Institutions pull more than $1 billion from US Bitcoin ETFs
US-listed Bitcoin exchange-traded funds suffered $1.04 billion in net withdrawals across Friday, October 30, and Monday, November 2, according to Bloomberg-compiled data, in one of the sharpest institutional retreats from digital assets in recent months.
The pullback came at an awkward moment for the market. Sentiment was already softening ahead of the November 3 US midterm elections, which investors viewed as a referendum of sorts on the future direction of Washington’s crypto policy. Layered on top was a security breach at Binance, the world’s largest cryptocurrency exchange, involving roughly $6.3 billion in stolen assets.
Together, the two forces produced a rare thing in crypto markets: a coordinated de-risking by the institutional class that Bitcoin ETFs were supposed to stabilise.
BlackRock’s iShares Bitcoin Trust (IBIT), the largest spot Bitcoin fund in the United States, bore the brunt of Monday’s outflows. The fund lost $405 million in a single session, its largest daily withdrawal since June. Friday’s broader selloff added further pressure across the product suite, with approximately $233.7 million pulled from IBIT, $201.4 million from Fidelity’s Wise Origin Bitcoin Fund, and $129.5 million from the ARK 21Shares Bitcoin ETF.
Those three funds sit at the heart of what many analysts treat as the single most important innovation in crypto market structure of the past two years. Because they hold the underlying asset directly and are sold through conventional brokerage channels, they have become the default vehicle for pension funds, hedge funds, and wealth managers seeking Bitcoin exposure. Their flows are widely read as a proxy for institutional demand, which is precisely why the withdrawals matter beyond a couple of weak trading sessions.
The Binance hack and the revival of custody fears
The immediate catalyst for the risk-off turn was the October 29 attack on Binance, which involved the theft of roughly $6.3 billion in assets. Binance said on November 3 that the attackers had used social-engineering techniques, including fake job interviews, combined with malicious software. The exchange described the incident as a “sophisticated, multi-stage campaign” and attributed it to North Korea, a attribution Pyongyang denied.
The mechanics of the breach unsettled the market in a way that ordinary exchange outages do not. Social engineering aimed at individual employees suggests a level of planning and patience associated with state-sponsored operations rather than opportunistic criminals. Fake job interviews are a long-documented tactic of North Korean hacking groups, and the scale of the haul, if confirmed, would rank among the largest thefts in crypto history.
Binance responded by suspending withdrawals temporarily, later resuming them in phases. The exchange said it had replenished about 95% of affected assets and that major tokens were fully backed. That reassurance did something to calm fears of a full-blown solvency crisis, but the episode revived questions that the industry has never fully answered: how safe are assets held on centralized exchanges, and how quickly can contagion spread when confidence in a custodian breaks?
The timing was poor. The market has spent much of the past year trading on the assumption that institutionalisation, the arrival of ETFs, regulated custodians, and Wall Street balance sheets, had made crypto more resilient. A $6.3 billion breach at the industry’s largest exchange undermines that narrative at exactly the moment investors were already scanning the horizon for political risk.
For ongoing coverage of exchange security incidents and their market fallout, see our exchange and custody news.
Midterms, macro data and the politics of crypto exposure
The second pressure point was political. The November 3 midterm elections dominated the US news cycle in the days before the outflows, and crypto investors were watching closely. The Trump administration’s approach to digital assets has been a defining feature of the sector’s recent fortunes, and investors were looking to the midterms for clues about whether that policy posture would survive intact.
Political risk of this kind is notoriously difficult to price. A legislative chamber that turns hostile to crypto, or a regulatory environment that becomes less predictable after the vote, could affect everything from token listings to the tax treatment of staked assets. Institutional investors, who must justify positions to committees and clients, tend to reduce exposure ahead of binary political events rather than trade through them. The ETF flows suggest that is exactly what happened.
Macro conditions compounded the caution. The November 6 US jobs report was the next major data point on the calendar, and labour-market surprises have an outsized effect on risk assets. A hotter-than-expected print would pressure rate-cut expectations; a weaker one would raise recession questions. Either outcome added uncertainty to an already crowded risk calendar, and Bitcoin, which trades increasingly like a high-beta risk asset, sat squarely in the path of it.
The combination matters because ETF outflows are not merely reactive. When retail investors sell in a panic, the damage is often contained. When the fund complexes that absorbed billions in institutional money start leaking, the selling feeds on itself: redemptions force authorised participants to sell underlying Bitcoin, which pressures spot prices, which triggers further redemptions. Monday’s $405 million exit from IBIT alone, the fund’s worst day since June, was a reminder of how quickly that loop can spin up.
What the outflows signal about institutional conviction
It is worth being precise about what the data does and does not say. Two days of outflows totalling $1.04 billion is a significant sum, but it comes after a long stretch in which these same funds absorbed tens of billions in net inflows. The withdrawals mark a shift in appetite, not obviously a structural break in demand. Some of the money may sit on the sidelines through the election and the jobs report, then return if the political outcome is read as benign.
Still, the episode exposes a fragility in the institutional thesis. Bitcoin ETFs were sold to the market as a way to decouple crypto from the industry’s operational risks: no exchange counterparty, no self-custody headaches, regulated wrappers with familiar tickers. Yet when Binance was hacked, the ETF complex bled anyway. That is partly mechanical, since spot Bitcoin’s price reacts to systemic fear regardless of where an investor holds it. But it is partly behavioural too. Institutional risk committees do not distinguish carefully between the failure modes of crypto venues. A hack at Binance raises the risk premium on the entire asset class.
The attribution to North Korea adds a geopolitical dimension that is harder to dismiss. If confirmed, it would suggest that crypto treasuries, whether held by exchanges or embedded in ETF structures, are now treated by adversarial states as a strategic target. That reality may eventually push more institutional flows toward regulated custodians with insurance and audit infrastructure, a shift that would advantage the ETF complex in the long run even as it punishes the broader exchange ecosystem in the short run.
Closing analysis
The $1.04 billion in outflows reads less like a verdict on Bitcoin than like a hedge against a specific cluster of risks: a political event, a macro print, and a security shock, all landing within a single week. BlackRock’s largest daily IBIT withdrawal since June tells us institutions were paying attention, not that they have left.
The deeper takeaway concerns sequencing. Binance’s statement that it had replenished about 95% of affected assets, with major tokens fully backed, prevented an immediate solvency panic, and that containment is why the ETF outflows, while large, stopped short of a rout. The market now has two watch points. The first is whether flows stabilise once the midterm results and the November 6 jobs data are absorbed. The second is whether the custody questions raised by a $6.3 billion social-engineering campaign translate into lasting changes in where institutions are willing to hold digital assets. If the first resolves quickly and the second favours regulated wrappers, this week’s withdrawals may prove to be a pause in a structural trend rather than the start of a reversal.
For continued tracking of fund flows and price reaction, follow our Bitcoin coverage.
