrawals.

According to the initial investigation, there are no indications that private keys were stolen.

Almost $3 billion in stolen crypto frozen

After the attack, several blockchain companies worked together to block as much of the stolen funds as possible.

According to CryptoQuant, Tether froze about 1.567 billion USDT, while Circle blocked more than $800 million in USDC. The Arbitrum Security Council also intervened and locked 74.6 million ARB and 8,425 Ethereum.

In total, this brings the amount of frozen funds to about $3 billion.

That leaves an estimated $3.3 billion of the original $6.3 billion that Binance must address.

The company says it will use its SAFU emergency fund and its own resources for this.

Binance has an emergency fund of $1.18 billion

Data from CryptoQuant shows that the SAFU fund contains about 15,000 Bitcoin, with an estimated value of $1.18 billion at a Bitcoin price of $78.500.

After use of this fund, the calculation leaves about $2.1 billion in losses that Binance must absorb from its own resources.

For comparison, the Proof of Reserves dated 1 October shows that Binance reports about $151.5 billion in customer assets across its eight largest cryptocurrencies.

The original hack therefore represents about 4.2% of these reserves. After the freezing of funds, this falls to 2.2%, and to about 1.4% after taking SAFU into account.

These percentages mainly express the relationship between the estimated losses and the reported reserves. They do not mean that the remaining losses are automatically covered.

Withdrawals temporarily suspended after huge outflow

The on-chain data also show striking movements during the incident.

In the hour of the attack, according to CryptoQuant, about 208,177 Ethereum and 18,322 Bitcoin left the exchange. That is 39 and 125 times as much as during a normal hour, respectively.

Not every outflow necessarily forms part of the hack. Regular customer withdrawals may also be included in these figures.

Binance temporarily suspended deposits and withdrawals to carry out additional security checks. According to the statement, co-CEO Yi He expects withdrawals to be available again within 48 hours.

Binance says customer assets are safe and has promised to publish an updated Proof of Reserves once the investigation is complete.

The coming days should make clear how much of the frozen crypto can actually be recovered and how quickly Binance will fully restore services.