Ether's week ran two flows in opposite directions: the FBI says the Binance thieves were converting stolen assets primarily into ETH, while Glassnode counted 23 straight days of net outflows from US spot Ether ETFs, the longest streak since launch [1][2].
The stolen funds' path into Ether
In a notice CZ quoted, the FBI said that it, the Secret Service and IRS-CI had observed North Korea's TraderTraitor actors converting the assets stolen from Binance primarily into Ether [1]. Nansen's flow map of the theft points the same way. It shows one wallet labelled Binance Exploiter holding 197.5k ETH, and another routing USDT into ETH [3]. An infographic CZ shared listed the lost assets as mixed crypto, including about 420,000 ETH and about 18,270 BTC [4]. On Nansen's map, the Bitcoin leg had not moved: an exploiter hub held 18,270 BTC with no outflows yet [3].
Whale Alert traced individual moves out of wallets it tags Binance Hack 2026, including 57,891 ETH worth about $132.6 million sent to a newly created wallet [5]. Smaller tokens left those wallets too: UNI worth about $46.8 million, LINK worth 27,952,636 USD, ENA worth $40.4 million and PEPE worth $37,481,346 [6][7][8][9]. Nansen's map groups WBETH, ENA, RLUSD, UNI, PEPE and LINK among the assets routed to DEX swaps [3].
The ETF side
Glassnode reported 23 consecutive days of net outflows from US spot ETH ETFs, the longest streak since launch. It marked historical resistance near $2,700 and support near $2,200 [2]. Whale Alert put the funds' 30-day net outflows at $1.07 billion, with ETH near $2,300 support [10].
Bitget's 29 October morning briefing had ETH at about 2,356.59 USDT, with a potential short-liquidation cluster around $2,380 to $2,410 [11]. A separate Bitget briefing that noted Binance's security investigation had ETH down 5.47% to roughly $2,219, and Bitcoin below $80,000 at about $77,185 [12]. That briefing listed the moves alongside a US equity pullback and strong Q3 GDP and core PCE data, with total crypto market capitalization down 7.13% to $2.61 trillion [12].
Institutional custody flows ran both ways. Whale Alert flagged 33,331 ETH and 23,582 ETH moving from unknown wallets into Coinbase Institutional addresses [13][14]. It also flagged 31,711 ETH moving out of Coinbase Institutional to a newly created wallet [15].
Where the voices split
On the bearish side, Ansem stayed bearish on Bitcoin and Ether and expected further downside unless they broke weekly highs of $82,000 and $2,400 [16].
CredibleCrypto took the other side. They argued that Ether had completed its consolidation range and was entering an expansion phase. They wrote that ETH had printed the first impulse of its next major wave, which they put at $20,000 and above [17]. In a separate post, CredibleCrypto wrote that if Bitcoin climbed to $90,000 or more, they would expect ETH to outperform and reach $3,000 or more; their ETH/BTC chart marked 0.03635 BTC for March 2027 [18]. They also likened the hack to the FTX collapse and suggested it could mark a local bottom [19].
The two reads share a market but not a frame. Ansem set a level for Ether to reclaim, while CredibleCrypto described a consolidation phase already complete [16][17].
The reopening
Binance restored withdrawals of ETH, USDT and USDC on the Ethereum network as part of a phased reopening [20]. Binance said it began restoring withdrawals at 06:00 UTC on 1 November. Between 06:00 and 15:30 UTC it processed $4.649 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion [21]. CZ described this as a 2.1% net outflow and wrote that 98% chose to stay [21]. Whale Alert flagged 30,000 ETH, worth about $68 million, leaving Binance for an unknown wallet [22].
Taken together, the stolen funds moved into Ether on the FBI's account [1]. The regulated wrapper kept shedding it on Glassnode's [2].
