As of 30 Oct 2026, Binance's answer to the loss question is a direct commitment. Co-CEO Yi He has said all losses from the 29 Oct 2026 breach will be covered from company funds plus the SAFU emergency fund, and that user funds are safe. SAFU is the name Binance uses for that emergency fund, and it holds about $1 billion in bitcoin.

It is important to read that statement for what it is. It is a company commitment about covering losses, reported in the available facts, rather than a completed payment record. The investigation is ongoing and figures remain preliminary, so the practical test will be what users and auditors can verify in later official updates and in the next proof-of-reserves snapshot.

The estimated impact of the breach is about $6.3 billion, which would make it the largest crypto theft on record, ahead of Bybit's $1.5 billion in 2025. Against that preliminary figure, a fund holding about $1 billion in bitcoin would not on its own cover the full estimate, which is why Yi He's statement pairs SAFU with company funds rather than presenting SAFU alone as the whole answer.

SAFU therefore should not be described as a guarantee fund of unlimited size. The facts available say it holds about $1 billion in bitcoin and that it sits alongside company funds in the coverage plan. No further detail about the composition or the release process for those company funds is given in the fact set, and none should be invented here.

The preliminary investigation describes how the loss occurred. A compromised DevOps engineer's laptop may have allowed an attacker to access a service container and submit unauthorised withdrawal transactions. No evidence of a wallet private key leak has been found at the preliminary stage. Reports also say the attacker used the Ethereum feature EIP-7702 on a wallet called Binance 14, turning it into a sweeper, with about 204,500 ETH moved.

Freezing work may reduce the amount that ultimately needs covering. About $3 billion has been frozen so far, including $2.3 billion in USDT and USDC. Tether froze more than $1.567 billion in USDT, Circle froze about $823 million in USDC, Ripple froze about $200 million, and World Liberty Financial froze $27 million in USD1. Frozen, however, is not the same as returned.

Deposits and withdrawals were suspended as a precaution, and Yi He said she expects withdrawal resumption to begin within the next 48 hours. Some reports say deposits were unaffected, a discrepancy that the available facts do not settle with certainty. Readers should rely on official Binance channels for the current position.

Market reaction and attribution provide further context. Bitcoin fell below $77,000, ether fell about 3.2 percent, BNB fell about 3.9 percent, and more than $1 billion in leveraged positions was liquidated in 24 hours. Attribution is an investigators' claim, not a court finding: TRM Labs traced the incident to the North Korean unit TraderTraitor, other trackers also pointed to North Korea, and Pyongyang has previously denied hacking allegations.

FAQ: What is SAFU? It is Binance's emergency fund, holding about $1 billion in bitcoin. Will SAFU cover all losses on its own? The available facts do not say that; Yi He said losses will be covered from company funds plus SAFU. When will the coverage be verifiable? The next proof-of-reserves snapshot on 1 November 2026 will show whether stolen assets were replaced.