$643.2 Million Exits Bitcoin Funds After Four Days of Inflows
Key Facts
U.S. spot Bitcoin exchange-traded funds recorded net outflows of $643.2 million on Oct. 30, 2026, according to Farside Investors data, reversing four consecutive days of inflows. Outflows in the same session also affected Ethereum funds, which saw $155.7 million, and Solana funds, which saw $10.8 million, according to Farside and TokenPost. BlackRock’s IBIT fund recorded $233.7 million in outflows, the largest single figure among the Bitcoin fund details in Farside’s table. The figures followed a security incident Binance disclosed on Oct. 29, but the timing of the two events does not prove the hack prompted investors to withdraw money from the funds. Session data show outflows widening across digital-asset categories, with Bitcoin accounting for the largest share of fund outflows.
The Oct. 30 session followed four consecutive sessions of inflows into Bitcoin funds. Inflows were $110.3 million on Oct. 26, then $176.0 million on Oct. 27, $137.3 million on Oct. 28 and $17.2 million on Oct. 29, according to Farside data. The sequence places Friday’s outflows after a four-day buying streak, but does not by itself indicate whether the shift will continue in subsequent sessions. It also coincided with outflows from Solana funds, which logged their fifth consecutive session of outflows on Oct. 30, according to TokenPost. Total outflows from Solana funds from Oct. 26 to 30 reached $71.6 million, showing that pressure on the category extended across several sessions.
Binance estimated the incident’s total impact at about $6.3 billion and said its partners had frozen about $3 billion in related on-chain assets as of Oct. 30. In an update published on Oct. 31, the platform said the recovery rate for affected assets had risen to 90%. It added that Bitcoin, Ethereum, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and ZEC were backed by 100% reserves. The company had described the incident as unauthorized withdrawal transactions after an attacker gained access to a service container, and said its initial investigation pointed to a possible compromise of a computer belonging to an engineer on the DevOps team. Its statement does not describe the incident as a compromise of its hot wallets in the plural.
The U.S. Federal Bureau of Investigation attributed the attack to North Korea, saying the TraderTraitor group converted the stolen assets primarily into Ethereum. The bureau urged node operators, virtual asset service providers, decentralized finance platforms and instant-swap services to block transactions linked to or originating from the attackers’ addresses. TRM Labs estimated that the attacker moved about $6.36 billion from Binance wallets across 10 blockchain networks, in a report cited by The Associated Press. The company said most of the transfers took place in about 20 minutes. These estimates illustrate the speed of the asset transfers and the breadth of networks used, while the bureau’s advisory focused on cutting off transfer routes linked to the addresses it identified.
Bitcoin fell 3.2% to below $79,000 on Thursday evening, Oct. 29, according to The Associated Press. In separate coverage dated Oct. 30, the agency reported that the price had fallen below $77,000 after being above $86,000 earlier in the month, as shares of cryptocurrency companies declined following the hack. These readings refer to different times, so they reflect the price’s trajectory over the period rather than a single session price. The market decline, fund outflows and incident occurred within a close time frame, but the available facts do not establish that one caused another. The difference in measurement times remains important when reading the Bitcoin levels cited in the two reports.
Binance said in its Oct. 31 update that withdrawals were expected to resume on Sunday, Nov. 1, 2026, after a newer update changed the timing stated in its earlier announcement. It also said it took a snapshot of reserves on Oct. 31, with publication of the full proof expected on Tuesday, Nov. 3. These steps follow its announcement that the recovery rate for affected assets had risen to 90%, while it said the listed assets were backed by 100% reserves. The FBI urged industry participants to block transfers linked to the attackers’ addresses, in a move aimed at limiting the circulation of stolen assets. Attention is focused on whether withdrawals resume as scheduled and the full proof of reserves is published, alongside the actions of those the bureau asked to block the transactions.