safu

The cryptocurrency exchange platform Binance released a preliminary investigation report on a security incident, disclosing the attack process in which approximately $6.3 billion in assets were stolen. The report states that an engineer, referred to as Little A, from the wallet operations team, searched for and installed an AI programming tool in June 2026, downloading a tampered Homebrew installation package from the search results. After the security team discovered the anomaly, they replaced the relevant equipment, but Little A still exposed the wallet infrastructure permissions.The report indicates that the attacker continued to lurk thereafter. In September, the attacker contacted a software engineer, referred to as Little B, through a recruitment platform, posing as a project director, and conducted video interviews and social media interviews, sending a code repository as an assignment. Little B downloaded the repository to their work computer and set it up according to the instructions. One file of 3,414 bytes bypassed terminal security protections and used internal AI tools to find traces related to Little A.The report states that on October 30, the attacker logged into another employee, referred to as Little C's, computer and transferred $6.3 billion. Binance stated that approximately $6.34 billion in assets were affected, with about $2.85 billion frozen or intercepted, and the losses covered by the SAFU fund and company funds. As of October 31, 98% of the affected tokens have been replenished.

According to Bloomberg, citing informed sources, Binance holds Directors and Officers (D&O) liability insurance to address claims against executives from regulatory investigations or lawsuits, but like most cryptocurrency companies, Binance has been unable to obtain cyber insurance. Cyber insurance in the cryptocurrency sector is considered nearly impossible to acquire.Additionally, Binance's Secure Asset Fund for Users (SAFU) has no external insurance or reinsurance support. Even if some companies seek compensation through crypto, crime, or D&O policies, these policies typically contain numerous denial clauses.

According to official news from Binance, it has completed the compensation for approximately $6 billion in assets involved in this hacking incident. At the same time, Binance confirmed that the transfer of funds from the Secure Asset Fund for Users (SAFU) has been completed, involving 7,499 BTC.Previously, Binance stated in the third security incident update announcement that it had reserved over $6.34 billion in company funds to compensate for the stolen losses, and the compensation ratio for affected assets has been increased from 80% to 90%. Among them, 10 assets including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC have achieved 100% reserve coverage.Binance stated that the sources of the compensation funds include part of the SAFU fund, the futures insurance fund, and the company's own funds. The remaining assets to be compensated mainly consist of tokens with lower liquidity, which will continue to be purchased through public markets and over-the-counter trading channels. Binance promises to bear all financial losses caused by this theft and will not pass them on to users.

According to official news from Binance, the transfer of its SAFU funds has been completed, involving a large transfer of 7,499 BTC that was previously monitored.Earlier, Whale Alert detected this BTC being transferred from Binance SAFU to an unknown wallet, valued at approximately 581 million dollars. Binance confirmed the connection between this transfer and the SAFU fund transfer in response to the monitoring post.

According to Whale Alert monitoring, 7,499 BTC were transferred from Binance SAFU to an unknown wallet, worth approximately 581 million USD.

Binance released a security incident update stating that the company had previously reserved over $6.34 billion of company funds to cover the stolen losses, with the coverage ratio at that time being approximately 80%, which has now increased to 90%. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC have achieved 100% coverage, while the remaining related tokens will continue to be purchased through market and over-the-counter channels until the coverage ratio for all tokens reaches 100%. Binance stated that the financial impact of the stolen funds will be borne by the platform, not the users.The replenished funds come from a partial drawdown of the user security asset fund SAFU, a portion of the contract insurance fund, and Binance's company funds. The partial drawdown of SAFU is expected to occur within the next 24 hours. The remaining 10% consists of assets outside the aforementioned ten tokens with lower liquidity, and the time required for purchase may be longer.Binance completed a new reserve proof snapshot on October 31 at 00:00 (UTC) and updated it on the reserve proof page. The complete zero-knowledge proof is expected to take 40 to 50 hours to generate, approximately by November 3 (UTC). Withdrawal services will continue to progress according to the previous schedule, with plans to reopen on Sunday, November 1.Binance introduced that SAFU was established in July 2018 and is held and managed by Nest Clearing and Custody Limited, regulated by the Abu Dhabi Global Market Financial Services Regulatory Authority. The company commits to replenishing the scale of SAFU to approximately $1 billion and clarifies that the partial drawdown of SAFU is for purchasing the remaining 10% of assets. After withdrawing the balance exceeding the stipulated level, the contract insurance fund remains above the coverage level required by the existing risk management framework; if the balance falls below the requirement, Binance will make up the difference with company funds.

Binance CEO He Yi stated that Binance's SAFU fund and the cryptocurrencies held by Binance include a large amount of assets such as BTC and ETH. Currently, they are completing the Proof of Reserves (POR) by fully matching all stolen altcoins through OTC and on-exchange purchases. After the purchases are completed, they will update everyone with the information again.

Binance founder Changpeng Zhao posted on the X platform that Binance suffered a hacker attack resulting in a loss of approximately 6 billion USD, of which 3 billion USD has been frozen, the SAFU fund is about 1 billion USD, and the remaining gap is about 2 billion USD.Changpeng Zhao stated that the SPCX stocks held by Binance are worth over 1 billion USD, which can cover most of the remaining gap, and the remaining part is still painful but manageable. This portion of the stocks comes from the 500 million USD that Binance invested when participating in Elon Musk's acquisition of Twitter. Changpeng Zhao previously mentioned that the actual loss might be slightly higher, but Binance will bear the responsibility.

Binance released an investigation update stating that preliminary investigations indicate that this security incident may involve an infected laptop, and subsequent investigations have uncovered more points of intrusion. Binance stated that this is a complex attack and is currently coordinating with law enforcement to handle the situation, while continuing to gather facts and will share more information directly in the future. Binance will use the SAFU fund and company funds to cover all losses and assures that user funds are safe.Binance still expects to resume withdrawal services within 45 hours, with deposits unaffected. After suspending withdrawals, the outflow of funds has stopped. Binance is working with partners to freeze affected assets, and approximately $3 billion has already been frozen, with further updates to be provided through official channels.

Binance customer service representative Sisi responded to community questions on social media, stating that this attack was not an event that could be completed through a single device; the starting point of the attack was a compromised employee's computer. Attacks on cryptocurrency institutions are usually highly targeted, and attackers often attempt to use complex methods to implement infiltration. Binance has discovered important clues related to the incident and has taken measures to control risks. Relevant investigations and tracing are still ongoing, and the platform's core risk control and emergency mechanisms have been activated.Regarding whether the engineer's permissions are too extensive, Sisi stated that this is not an incident where the attacker could directly use a specific engineer's permissions to complete a fund transfer, nor is it the result of a single person being able to operate with one click; the related anomalies involve a more complex attack process. At this stage, the investigation has not attributed responsibility to any individual, and the company will assume corresponding responsibilities while continuing to promote subsequent handling and security upgrades.Currently, there is no evidence of wallet private key leakage. The total losses from this incident will be fully borne by the SAFU fund and company funds, with no need for users to bear any costs. Approximately $3 billion in affected assets have been frozen on-chain, and Binance is cooperating with law enforcement and blockchain intelligence agencies to trace the funds, which are publicly traceable on-chain. Deposits are fully open and unaffected; withdrawals have been suspended as a precautionary measure and are expected to reopen within 48 hours, with specific timing subject to official announcements. Binance will continue to update progress while ensuring the accuracy of the investigation and will publish detailed information and further security reinforcement measures after the incident is handled and reviewed.

Binance's latest announcement confirms that in this hacking incident, Binance will cover all losses from the SAFU fund and company funds. Binance reiterates that user funds are safe and states that once the repair work is completed, an updated proof of reserves will be released.As an immediate precautionary measure, Binance has temporarily suspended deposits and withdrawals until the security checks are completed, revoked the authorization of affected addresses, and contacted law enforcement and blockchain intelligence partners to track and recover the funds.

Binance founder CZ posted on the X platform stating that user funds are safe (SAFU), and specifically mentioned He Yi working overnight with hundreds of Binance employees to handle the security incident during her pregnancy.CZ noted that many industry friends and even competitors, including those who previously had unfriendly relations, provided much-needed assistance. He described the incident as heartbreaking but emphasized that Binance will get through this tough time.

Binance released preliminary investigation results on its official X account, stating that the security incident may involve the laptop of a DevOps engineer being compromised. The attacker used this to access the service container and submitted unauthorized withdrawal transactions. Binance stated that there is currently no evidence of wallet private key leakage and will publish a detailed technical review after the investigation is complete and the facts are fully verified.Binance estimated the total impact of the incident to be approximately $6.3 billion. The platform has frozen related assets in collaboration with blockchain partners, with about $3 billion currently frozen on-chain. Binance stated that it will cover all losses through the SAFU fund and company funds, ensuring user fund safety, and will release updated proof of reserves after the resolution is complete.As an immediate measure, Binance has suspended deposits and withdrawals until security checks are completed, revoked the authorization of affected addresses, and has contacted law enforcement and blockchain intelligence partners to track and recover funds. Binance stated that the team is working with law enforcement partners to confirm the identities of the relevant individuals and reminds users to obtain updates only through official channels.

Binance founder Zhao Changpeng responded on social media to "The Binance SAFU fund purchased 1 billion dollars worth of Bitcoin at an average price of 66666.66 dollars, currently with an unrealized profit of 270 million dollars," stating that it might purely be luck.

According to on-chain analysts' monitoring, the Binance SAFU fund accumulated 15,000 BTC from February 2 to February 12, with an average cost of approximately $66,666.66 based on a $1 billion calculation; based on the current price of $81,000, the return rate is 21.5%, with an unrealized profit of $221 million.

According to Arkham monitoring, the Binance SAFU fund address successfully bottomed out, holding 15,000 BTC currently valued at $1.21 billion, with an unrealized profit of about 20%, worth approximately $200 million.It is reported that the Binance SAFU fund has completed a $1 billion Bitcoin purchase plan, holding 15,000 BTC valued at $1.005 billion (calculated at the price when transferred to the SAFU fund).

Web3 wallet infrastructure Claw Wallet announced a strategic partnership with GoPlus. Claw Wallet has integrated GoPlus's SafuSkill Launchpad, supporting the assetization and tokenization of AI skills, empowering developers to obtain continuous on-chain revenue through GitHub verification.At the same time, Claw Wallet introduces GoPlus AgentGuard security scanning technology, which conducts real-time monitoring and risk visualization of AI Agent's code, sensitive data, and operating environment through a multi-dimensional scoring system. This collaboration aims to enhance the security of AI Agent wallets and improve their ecological incentive mechanisms.

GoPlus released a report on social media stating that it conducted a comprehensive security scan on the top 100 high-frequency download Skills in the ClawHub ecosystem. The number of skills that were blocked reached 21 (accounting for 21%), while the number of skills that received warnings was 17 (accounting for 17%).GoPlus indicated that 21% of the Top 100 Skills involve clearly high-risk operations (such as direct network penetration, sensitive API calls, automatic messaging, etc.), and it is recommended to enforce a "Human-in-the-Loop (HITL)" confirmation mechanism when executing such Skills, to conduct manual reviews of high-risk behaviors. 17% of Skills carry certain risks, and it is advised to execute them with caution; for users with higher security requirements, manual confirmation is also recommended.In this context, GoPlus Security announced the launch of SafuSkill, a security-first Skills marketplace. SafuSkill is built on the BNB Chain and integrates a skills marketplace, an automated Skills security scanning engine, and developer management tools into an AI Agent Skills platform, aimed at helping users filter and discover safer AI Agent Skills. It provides security scanning and runtime protection capabilities for AI Agent Skills, promoting the development of the AI Agent ecosystem towards a more transparent and secure infrastructure layer.