A Nov. 6 report from analytics firm Santiment found heavy net outflows from wallets it linked to Binance after an Oct. 29 security breach. Bitcoin commentary also turned sharply negative. On Nov. 5, Binance futures open interest stood near $8.97 billion for Bitcoin and $8.03 billion for Ethereum. Those figures show the value of outstanding contracts, not whether the same traders stayed in the market or which way they were betting.
- Santiment tracked about 28, 316 BTC in net outflows from Binance-associated wallets through Nov. 5.
- Bitcoin commentary turned sharply negative, but Santiment’s ratio reflects the discussion it tracked, not public opinion as a whole.
- Exchange outflows do not measure stolen funds.
- Binance said it had replaced approximately 98% of affected assets. That figure comes from the company.
What is known about the breach, and what is not
Santiment’s report describes a security breach involving Binance on Oct. 29, but offers no details on how attackers gained access, which systems they compromised or the incident’s full scope. Binance initially suspended withdrawals, then reopened them in stages beginning Nov. 1.
The report also cites approximately 217.5 million ENA, worth roughly $40 million at the time, that attackers reportedly converted into Ethereum through decentralized trading platforms. It does not explain how that activity was linked to the breach or how the attackers’ role was established. Treat the ENA figure as a separate claim reported by Santiment, not a complete accounting of losses.
Outflows do not establish theft
Through Nov. 5, Santiment recorded approximately 28, 316 BTC in net outflows from wallets it associated with Binance. Across all tracked exchanges, Bitcoin balances fell by 38, 631 BTC, or 2.92%, between Oct. 25 and Nov. 5. The decline began four days before the breach, so Santiment warned against attributing the entire move to the incident.
Exchange-flow data tracks net movements in labeled wallets. Those movements can include customer withdrawals and institutional transfers. On their own, they do not show why funds moved or whether anyone stole them. Wallet labels also do not identify the people or institutions behind each transaction.
On Oct. 29, Santiment recorded net exchange outflows of 22, 317 BTC and about 324, 640 ETH. It also measured Ethereum-based USDT outflows of approximately 1.71 billion USDT that day and 3.94 billion on Nov. 2. The Nov. 2 figure does not show that all those tokens were stolen or withdrawn from Binance.
Bitcoin discussion soured as futures contracts remained open
Santiment’s positive-to-negative Bitcoin commentary ratio fell to 0.37 from Oct. 29 to 30, or about 2.7 negative comments for every positive one. The report does not specify the platforms, sample or methodology behind the measure. Read it as a gauge of the discussion Santiment tracked, not a poll of all crypto users.
Binance also took all six spots on Santiment’s list of trending cryptocurrency stories on Oct. 29, ahead of discussion about the Federal Reserve, Strategy and the approaching U.S. midterm elections. That shows how much attention the breach attracted, not what the market would do next.
By Nov. 5, Binance Bitcoin futures open interest was near $8.97 billion and Ethereum futures open interest was around $8.03 billion, according to Santiment. Open interest is the value of futures contracts that have not been closed. It measures outstanding exposure, not the number of individual traders, whether they held positions throughout the period or whether they were collectively bullish or bearish.
Santiment said Bitcoin funding rates remained mostly positive and generally within familiar ranges. It did not describe traders as outright bullish, but said they were not collectively taking unusually aggressive bearish positions. BNB futures open interest was about $427 million, while BNB traded near $692 when Santiment made its observation. The firm also reported that BNB spot trading volume reached $3.78 billion on Oct. 29, its highest daily reading since Feb. 5.
ENA activity and the limits of freezing assets
Santiment counted 169 active ENA withdrawal addresses in one hour on Oct. 29, compared with roughly 20 to 25 in many nearby hours. It recorded 208.62 million ENA in net exchange outflows that day.
That is a separate measure from the approximately 217.5 million ENA attributed to attackers. One figure tracks net exchange movements. The other estimates tokens reportedly converted by attackers. They should not be added together or treated as the same thing.
Santiment said ENA lacks an issuer-controlled freezing mechanism like those available for USDT and USDC. That limits one possible response to theft. It does not, on its own, prove that a token is decentralized or that funds cannot be recovered by other means.
Binance recovery claims and the Arbitrum request
In a Nov. 4 update, Binance said it had replaced approximately 98% of the affected assets using company resources. It said it was still acquiring the remaining tokens through markets and over-the-counter channels, which are trades conducted outside ordinary exchange order books. Lower liquidity was slowing the process, the company said. Binance did not provide a token-by-token breakdown of what remained.
Binance also said a reserve snapshot taken at 00:00 UTC on Nov. 4 covered 44 tokens, up from 10 previously. The update mentioned a zero-knowledge proof, a cryptographic method for demonstrating a claim without revealing all the underlying information. The available details do not show exactly what the proof would verify. The expanded token count alone is not a complete assurance about Binance’s reserves or liabilities.
Separately, Binance asked Arbitrum’s DAO to release 8, 425.997 ETH and 74.56 million ARB that the report describes as frozen. The DAO would need to consider the request through discussion and a vote. The report does not explain how the assets were frozen, whether the request was approved or whether the funds were released.
Binance estimated that discussion, voting and execution could take about 49 days, and possibly longer if legal claims intervene. Proposed indemnification agreements, which set out responsibility for specified losses or claims, would apply New York law, with disputes assigned to state and federal courts in New York County. This is Binance’s estimate and proposed legal framework, not a confirmed outcome.
Key questions and answers
-
How much Bitcoin left Binance-associated wallets?
Santiment recorded approximately 28, 316 BTC in net outflows through Nov. 5. The figure does not show that the coins were stolen or that the breach caused every withdrawal.
-
Did exchange outflows equal the amount stolen?
No. The figures include broader movements, such as customer withdrawals and institutional transfers. They are not a tally of stolen assets.
-
Did futures traders leave the market?
Santiment reported Binance Bitcoin and Ethereum futures open interest near $8.97 billion and $8.03 billion, respectively, on Nov. 5. Those figures measure outstanding contracts, not whether the same traders remained or which way they expected prices to move.
-
What did Binance say it had replaced?
On Nov. 4, Binance said it had replaced approximately 98% of the affected assets using company resources and was still acquiring the remainder. That figure is Binance’s claim.
-
What happened to the assets Binance asked Arbitrum’s DAO to release?
Binance requested 8, 425.997 ETH and 74.56 million ARB. Santiment’s report does not say whether the DAO approved the request or released the assets.
