Ether traded near $2,250 on Saturday, October 31, as investors weighed a deepening run of outflows from US spot Ether exchange-traded funds against the potential market impact of a large cache of stolen Ether tied to the $6.3 billion Binance hack.

Glassnode has counted 23 consecutive sessions of net outflows from US spot Ether ETFs, while a new report put Ether held in wallets linked to the hack at an estimated 525,200 ETH. Binance says it has already replaced 90% of the stolen assets, though that customer compensation does not erase the Ether still sitting in attacker-linked wallets.

ETF Outflows Stretch to 23 Sessions

The Ethereum price is contending with weakening fund demand as investors reassess their exposure to digital assets. The token fell more than 5% on Thursday before regaining some ground on Friday, according to recent market data.

Data from Glassnode shows US spot Ether ETFs recorded 23 consecutive outflow sessions, the longest such run since the funds launched. Farside's data captured a $4.4 million inflow on October 23 and five straight outflow sessions from October 26 through October 30. Those withdrawals totaled approximately $431.4 million, including $155.7 million on the final day.

The mechanics give the streak added significance: ETF shares are created and redeemed against the Ether the funds hold, so consecutive outflow sessions translate into net selling from fund reserves through a demand channel that only opened when the products debuted in July 2024.

BlackRock's iShares Ethereum Trust accounted for $76.6 million of that final day's outflows, while Grayscale's Ethereum Mini Trust saw $34.1 million leave the fund.

Glassnode noted that traditional investors had bought heavily in August and September. A sustained return of ETF inflows would give traders another measure of institutional demand for the Ethereum price.

Attacker-Linked Wallets Hold Estimated 525,200 ETH

Attention has also turned to wallets linked to the $6.3 billion Binance hack. An earlier estimate from blockchain analytics firm TRM Labs put attacker-linked holdings above 420,000 ETH. A later report published October 31 placed the total at an estimated 525,200 ETH across linked wallets as of 16:51 UTC.

The two figures use different reporting times and wallet scopes, and therefore do not establish a directly comparable increase in the attacker's holdings. Any future sales also remain uncertain.

A position of that size could weigh on the Ethereum price if its holder sells into the market, though the effect would depend on the size and timing of trades and on the liquidity available to absorb them.

Aave risk researchers said one linked wallet deposited about $60 million in USDT as collateral on October 29 and borrowed 19,762 wrapped ETH before the lending protocol restricted activity. Aave's market freeze blocked new activity but did not seize the borrowed funds. Freezing a market is a standard risk-management function on lending protocols such as Aave, halting new deposits and borrows while existing positions, including outstanding loans, remain in place.

That loan represents only part of the estimated Ether holdings. Researchers say other stolen assets were also exchanged for ETH. Tether and Circle froze significant amounts of the stolen stablecoins. Unlike those tokens, native ETH has no central issuer capable of freezing it directly.

Binance Replaces 90% of Stolen Assets

Binance says it has replenished 90% of the assets affected by the hack. The exchange also says customer ETH is fully backed and plans to resume withdrawals on November 1. Its replacement funding draws on corporate funds, futures insurance reserves, and the SAFU emergency fund, which was established in 2018 and is funded by a portion of trading fees.

Those replacement purchases are separate from the ETH still held in attacker-linked wallets. The Ethereum price could face a supply overhang — a pool of tokens capable of entering the market at any time — even after customer balances are covered. While buying replacement Ether could add demand, Binance has not said it will purchase the attacker's tokens.

Taken together, the extended ETF outflow streak and the large attacker-linked ETH holding present the Ethereum price with a dual test: traders are watching both for a return of institutional fund demand and for any sign that the stolen supply could reach the market. Binance's planned resumption of customer withdrawals on November 1 marks the nearest dated checkpoint, and daily ETF flow figures offer the most direct read on whether institutional demand turns back up.

Source: Blockonomi