Binance has drawn on a reserve used to absorb losses from bankrupt futures positions as it replaces stolen cryptocurrency. The exchange says it moved only excess funds, while published balanc
Binance has drawn on a reserve used to absorb losses from bankrupt futures positions as it replaces stolen cryptocurrency. The exchange says it moved only excess funds, while published balances give traders a partial view of the protection that remains.
SummaryBinance has used part of its futures insurance fund to help replace assets stolen in its $6.3 billion hack, drawing on a reserve normally used to absorb losses from bankrupt trading positions.
Binance’s October 31 recovery update names the fund alongside its Secure Asset Fund for Users, known as SAFU, and corporate treasury money. The exchange says the money released from the futures fund was above its required protection level and did not reduce coverage below that threshold.
UPDATE: FBI officially attributes the $6B+ Binance hack to North Korea’s TraderTraitor hackersThe FBI says the attackers have been converting stolen funds into $ETH and may use DeFi platforms and instant-swap services to launder them, urging crypto service providers to block… https://t.co/a6PqQfrGh2pic.twitter.com/9EdTBPyjnr
— crypto.news (@cryptodotnews) November 1, 2026
The announcement does not state how much came from each source or give the minimum balance required in the affected futures pools. Binance says it monitors those requirements against historical stress scenarios and adds company funds when necessary.
Public data provide some figures to compare with that assurance. Swolecharts listed approximately $1.85 billion across the Binance insurance funds it tracks at 09:00 UTC on November 1, with balances divided among pools covering different contracts.
One shared pool’s USDT and USDC holdings were below the amounts recorded by another data collector in mid-October. The readings cover different dates and do not isolate the transfer made for the hack response.
The distinction has practical consequences for futures traders. An insurance fund can absorb a bankrupt position’s deficit, but when the relevant fund cannot take over that exposure, Binance’s rules provide for closing positions held by profitable traders on the opposite side.
The exchange’s recovery update, published October 31 at 14:24 UTC, says the asset replacement programme used part of SAFU, a portion of the futures insurance fund and Binance’s own treasury.
Binance describes the futures funds as company reserves, not assets owned by users. Its explanation says the funds receive company resources, including allocations from liquidation clearance fees collected by the platform.
SAFU has a separate purpose as an emergency reserve for events such as a security breach. The corporate treasury is the third source named in the recovery programme, without a published allocation showing each source’s contribution.
The October 29 breach left Binance arranging replacement cryptocurrency while investigators and asset issuers worked on tracing and freezing the stolen funds. The exchange’s promise to cover customers did not depend on recovering every stolen token first.
As crypto.news previously reported, Binance’s initial replacement holdings included roughly $5 billion in the affected cryptocurrencies. Its purchases were intended to restore matching token quantities, with the remaining assets acquired through markets and over-the-counter transactions.
Binance said the outstanding assets took longer to obtain because they were less liquid. A dollar amount allocated to compensation and the possession of each cryptocurrency required for customer withdrawals are separate stages of that process.
The exchange reopened Bitcoin withdrawals on November 1 and said 95% of the affected assets had been replenished. Selected assets across 15 networks were included in the first recovery phase, with availability restored progressively.
The reopening brings customer access back into the recovery process, but the 95% figure does not identify the futures fund’s contribution. Binance has not published a figure assigning that percentage of the replacement programme to the fund.
A futures trader supplies margin to support a position. When that collateral no longer meets the required maintenance margin, the exchange begins liquidating the trade.
Binance’s liquidation protocols describe an attempt to reduce the position through an immediate-or-cancel order. The order fills to the extent the market permits, and any unfilled portion is cancelled.
Liquidation can stop if the remaining assets meet the position’s maintenance requirement after losses and the clearance fee. A position that cannot be closed, or leaves a negative balance after liquidation, can become a bankrupt position taken over by the fund where possible.
The fund then bears losses from that exposure, while any profit from a position it assumes is retained by the fund. Binance’s protocols place this step between a failed market liquidation and the forced reduction of an opposing trader’s position.
The amount being liquidated is not automatically the amount lost by the fund. A large position can close with sufficient margin, while the deficit on another position depends on the prices at which it can be cleared.
Binance’s fund guide says the reserve does not refund a trader’s ordinary trading losses. Its role concerns the shortfall associated with a bankrupt position, including the difference between bankruptcy and execution prices.
The bankruptcy price is the point at which the losing trader’s margin balance reaches zero. Execution can occur at another price, especially when an order cannot find enough liquidity to close immediately.
Liquidation clearance fees are distinct from the funding payments exchanged between holders of perpetual contracts. Binance’s funding-rate documentation describes those payments as transfers between long and short positions, with their direction depending on the funding rate.
A positive funding rate therefore does not, by itself, show money entering the insurance fund. The fund’s resources and the payments made between counterparties follow different rules.
At 09:00 UTC on November 1, data collector Swolecharts listed approximately $1.85 billion across the Binance insurance funds it tracks, down 24.96% over 24 hours.
Its shared BTCUSDT pool entry listed 649.67 million USDT and 199.98 million USDC. The pool’s covered contracts included BTC, ETH and BNB USDT-margined futures, alongside other contracts in the displayed group.
The tracker listed additional assets and other pools separately. The 2 stablecoin balances are therefore a subset of the resources it counted, not the entire Binance fund or even every asset in that shared pool.
An October 17 snapshot published by data collector FeeØtter recorded 791,125,863 USDT and 499,980,384 USDC for the fund covering BTCUSDT. It identified the reading as official API data taken at 00:00 UTC that day.
You might also like: Pi Network rolls out 4 developer updates ahead of November summit
The earlier balances total approximately 1.291 billion dollar-denominated stablecoin units. Adding the 2 later rounded balances gives 849.65 million units, a difference of approximately 441.46 million, or 34.2% of the earlier total.
The calculation subtracts the November 1 pair of readings from the October 17 pair and divides that difference by the earlier sum. It compares the 2 specified stablecoin holdings, without converting other assets or adding balances from unrelated pools.
Neither comparison establishes how much Binance moved for the hack response. The dates span ordinary liquidation activity, possible fund reallocations and other changes, and Binance has not matched the transfer to a pool-by-pool reconciliation.
The exchange’s public history page separates USDⓈ-M and COIN-M fund records. Its disclosure directs customers to that history, with balances refreshed daily at 00:00 UTC.
JUST IN: Binance says 90% of the $6.3B hack losses are now covered, targets Sunday to resume withdrawalsCo-CEO Yi He says Binance is allocating half of its SAFU fund to cover the losses, while keeping the remaining 50% in reserve. pic.twitter.com/1C3a39DEk7
— crypto.news (@cryptodotnews) October 31, 2026
Binance’s defence is that a lower fund balance can still provide the protection its risk framework requires. It says the money used for replacing stolen assets was excess above that level, and that the remaining balance continues to cover the assessed exposure.
The company says it will add resources if the fund falls below the required size. It describes continuous monitoring against historical scenarios involving extreme but plausible market conditions.
The published fund guide already allows excess balances identified in a periodic review to be used for other purposes at Binance’s discretion. It provides for company top-ups when a fund is below its required minimum and for rebalancing among funds.
The required minimum is calibrated for losses from the categories of contracts covered by each fund. Binance says the approach uses a 99.9% confidence interval and historical stressed scenarios, with review at least quarterly and when the exchange considers it appropriate.
Its guide expressly says the confidence level is not the probability of avoiding auto-deleveraging. It does not promise that the process will be avoided in 99.9% of liquidation scenarios.
Binance’s ADGM clearing rules set out related provisions for the clearing house’s Default Funds. Rules 259–262 require sizing for stressed but plausible exposure and review at least quarterly, or more often during market stress.
Rule 263 permits withdrawals and redistribution of excess balances subject to Financial Services Regulatory Authority approval. Rule 265 requires the relevant balance to stay above the applicable target, subject to the rulebook’s provisions on adjusting that target.
The rulebook uses the term Default Fund, while the recovery announcement refers to Futures Insurance Funds. The announcement does not identify the legal allocation of the amounts transferred or publish an approval record for a specific movement.
The documents do not establish that Binance breached its requirements. They set out the conditions against which the exchange says it has maintained the remaining protection.
Binance maintains multiple futures insurance pools, each covering specified contracts. A balance across all tracked pools does not mean the same amount stands behind every position on the platform.
The company’s fund guide places BTC, ETH and BNB USDT-margined contracts in a shared pool. Other contract groups have their own pools, and coin-margined contracts using the same collateral asset share a fund for that asset.
Binance can change the allocation of contracts among funds. Its guide therefore directs users to the balance associated with the contract they trade, not only an exchange-wide total.
The public snapshot illustrates the differences in size. Alongside the BTCUSDT group, Swolecharts listed 273.32 million USDT and 100 million USDC in its SOLUSDT shared group, and 80.33 million USDT for an AAVEUSDT pool at the November 1 reading.
Those entries describe the resources assigned to their respective groups in the tracker. They cannot be ranked as adequate or inadequate without the exposure and loss scenarios each pool is expected to cover.
Binance’s API documentation lists an ADL risk measure that takes account of more than fund size. It includes position concentration, order-book depth, volatility, average leverage, unrealised profit and loss, and margin utilisation at the symbol level.
The documentation says the rating can be high, medium or low and is updated every 30 minutes. It is a symbol-level measure, separate from an individual account’s place in the ADL queue.
An account can face a different result from another account trading the same market because queue priority depends on its own profitability and leverage. The fund balance describes a shared resource; the ranking describes which opposing positions may be selected if intervention becomes necessary.
Auto-deleveraging is the last step described in Binance’s ADL guide. It applies when the relevant insurance fund is unable to accept a bankrupt futures position.
The exchange then selects profitable opposing positions using a ranking based on profit and leverage. More profitable, more highly leveraged positions move ahead of positions with lower rankings.
A selected trader can therefore have the direction of the market right and still lose control over when that exposure is closed. The action deals with an opposing bankrupt position, not a failure by the profitable trader to meet margin requirements.
Binance says a position affected by ADL is closed at the bankrupt trader’s bankruptcy price. That price can lie outside the contract’s market range, and the profitable trader receives a notice identifying the amount and liquidation price.
No trading fee is charged for that ADL closure. After the process, the trader can open a new position, although the guide does not promise that the same market conditions will remain available.
Binance displays an indicator of the likelihood that a position will be selected. Its ranking formula uses unrealised profit, position notional and effective leverage, with account-level inputs differing from the contract-level profit calculation.
The exchange acknowledges that it cannot eliminate ADL under every market condition. Its claim about the fund transfer is narrower: it says the remaining resources meet the level required by its framework.
No disclosed calculation in the recovery notice quantifies a change in ADL probability caused by the reallocation. The balance comparison alone cannot establish that profitable positions have become more likely to be closed.
Galaxy Research’s October anniversary review described how profitable traders were affected during the October 10, 2025 liquidation event. It said Hyperliquid activated ADL for the first time in more than 2 years, closing profitable short positions as markets sold off.
The research counted more than $19 billion in liquidations over the following 24 hours. It described collateral being sold into depleted order books and prices on some venues diverging from those available elsewhere.
Galaxy said the episode still lacked a full public accounting a year later. Its assessment identified correlated leverage and fragmented liquidity as continuing problems, while noting that lower leverage and changes in the mix of traded assets could reduce exposure to a repeat.
The episode concerned a market liquidation shock, not the theft of Binance’s hot-wallet assets. It records ADL operating in a past stress event without establishing how the current fund reallocation changes the probability of another one.
Exchanges do not all wait for an insurance fund to run out before they reduce profitable positions. Bybit’s ADL rules describe a trigger based on the loss suffered by an individual trading pair over a rolling 8-hour period.
The calculation measures the drawdown against the highest fund balance during that window. ADL can begin when that drawdown reaches the pair’s trigger line and stop once it falls to a separate stopping threshold.
Bybit provides a numerical example in its guidance, but the example is not a universal threshold for every contract. Users must check the parameters assigned to the relevant pair in its insurance fund records.
The same guidance describes another condition involving the combined balance of multiple independent pools reaching zero or falling below it. A positive headline balance and a pair-specific drawdown trigger therefore answer different questions within that system.
Bybit’s fund explanation separates inverse, USDT and USDC contract reserves, with individual pools for some USDT contracts. Money reported for one category does not automatically establish the protection assigned to a position in another.
Gate’s insurance fund description identifies several causes of balance changes: remaining margin from liquidated positions, company injections, and profits or losses from positions taken over by the fund. A daily change can reflect more than a withdrawal or a company contribution.
Those rules describe the respective exchanges and do not establish Binance’s trigger settings. Binance’s own documentation identifies fund size alongside market depth, volatility and the concentration of positions in its assessment of ADL risk.
Binance’s choice to use SAFU and the futures funds places 2 reserves with different functions alongside ordinary company resources. Its recovery notice describes SAFU as protection for extreme platform events, while the futures funds support the liquidation process.
SAFU’s conversion into Bitcoin was completed in February, when Binance reported holdings of 15,000 BTC worth approximately $1.005 billion at the time. The figure is a dated reserve disclosure, not the amount the fund contributed to the October incident.
Binance has committed to returning SAFU to approximately $1 billion. Its futures fund policy instead requires balances to meet the minimum established for the relevant risk exposure, with company contributions when needed.
The October 31 announcement says some SAFU resources also serve capital obligations within Binance’s ADGM arrangements. It does not provide an amount that can be assigned from the historical Bitcoin balance to the current replacement programme.
Customer proof of reserves serves another purpose. It concerns the assets backing customer balances included in the reported snapshot and the process through which a user can verify their inclusion.
The reserve reporting comparison explains why those snapshots are not a substitute for a full financial audit. They document specified checks at a point in time, rather than every subsequent corporate transfer or liability.
Binance’s own reserve page describes evidence for assets held in custody for users. The recovery notice states that futures insurance funds are not included in the customer proof-of-reserves calculation and must be viewed separately.
A customer can consequently verify inclusion in the reserve report without obtaining the futures fund’s required minimum, the amount transferred from it or its stress-test results. The exchange has pointed users to different records for customer backing and for the company-owned liquidation reserve.
The return of withdrawals gives customers a way to move supported assets after the security suspension. Binance’s first recovery phase listed selected cryptocurrencies across 15 networks, including Bitcoin, Ethereum and BNB Smart Chain.
JUST IN: Binance phased withdrawal resumes today, with the first window set for 06:00–09:00 UTCPhase One covers 15 networks, including Bitcoin, Ethereum, BNB Chain and Solana; Binance says 10 major asset balances are fully backed, it has covered about 95% of the exploit’s… pic.twitter.com/zWWD89rhqR
— crypto.news (@cryptodotnews) November 1, 2026
Its November 1 notice scheduled the initial reopening window for 06:00–09:00 UTC. The exchange said it prioritised network and asset pairs using demand over the preceding week.
The notice asks customers to check their chosen asset and network for actual availability. The first-phase list does not mean every supported withdrawal returned simultaneously.
The service restoration follows the exchange’s reported purchases of matching tokens. Binance said the remaining shortfall involved less-liquid assets it continued sourcing through markets and OTC channels.
The customer reserve snapshot was taken at 00:00 UTC on October 31. Binance’s recovery update says the full zero-knowledge proof requires approximately 40–50 hours to generate, with availability estimated by November 3 UTC.
Pool balances: The assets assigned to the fund covering each contract, with the date and time of each reading.
Transfer breakdown: Any disclosure assigning amounts to the futures fund, SAFU and corporate treasury.
Required coverage: Published minimums, relevant stress assumptions and any disclosed changes to pool allocation.
Top-ups: Company contributions that replenish a futures pool or restore SAFU toward its stated target.
Reserve proof: The complete proof associated with the October 31 snapshot, expected by November 3 UTC.
Yes. The exchange’s October 31 update names it alongside SAFU and corporate treasury resources, without disclosing the amount provided by each source.
Swolecharts listed approximately $1.85 billion across its tracked Binance funds at 09:00 UTC on November 1. The aggregate covers separate pools and is not the amount available to every individual contract.
Binance describes the futures insurance funds as its own reserves, not user assets. Its announcement says it released money above the required coverage level, not that it debited customers’ margin accounts.
No. Binance’s risk documentation includes liquidity, concentration, leverage and other conditions alongside fund size, and the recovery notice does not quantify a change in ADL probability.
Yes. Binance ranks opposing profitable positions by profit and leverage when the relevant fund cannot accept a bankrupt position, and selected exposure can be closed at the bankruptcy price.
No. Binance expressly says that calibration figure does not mean ADL will be avoided in 99.9% of liquidation scenarios.
Binance says the futures insurance funds are outside customer proof of reserves. It directs users to a separate fund-history page, while the full proof for the October 31 customer snapshot is expected by November 3 UTC.
Binance has committed to restoring SAFU to approximately $1 billion and says it tops up futures insurance funds when they fall below the size required by its framework. This is educational analysis, not investment advice.
Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Figures reflect regulatory filings and reporting available at the time of writing and change with each disclosure. Nothing here is a recommendation to buy, sell, or hold any security or asset. Always do your own research. Information is accurate as of November 1, 2026. Legal questions should be discussed with qualified counsel.
Read more: Binance reopens USDT, USDC, ETH, BNB withdrawals as President Trump weighs in
