Binance Buyback Takes Shape as $24M in ENA Flows Back

Published October 31, 2026, 03:15 PM PKT. Based on Binance's October 30, 2026 Security Incident Update #2, Lookonchain tracking and Arkham Intelligence wallet labels as reported by Bitcoin.com News on October 31, 2026, CryptoTimes' October 31, 2026 account of the same transfers, and Reserve Protocol's statement as reported by Bitcoin.com News. Neither Binance nor Ethena has confirmed the purpose of the ENA transfers described below, and this article does not present the transfers as a confirmed Binance purchase.

Binance's buyback of the assets stolen in its October 29, 2026 hack is now visible on chain, at least in part. Wallets labeled as belonging to Ethena sent 128.63 million ENA, worth about $24 million, to Binance over eight hours on October 31, 2026, according to Lookonchain tracking reported by Bitcoin.com News. The transfers arrived in batches of roughly 25.25 million ENA from an address Arkham Intelligence labels "Ethena: Coinbase Prime Custody," with each batch landing in a Binance deposit address, Bitcoin.com News reported. The amount matters because it lines up with the theft itself: on-chain analyst EmberCN put the ENA stolen from Binance on October 29 at 217.5 million tokens, so the October 31 inflow covers roughly 59% of the missing ENA. The hacker no longer holds that ENA, having sold all 217.5 million tokens for about $33.93 million as part of seven token sales that produced 70,480 ETH, according to the same reporting. ENA traded near $0.19 at the time of the reports.

128.63 million ENA in eight hours

The sequence, as tracked by Lookonchain, began in the early hours of October 31, 2026, with the firm's post on X at about 03:31 UTC flagging the deposits, CryptoTimes reported. Lookonchain described the flow in one line: "Binance is buying back the stolen assets through market channels and OTC deals," and added that Ethena had deposited the 128.63 million ENA into the exchange over the preceding eight hours. Arkham's labels give the trail its shape, showing the tokens leaving a Coinbase Prime custody address associated with Ethena in steady batches, but labels are not confirmations. Neither Binance nor Ethena has said the transfers are part of the buyback, and the deposits could in principle reflect other Ethena treasury movements. What makes the buyback reading credible is the fit: the token is one of the assets taken in the hack, the amount is a large fraction of exactly what was taken, and the timing falls one day after Binance said it was actively buying the remaining stolen tokens. Readers should still treat the link as inferred from on-chain data, not as a statement from either company, until one of them confirms it.

The $6.34 billion reserve and the token-for-token rule

The buyback follows the plan Binance set out on October 30, 2026 in Security Incident Update #2, signed by co-chairs Yi He and Richard Teng. The exchange said it would cover all stolen funds through its Secure Asset Fund for Users, an emergency reserve, and its corporate treasury, and that it had set aside more than $6.34 billion, with $5 billion already held in the exact tokens that were stolen, including USDC, USDT, BTC, ETH and BNB. That covers about 80% of the roughly $6.3 billion loss, leaving about $1.3 billion, or 20%, to be bought. The update stated: "We are actively buying the remaining relevant token assets through market and OTC channels." The token-for-token detail is the part that makes the ENA flow legible. Binance is replacing each stolen altcoin with the same token rather than with Bitcoin or Ether, so that its reserves match customer balances one for one. Repaying stolen ENA with BTC or ETH would cover the dollar value but would leave the ENA reserve ratio below 100%, and the drained "Binance 14" hot wallet was among the holdings Binance counted toward customer balances in its October 1 reserve snapshot, CryptoTimes reported. Yi He has spent the weekend reassuring users, telling supporters in Chinese that Binance would "never let down those who trust Binance," and declining offers of user donations by saying the exchange could cover the losses and that donations should go to charity instead, Bitcoin.com News reported.

RSR is next, with a Monday deadline

Ethena is not the only project in the queue. The Reserve Protocol team said Binance had confirmed it will repurchase the 3.38 billion RSR stolen in the attack, Bitcoin.com News reported. Reserve added that its treasury has no appetite to sell, and said: "In the case of RSR we believe Binance will acquire on the open market through a professional market maker." With RSR near $0.00137 per token, the missing tokens are worth about $4.6 million, and RSR was up about 6.4% over the past 24 hours at the time of the report, though it is unclear how much of that move is tied to buying. Reserve said it infers the repurchase will be finished by Monday, because that is when Binance has promised a full proof of reserves report showing that balances are fully backed. That inference, not a Binance timetable, is the only published deadline for the RSR leg. The same caution applies to the wider buyback: Binance has not published a completion timetable for the remaining purchases, and no figure has been published for how much of the roughly $1.3 billion gap has actually been closed beyond the ENA inflow described here.

The Sunday withdrawal test and the Monday reserves report

Two dated checkpoints will show whether the recovery plan is holding. Binance said it would run an initial proof of reserves snapshot within 12 hours of its October 30 update, with results ready by November 2, and that withdrawals, frozen since the evening of October 29, are targeted to resume in phases within about 34 hours of that update, subject to security checks. That arithmetic points to a phased reopening around Sunday, November 1, and a reserves report on Monday, November 2, but both are targets, not promises, and the restart will roll out in phases rather than all at once. About $3 billion in affected assets has been frozen on chain with the help of industry partners, including roughly $1.6 billion in USDT frozen by Tether and about $800 million in USDC frozen by Circle, but frozen funds are not recovered funds, and Binance has not disclosed how much stolen crypto is actually back under its control. Attribution also remains unconfirmed by Binance: TRM Labs and Chainalysis have tied the theft to North Korea's TraderTraitor group, and the US Secret Service and FBI have opened a probe according to earlier reporting, but Binance has not publicly confirmed who carried out the attack. The Monday report is therefore the first hard test of the whole plan: it will show whether Binance closed the remaining 20% gap in time, whether the ENA inflow was part of that close, and whether more project treasuries were quietly part of the fix.

This article is news reporting and is not investment advice.

Sources

• Binance, Security Incident Update #2, October 30, 2026, signed by co-CEOs Yi He and Richard Teng (primary source for the more than $6.34 billion reserve, the $5 billion already held in matching tokens, the market and OTC buyback of remaining tokens, the proof of reserves snapshot and November 2 results date, and the phased withdrawal target)
• Bitcoin.com News, Binance Starts Shopping for Stolen Coins as Ethena Ships $24M in ENA (published October 31, 2026, secondary source for the 128.63 million ENA figure, the 25.25 million token batches, the Arkham "Ethena: Coinbase Prime Custody" label, the 217.5 million ENA stolen figure via EmberCN, the $33.93 million hacker sale, the 3.38 billion RSR repurchase, and the Yi He user messages)
• CryptoTimes, Binance Buys Back Stolen Assets via OTC Deals After $6.3B Hack as Ethena Sends $24M (published October 31, 2026, secondary source for the Lookonchain X post timing at about 03:31 UTC October 31, the eight-hour deposit window, the 59% coverage figure, the token-for-token reserve logic, and the caution that neither Binance nor Ethena had confirmed the purpose of the transfer)
• Lookonchain, X post, October 31, 2026, and Arkham Intelligence wallet labels, via Bitcoin.com News and CryptoTimes (on-chain source for the ENA deposit flow and the custody address label)
• Reserve Protocol, statement via Bitcoin.com News, October 31, 2026 (source for the Binance confirmation of the 3.38 billion RSR repurchase and the open-market acquisition expectation)