217.5 Million ENA Sold for $33.93 Million as Part of $158.25 Million Conversion

Key Facts

The attacker linked to the Binance hack sold about 217.5 million ENA tokens for a stated $33.93 million on October 30, according to data from Lookonchain. The sale was part of a broader disposal involving seven tokens, as wallets linked to the attacker converted the proceeds of the swaps into 70,480 Ether, with a stated total value of $158.25 million, according to TokenPost. The transfers tied the ENA sale to a broader effort to liquidate assets collected in the incident. In subsequent market action later the same day, ENA rose 8.4%, according to CoinDesk. EL7 data showed the token closed at $0.1855 on October 30, compared with $0.1755 the previous day.

The swaps were not limited to ENA; they also included UNI, PEPE, LINK, AAVE, ONDO and WLD, according to TokenPost. The reported amounts were 7.02 million UNI, 7.77 trillion PEPE, 2.57 million LINK, 127,953 AAVE, 21.85 million ONDO and 17.32 million WLD, alongside 217.5 million ENA. Lookonchain said the attacker completed the sale of the entire reported ENA amount, after which the swaps formed part of the stated total transfers. Other tokens also rose in October 30 trading: PEPE gained 7.3%, UNI rose 4.6% and LINK advanced 3.7%, according to CoinDesk. In the broader market, liquidations of crypto futures contracts quadrupled to $1.57 billion after the hack put pressure on prices, according to the same report.

Binance estimated the incident's total impact at about $6.3 billion in an update published on October 30, and said it had worked with its blockchain industry partners to freeze about $3 billion in on-chain assets by that time. TRM Labs estimated, according to the Associated Press, that about $6.36 billion was moved from Binance wallets across 10 blockchain networks, with most transfers taking place in about 20 minutes. Binance said it would cover all losses from its SAFU fund and company funds, stressing that user funds were safe. Circle also froze more than $800 million in currencies linked to the incident in coordination with law enforcement, while Tether said it had frozen the equivalent of more than $1.5 billion, according to the Associated Press. These measures show how the response expanded from tracking the assets to freezing them and addressing user losses.

Binance said its preliminary findings indicated that a laptop belonging to an engineer on its DevOps team may have enabled the attacker to access a service container and carry out unauthorized withdrawals, according to TokenPost. The Associated Press later reported that the company said a subsequent investigation had uncovered additional "compromise points" after its initial indication that the laptop may have been compromised. Investigations were ongoing in the published updates, and Binance did not provide a complete final account of the breach path in those statements. In the initial market reaction on Thursday evening, October 29, Bitcoin fell 3.2% to below $79,000, according to the Associated Press. CoinDesk later recorded an ENA rebound in October 30 trading, placing the token's subsequent move in a different timeframe from Bitcoin's initial drop and the futures liquidations.

Binance temporarily suspended withdrawals while it completed security checks, while deposits continued as normal, according to its October 30 update. The Associated Press said the platform had begun restoring assets to users and expected withdrawals to resume within a day or two of the report's publication on that date. Binance said it would publish a detailed technical review after the investigation was complete and the facts had been fully verified, and also promised to update its proof of reserves after remediation was finished. Publication of the technical report remains contingent on completion of the investigation, while the resumption of withdrawals remains tied to completion of the security checks. In comparison with an earlier incident, losses from the Bybit platform hack in February 2025 amounted to about $1.5 billion; the Federal Bureau of Investigation said North Korea and the TraderTraitor group were responsible, according to the Associated Press.