U.S. spot Bitcoin exchange-traded funds recorded $643.3 million in net outflows on Friday, their largest one-day withdrawal since June 25, as traders reacted to a reported $6.3 billion theft from Binance hot wallets a day earlier. Spot Ethereum ETFs also saw $155.9 million leave on Friday, their biggest daily outflow since Oct. 7, according to SoSoValue data.
The withdrawals pushed Bitcoin ETF flows into negative territory for the week ended Oct. 30, with $202.6 million in net outflows. Ethereum ETF products posted an even larger weekly withdrawal total of $431.5 million. The figures show that the exchange incident affected demand for regulated crypto funds as well as activity on centralized trading platforms, even though ETF assets are generally held outside exchanges.
Bitcoin and Ether rebounded modestly by late Sunday. Bitcoin rose 1% over 24 hours to $78,491 as of 11:20 p.m. ET, while Ether gained 1.3% to $2,296. The price recovery came after Binance began restoring withdrawals, though fund flows suggested that some market participants had reduced exposure following the security breach.
Binance withdrawals resumed after reported theft
The FBI identified North Korean hackers as the attackers behind the theft, according to the information provided. Binance reopened withdrawals on Sunday after the incident disrupted access to funds.
During the first nine and a half hours after withdrawals resumed, Binance recorded about $3.64 billion in net outflows. That pace reflected users moving assets away from the platform after a breach involving hot wallets, which are internet-connected wallets used by exchanges to process routine deposits and withdrawals.
Large post-incident withdrawals do not necessarily mean every departing user expects further losses. They can also reflect a practical response to uncertainty over operational continuity, withdrawal processing, and the exchange's ability to absorb the financial and reputational costs of the attack. In this case, the scale of the reported theft gave users a strong reason to seek direct control of their assets or transfer them elsewhere.
The episode also revived the distinction between holding crypto through an ETF and keeping tokens on an exchange. Ko, chief analyst at ViaBTC, said spot Bitcoin ETF holders do not have direct exposure to Binance because the funds' underlying Bitcoin is held by regulated custodians. That structure separates ETF assets from an exchange's hot-wallet operations, although it does not remove the effect that a major exchange disruption can have on Bitcoin prices and trader sentiment.
ETF flows show risk appetite weakened beyond Binance
The $643.3 million withdrawal from U.S. spot Bitcoin ETFs was substantial in daily terms, but it remains small relative to the sector's overall asset base. Maeda, head of markets at Laevitas, compared Friday's outflow with the $98.14 billion in total net assets held by spot Bitcoin ETFs.
That comparison places the event in perspective. The flow was a meaningful short-term retreat rather than a wholesale exit from listed Bitcoin products. Even so, the simultaneous outflows from both Bitcoin and Ethereum ETFs indicate that the market response extended beyond concerns tied solely to Binance or to one cryptocurrency.
Ethereum funds experienced the larger weekly reversal, with $431.5 million in net outflows for the week ended Oct. 30. Bitcoin funds saw $202.6 million leave over the same period. The different totals suggest that traders were reassessing exposure across the largest crypto assets rather than treating Bitcoin as a complete shelter from exchange-related risk.
Maeda referred to the Bybit hack in the first quarter of 2025 as a reference point for how fund flows can behave after a major security event. Such incidents can produce sharp initial withdrawals as traders reduce risk, followed by a more mixed period in which flows depend on whether markets stabilize and whether the affected platform restores normal operations.
John, an analyst at Zeus Research, said near-term demand could remain cautious and would depend on market stability, liquidity conditions, and whether ETF flows recover. The Crypto Fear and Greed Index stood at 37 on Sunday, placing market sentiment in its fear range, according to the sentiment tracker.
Political calendar adds another variable
Attention is also turning toward the U.S. midterm election calendar. Maeda said markets could remain sensitive both to updates on the Binance incident and to political developments. Crypto prices often react to shifts in expectations around regulation, enforcement, and the prospects for legislation affecting market structure.
Ko also pointed to the midterms as a factor that could influence progress on crypto market-structure legislation in Congress. A change in the political timetable or congressional priorities could affect how quickly lawmakers address rules for trading venues, custody providers, token classifications, and stablecoin issuers.
The Binance breach has therefore placed two separate concerns in front of the market: immediate confidence in exchange security and longer-term uncertainty around the rules governing the industry. The ETF outflows show that regulated products can still feel the effects of a crisis centered on an offshore exchange, even when their custody arrangements are separate.
For now, the modest rebound in Bitcoin and Ether suggests that selling pressure had not turned into a sustained price collapse by late Sunday. The next signals are likely to come from Binance's handling of withdrawals and any further findings from authorities, alongside whether U.S. Bitcoin and Ethereum ETFs return to net inflows after the sharp Friday withdrawals.
Worried about hacks and ETF outflows? Learn how to trade safer with the right security practices today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
