Why a $6.4B Binance Hack Barely Shook Bitcoin: The ETF Buffer Changed the Market’s Reflexes

A record-setting exchange breach used to trigger a cascading selloff. This time, it didn’t. Binance confirmed a roughly $6.4 billion theft—over four times the $1.5 billion Bybit heist in February 2025 as estimated by Chainalysis and TRM Labs—yet Bitcoin only dipped to about $76,400 on Friday, roughly 6% below where it traded after Wednesday’s Fed decision. Spot moves were brisk but contained: Bitcoin was down about 4% a day later, with 24-hour performance at -5.32%, a high of $80,769, a low of $76,339, and reported volume near $2.6 billion. More than $1.3 billion in leveraged positions were flushed out, and still the tape held.

In March 2018, the same venue’s security scare sent Bitcoin from $10,740 to $9,690 within minutes—nearly 11%—and it kept sliding to about $6,600 by April 5. That attack hinged on account takeovers, API key abuse, and a coordinated pump of Viacoin while 31 pre-positioned accounts offloaded into the frenzy; Binance said no funds were ultimately stolen. The setup then was fragile: crypto’s market cap barely topped $400 billion in March 2018, Fear and Greed printed 12 (“extreme fear”), and risk was already trending lower off the 2017 peak.

Today’s plumbing looks different. The market is roughly $2.6 trillion, and a sizable slug of supply sits in U.S. spot Bitcoin ETFs. Funds such as BlackRock’s iShares Bitcoin Trust now hold roughly 1.3 million BTC—about 6% of supply—inside brokerage accounts, away from exchange hot wallets. Those vehicles brought in $136 million on Wednesday, per Farside Investors, and sovereign wealth funds like Mubadala and the Abu Dhabi Investment Council have been buyers. Shareholders of these products tend to be slower to capitulate; the creation/redemption mechanics don’t incentivize knee-jerk selling during headlines. Timing helped as well: the theft began at 4:05 p.m. ET Thursday, after U.S. markets closed. Preliminary ETF inflows of about $17 million recorded Thursday predate the event, making Friday the first clean read on whether that base will actually de-risk.

Containment also arrived faster. Binance says it has set aside more than $6.34 billion of company funds to cover every loss and is sourcing the missing assets both on-exchange and over-the-counter—reducing visible book pressure. About $3 billion is frozen, deposits are operating normally, and withdrawals are slated to resume in 45 hours. That clarity acts like a backstop when screens are thin.

Not everything can be ring-fenced. The attacker still holds more than 420,000 ETH and 18,270 BTC—around $2.4 billion—that no stablecoin issuer can freeze; other tokens would push that stash above $3 billion. TRM Labs and Chainalysis link the operation to the North Korean group behind the 2025 Bybit exploit, which later converted roughly 84% of stolen Ethereum into Bitcoin via Thorchain, a cross-chain swap network that complicates interdiction. That pattern raises the odds of continued laundering attempts via censorship-resistant rails even as stablecoin treasuries immobilize what they can.

Sentiment wasn’t great going in and softened further. CoinMarketCap’s Fear and Greed gauge slipped to 36 from 43, flipping from “neutral” to “fear.” Bitcoin trades about 38% below its $126,080 record. Glassnode data indicate long-term holders sit underwater on roughly 4 million coins acquired between $85,000 and $118,000, and as HashKey’s Tim Sun noted before the hack, the drag lately has been insufficient incremental demand rather than sudden capitulation.

The throughline is structural evolution. ETF sequestration of supply dampens reflexive selloffs; creation/redemption frictions, institutional mandates, and sovereign wealth allocations often extend holding horizons. At the same time, the response toolkit is broader: stablecoin freezes swiftly cordon a portion of loot, while exchanges with sizable treasuries can cushion users and source liquidity OTC to avoid on-screen spirals. That said, there’s a trade-off: growing concentration of Bitcoin in regulated wrappers introduces governance and policy sensitivities, and cross-chain tools like Thorchain preserve adversaries’ optionality. Markets can price both truths at once, which is why the tape absorbed a record hack while staying focused on flows, not fear.