BINANCE’S USER FUND MOVED 7,500 BITCOIN — HALF OF ITS 15,000 — ONE KEY SIGNED — 21 MINUTES AFTER UPDATE #3

At 14:30 UTC on October 31, 2026, Binance posted its third update on the hack. It said all bitcoin owed to users is “fully backed 100%,” and that a “partial deployment” of SAFU, its emergency fund for users, would help buy the last 10% of stolen tokens. Binance printed the fund’s bitcoin address in the same post. So we checked it.

The address held 15,000.00147092 bitcoin before the post. At 14:45:31 UTC, in block 973,983, it sent 1 bitcoin to a new address starting 165Eurv. Six minutes later, in block 973,984, it sent 7,499 more to the same place. That is 7,500 bitcoin, exactly half the fund. The new address has two transactions, both from SAFU, and had spent nothing as of block 974,008. The coins that moved came from the 1,315, 3,600 and 4,225 bitcoin SAFU took in during February 2026.

Every input was an old-style pay-to-public-key-hash output. That format holds one public key and takes one signature. All three inputs show the same key. Binance says the fund is held and managed by Nest Clearing and Custody, regulated in Abu Dhabi. The chain cannot show whether that key is split among several machines or people behind the scenes. It does show one signature per input moving 7,500 bitcoin. On October 30 we <a href="https://mempolitics.com/story/binance-eip-7702-explanation-18270-bitcoin-left-on-one-key-11-signatures-none-moved-block-973862-2026-10-30/">reported</a> the stolen hot wallet bitcoin left the same way.

Binance’s own FAQ asks why SAFU is being spent if bitcoin is already covered. Its answer: SAFU will buy the remaining 10%, which it says is tokens outside its top ten. Binance has not said whether the 7,500 bitcoin will be sold to do that. The zero-knowledge proof for its October 31 snapshot is due by November 3, 2026. Until then, “fully backed” is a claim you cannot check. At the time of this writing, bitcoin was $77,459.