Binance's emergency fund for users holds half the bitcoin it did a week ago. The wallet identified as the exchange's Secure Asset Fund for Users (SAFU) now holds 7,500.00136678 BTC, according to mempool.space address data. It held about 15,000 BTC before Binance tapped it to help cover Thursday's $6.3 billion hack.

At a bitcoin price near $77,000, what is left is worth about $580 million. For anyone with money on Binance, that matters for one reason. The backstop meant for exactly this kind of emergency is now below the $800 million line in Binance's own policy, and that policy does not clearly require the exchange to refill it.

The Clause That Decides Whether SAFU Gets Refilled

Binance's published SAFU policy contains a top-up rule. "If the fund's market value falls below US $800 million due to BTC price fluctuations, Binance will rebalance the fund to restore its value to $1 billion," it states.

The words doing the work are "due to BTC price fluctuations." This drop did not come from a falling bitcoin price. It came from Binance moving coins out to pay for a hack. The policy sets no timeline for replenishing money withdrawn after a security incident.

Read as written, the rule that forces a refill was built for a price slump, not for this. Whether Binance will restore the fund to $1 billion, and when, is not yet confirmed.

What the Wallet's History Shows

The SAFU address is public, so anyone can check its balance. Over its life, it has received 32,917.99606168 BTC and sent out 25,417.99469490 BTC across eight spent outputs. The difference is the 7,500 BTC sitting there today.

Those totals are larger than the fund's 15,000 BTC peak, which means bitcoin has moved in and out of this address before last week. The data alone does not explain those earlier movements, so they should not be read as earlier payouts.

What the data does show is the size of this drawdown. About 7,500 BTC, half the fund, left in one episode tied to one incident.

The Hack Behind the Drawdown

The attack on Thursday cost $6.3 billion, the largest hack in crypto history. On Saturday, the FBI attributed it to North Korea, naming the group behind it as TraderTraitor.

Binance began reopening withdrawals in phases on Sunday. It said it had replenished about 95% of the affected assets, up from 90% a day earlier. That recovery came after a rough few days for traders, covered in our report on the market fallout from the hack.

SAFU was only one of the sources Binance drew on. How the $6.3 billion loss splits between the fund and the exchange's other money is not yet clear.

What to Watch Next

The simplest test is the wallet itself. If Binance intends to rebuild SAFU, bitcoin will flow back into the published address, and anyone can see it.

Until then, the fund that users were told would cover them in a crisis sits at about $580 million, and the rule that would oblige Binance to top it up does not, on its own wording, apply to money spent on a hack.