A 6.3 billion dollar theft is not measured on the day it happens, but in the three days after, when the money tries to leave and the institutions try to say it is not their fault. The weekend left three numbers behind.

The ETFs pay the sentiment bill

On Friday 30 October, the first trading day after the theft, US spot bitcoin ETFs recorded 643.3 million dollars of net outflows. According to SoSoValue, cited by The Block and CoinDesk, before Friday the net inflow since the start of the year was just above one billion: a single day wiped out 63.6% of it. BlackRock (IBIT) lost 233.7 million, Fidelity (FBTC) 201.4; assets fell below 100 billion, to 98.14.

The analysts The Block spoke to call it a “sentiment shock”: the bitcoins in the ETFs sit with regulated custodians, not on Binance, and less than 1% of assets left. Not a run: risk reduction, with bitcoin around 78 thousand dollars.

Binance reopens and counts

On Sunday at 06:00 UTC the exchange reactivated withdrawals. At 03:30 it had processed 4.6 billion of outflows against 1 billion of deposits — 3.6 billion net — and The Block counts 3.64 in the first nine and a half hours; DefiLlama, on a rolling 24-hour basis, reaches 5.8. They are fractions of the roughly 171 billion in client assets Binance declares, and the company says it has replaced 90% of what was lost with treasury and insurance funds. For a full day the question about an exchange was “how much can I take out”, and the exchange itself answered it.

The money that crosses bridges

According to on-chain analyst SomaXBT, cited by The Block, about 242 million dollars moved through Tron in two days: 194 million left the network through bridges and swap services, with Relay leading (48 million), then THORChain (44) and Chainflip (32.1). Tether froze 378.7 million USDT, and 249 million are still to be moved. The FBI, which attributes the theft to the North Korean group TraderTraitor, asked THORChain nodes on Saturday to block the addresses.

THORChain stopped on its own, for a reason that has nothing to do with the hack: on Saturday at 11:34 UTC a block reorganisation on Ethereum removed a 10 ETH deposit that had already been credited, and the protocol refunded a payment it had never received, paying 10 ETH too many. Operators suspended swaps on ten chains, among them Bitcoin, Ethereum, Solana and Tron; technical co-founder Chad Barraford wrote that the nodes “do not have information that is not already public”, and did not say whether they will block the addresses indicated by the FBI.

What the numbers do not say

None of these figures measures the severity of the theft: they measure trust, which is harder to rebuild. An exchange can reimburse its customers and stay standing, a bridge can reopen ten chains within a few hours. What does not come back is the idea that some infrastructure is too big to be attacked.

Verified sources: The Block, “Spot bitcoin ETFs see largest daily outflows in four months following record Binance hack” (1 November 2026); CoinDesk, “Bitcoin ETFs saw $643M outflows Friday; 2026 barely green” (2 November 2026); Cointelegraph, “Binance net outflows surge to $5.8B as withdrawals resume after record hack” (1 November 2026); The Block, “Binance sees $3.64 billion in net outflows after reopening withdrawals” (1 November 2026); The Block, “North Korean hackers launder $242 million of Binance loot via Tron as FBI presses THORChain” (1 November 2026); Cointelegraph, “THORChain halts swaps after block reorg bug” (1 November 2026). SoSoValue and DefiLlama flow data as cited by the outlets.