Binance Rebuilds ENA Holdings After Major Hack
Binance is purchasing token assets after reporting a $6.3 billion loss, with onchain activity drawing attention to a large transfer of ENA tokens from wallets associated with Ethena. Bitcoin.com News reported that 128.63 million ENA, valued at about $24 million, reached a Binance deposit address.
The transfers may be relevant to Binance’s effort to rebuild the assets needed to support customer balances, but neither Binance nor Ethena confirmed that the movements were part of an over-the-counter transaction or a direct buyback arrangement.
What happened
Bitcoin.com News reported that blockchain trackers identified transfers from wallets associated with Ethena to Binance early on Oct. 31. Arkham Intelligence data, as cited by Bitcoin.com News, showed the ENA leaving an address labeled Ethena: Coinbase Prime Custody and moving to a Binance deposit address.
The 128.63 million ENA was sent in batches of roughly 25.25 million ENA over eight hours, according to Bitcoin.com News. The outlet valued the transferred tokens at about $24 million.
The movements arrived as Binance said it was purchasing the remaining assets necessary to address its reported loss. In a post published on Oct. 30, Binance said it had set aside more than $6.34 billion in company funds. It said more than $5 billion in corresponding token assets were already in place, covering approximately 80% of the $6.3 billion loss.
Binance said it was acquiring the remainder through market and over-the-counter channels. The company did not identify specific assets being purchased in the post, and it did not publicly connect the Ethena-associated transfers to its acquisition process.
Bitcoin.com News also cited onchain analyst EmberCN, who reported that 217.5 million ENA was stolen from Binance on Oct. 29. On that basis, the 128.63 million ENA transferred to Binance represented roughly 59% of the missing ENA, according to the outlet.
Why it matters
The ENA transfers offer a visible example of how a large exchange may restore token-by-token backing after a security incident. Replacing a dollar value alone would not necessarily restore the same inventory of crypto assets held for users. Binance’s statement specifically referred to corresponding token assets, making the composition of its holdings central to its recovery process.
Binance said it would take its first Proof of Reserves snapshot within 12 hours and publish the results by Nov. 2, 2026. It also said it was targeting phased withdrawal restoration within approximately 34 hours, subject to security checks.
That schedule places attention on the assets Binance holds at the time of the snapshot, rather than only on the amount of corporate capital it has committed. The reported movement of ENA into a Binance deposit address is therefore notable, even though the purpose of the transfers remains unconfirmed.
There are also differences in reporting around the transfer details. Bitcoin.com News described the value as about $24 million and said the transfers occurred over eight hours. Other circulating figures referenced $24.33 million and a shorter timing window ending at Oct. 31 UTC. Neither Binance nor Ethena confirmed an OTC deal, so those differences should not be treated as confirmation of the transaction’s purpose.
Background and context
Binance reported a hot-wallet attack spanning Oct. 29-30 that resulted in the loss of about $6.3 billion in token assets. The exchange pledged to fully cover the loss through its Secure Asset Fund for Users and corporate funds.
As of Oct. 30, Binance said more than $5 billion in corresponding token assets were already in place and that company funds exceeded $6.34 billion. Its stated plan was to purchase the remaining assets through market and over-the-counter channels.
The exchange must replace the exact stolen tokens to support user balances for its planned Nov. 2 Proof of Reserves report. That requirement explains why onchain observers have tracked ENA deposits alongside Binance’s stated market and OTC purchasing program.
Still, a deposit into an exchange-controlled address does not by itself establish the commercial arrangement behind it. The address label cited by Bitcoin.com News identifies an Ethena-associated custody source, but it does not establish whether Binance bought the tokens, whether Ethena sent them under a separate arrangement, or whether another party coordinated the transfer.
What to watch
The first question is whether Binance’s Proof of Reserves publication identifies its token holdings in enough detail to show how the exchange restored coverage for affected assets. Binance said it planned to publish that report by Nov. 2, 2026.
Another issue is whether Binance or Ethena provides a direct explanation of the 128.63 million ENA transfer. Confirmation could clarify whether the movement was connected to an OTC purchase, a market acquisition process, custody operations, or another mechanism.
Market participants will also be watching Binance’s phased withdrawal restoration process and the security checks that the exchange said would govern it. The exchange’s stated timeline was subject to those checks, leaving the implementation details open.
