Binance hacker holds $1.4B BTC, exceeds weekly spot ETF demand threefold

4 min

Bitcoin faced supply overhang risk after trader Route 2 FI highlighted that the Binance hacker’s 18,270 BTC worth $1.42 billion equals more than three times the week’s US spot ETF net inflows, with BTC trading near $77,300. Arkham data shows the attacker also holds 488,364 ETH worth $1.09 billion across 73 addresses. SoSoValue reported US spot Bitcoin ETFs absorbed about $440.7 million from October 26 to 29, creating a potential imbalance if hacker coins move to market.

Holdings, flows, and Binance’s response

Arkham’s entity page lists the Binance hacker’s BTC at $1.42 billion at Friday prices and ETH at $1.09 billion. US spot ETFs recorded approximately $440.7 million of net inflows over four sessions, putting the hacker’s BTC at about 3.2 times that weekly demand.

Binance hacker holdings on October 30, 2026 vs spot Bitcoin ETF inflows for October 26 to 29. Sources: Arkham, SoSoValue.

No on-chain evidence shows the hacker selling BTC yet. Lookonchain tracked altcoin sales into ether: UNI, PEPE, ENA, LINK and others were converted into 70,480 ETH worth about $158 million.

Binance told CoinDesk it has set aside more than $6.34 billion to cover customer losses. It reported $5 billion already held in matching tokens to those stolen and is buying the balance via exchanges and OTC. About $3 billion of stolen funds is frozen. Co-founder Yi He stated that Binance’s SAFU and holdings include a large amount of BTC and ETH and that the firm is purchasing all stolen altcoins in matching amounts. If Binance already holds sufficient BTC for customer coverage, its buybacks concentrate on altcoins, leaving the hacker’s 18,270 BTC as a potential net seller without a matching buyer.

Bybit precedent: buyback support fades

Route 2 FI cited the February 2025 Bybit hack as a reference. Bybit filled a roughly $1.4 billion ether shortfall within days through loans, deposits and market purchases. Price effects were short-lived: measured from the February 20, 2025 close on Binance, ETH was up 3.0% two days after but fell 35.9% to $1,754.28 by March 11. Bitcoin was down 2.1% two days after and fell 22.1% to $76,606 by March 11. Broader market factors contributed to the declines, indicating buybacks offer transitory support rather than a sustained floor.

Route 2 FI argued the event could push traders toward decentralized venues, referencing Hyperliquid’s HYPE token. The timing does not align: HYPE rallied on an ICE and Trade.xyz announcement about a regulated US perpetuals venue on Hyperliquid hours before the Binance drain began, then retraced after the hack.

Technical setup and levels

BTC’s Friday low at $76,500 was $35 above the 200-day EMA at $76,465. BTC trades at $77,326, down 3.5% over 24 hours. Key levels:

Resistance: $80,000 near the 50-day EMA at $80,581, then $81,971, which was Thursday’s pre-hack high.
Support: $76,500 at the 200-day EMA, then $74,968, the September 15 low.

Previous 200-day EMA test in mid-September held at $74,968 and rallied to $87,395 within a week, setting a clear invalidation line for long positions.

Outlook scenarios:

Rebound: daily close above the 50-day EMA at $80,581 targets $81,971, then $84,898.
Range: price oscillates between $76,465 and $80,000 if the hacker’s BTC remains inactive.
Sell-off: daily close below the 200-day EMA, or movement of the hacker’s BTC to exchanges or mixers, opens a path toward $74,968.

Near-term drivers: whether Binance reopens withdrawals on schedule and whether the hacker’s BTC begins to move on-chain.