In this incident, some transactions shifted to places like OKX and Hyperliquid, and the price differences created by the hack provided profits for arbitrageurs and block builders.

Written by: BigTime

Core Insights

• Binance suspended withdrawals for about 56 hours, during which spot and futures trading continued as usual. Users were still able to buy and sell, but funds and inventories in their accounts could not be withdrawn to other venues.
• A week after the incident, Binance's spot trading share among the top ten exchanges dropped from about 48% to approximately 42%, while OKX rose from about 11% to around 14%. Meanwhile, the hacker hastily exchanged currencies, incurring around $119 million in execution losses, while traders and arbitrageurs netted about $60 million after deducting costs.
• After withdrawals were resumed, about 10% of the withdrawn funds flowed to other centralized exchanges, with Hyperliquid’s single-day net inflow being less than 10% of Binance’s net outflow. Market makers need to consider the counterparty risk brought by the remaining balances on the exchanges when evaluating these changes.

On the evening of October 29, 2026 (UTC), Binance's hot wallet was hacked, with the initial estimate of the loss being around $6.3 billion. In the following two days, a narrative spread in the market: Binance suspended withdrawals, and liquidity flowed to Hyperliquid and other exchanges. The change in trading shares supported some of these claims, but the fund flows did not show the same scale of transfer. The two must be viewed separately, as price and price differences each have their own causes.

1. The 56 Hours of Withdrawal Suspension

All times are in UTC

Table 1｜Key Timeline of the Binance Incident. Source: See source column in the table, all public reports, with some time points differing by several minutes to tens of minutes across reports.

From the suspension of withdrawals to the first phase of restoration took about 56 hours. Estimates of the scale of the theft vary: Chainalysis estimated it to be about $5.912 billion at market price at the time of the hack, while TRM estimated about $6.36 billion. TRM attributed the incident to the North Korean hacker group TraderTraitor with "high confidence," a determination later confirmed by the FBI; Binance stated that the investigation had not yet held any individuals responsible. For comparison, in February 2025, Bybit was hacked for about $1.46 billion, which was the industry record until now.

During the withdrawal suspension, Binance's spot and futures trading continued as normal, while the only restrictions were on withdrawals and a few products like Alpha.

Users were still able to buy and sell on Binance, and market makers could continue to quote, but neither side could transfer inventory to other exchanges through withdrawals.

2. Changes in Trading, Positions, and Prices

According to CoinDesk statistics from October 30, BTC dropped by 3.1% within 24 hours, with an overnight low of about $76,400; ETH fell by about 4%, dropping to around $2,170; BNB declined by 6.2%. Derivatives trading volume increased by 74%, reaching $346.1 billion. During the same period, approximately $1.57 billion was liquidated across the network, primarily among long positions. According to CoinGlass data, about half of this occurred on Binance, confirming that Binance's futures trading was still operational during the withdrawal suspension.

Data from Kaiko (Bloomberg) shows that in spot trading among the top ten exchanges, Binance's share dropped from about 51% in mid-August to approximately 48% before the incident and further decreased to about 42% after the incident. Meanwhile, OKX increased from about 11% to approximately 14%, and Coinbase rose from roughly 9% to 9.6%.

Hyperliquid was the most discussed platform that night. CoinDesk reported that HYPE's open interest rose by 28%, and trading volume surged nearly eightfold. However, on the same day, Trade.xyz announced it had secured investment from the Intercontinental Exchange (ICE), with the news predating the Binance hack. Existing data could not distinguish the individual impacts of these two events on HYPE’s rise, thus the increase cannot be entirely attributed to funds fleeing Binance.

These data show a shift in trading activity but are insufficient to explain that funds were also moving simultaneously. When Binance suspended withdrawals, to place an order on OKX, existing margin and inventory were needed in the account. Binance’s market share dropped by about 6 percentage points in a week. Our judgment is that the funds from major institutions that had previously been held across multiple exchanges provided the conditions for this adjustment.

3. Price Differences Created by the Hacker's Currency Exchange and Arbitrage Profits

The hacker was eager to exchange currencies and paid above-market costs in on-chain transactions, leaving space for arbitrageurs.

Stablecoins may be frozen by the issuer, prompting the hacker to hastily exchange USDT for ETH. According to TRM’s review, the hacker exchanged about 325 million USDT for roughly 122,300 ETH, with an implied average price of about $2,657, while the market price at the time was about $2,300 to $2,350. With limited on-chain liquidity, this urgent exchange without regard for price incurred a noticeable premium.

Bitquery estimated the hacker's execution loss relative to the market price to be about $119 million, half of which was gained by traders and arbitrage bots, netting about $60 million after deducting costs. According to Bloomberg, Ethereum block builders and validators earned an additional approximately $29.5 million. DefiLlama data shows that Titan Builder’s 24-hour income on that day was about $22.83 million, ranking first among all protocols.

TRX also experienced price differences. James Aitchison from Caerus Global Management told Bloomberg that the hacker purchased TRX at about 36.7 cents on SunSwap, while prices were around 33 cents at other venues, and this price difference took about 10 hours to converge. Price deviations also occurred between centralized exchanges. According to ChainCatcher, Galaxy’s research director Alex Thorn pointed out that Coinbase's Bitcoin price discount relative to Binance's USDT price expanded to its largest within the year.

Typically, arbitrageurs can buy at lower-priced venues and sell at higher-priced ones, then adjust assets and close positions through withdrawals to gradually eliminate the price difference. When Binance suspended withdrawals, this adjustment channel was obstructed, making it more difficult for arbitrageurs to move inventory and for price differences to converge between different venues.

4. Fund Flows after the Resumption of Withdrawals

After withdrawals were restored, funds began to flow out of Binance accounts.

Table 2｜Fund Flow after the Resumption of Withdrawals. Source: See source column in the table; different data platforms have different statistical windows and cannot be summed up directly.

According to these statistics, the funds flowing into other centralized exchanges and on-chain exchanges do not correspond to the majority of Binance's withdrawal amount. We tend to believe that more funds have fled the trading venues and returned to users' own wallets. However, since the statistical windows of various platforms differ, this remains an inference on the fund's whereabouts.

Geoff Kendrick from Standard Chartered believes this incident may accelerate the shift of trading towards decentralized exchanges (ChainCatcher). This medium- to long-term judgment has not been reflected in the funding data of the week following the incident. According to The Block data, the DEX spot trading volume in October was about 23% of that of CEX; based on this scale, on-chain exchanges still primarily serve a supplementary role.

5. Market Maker Exposure and Comparison with FTX and Bybit

On the night of the incident, Wintermute and GSR quickly disclosed their exposure. Wintermute CEO Evgeny Gaevoy stated that the company's exposure on Binance was less than 20% of its net assets and that operations would not be affected; GSR CEO Xin Song indicated that GSR's exposure was below 5% of its net assets. Both disclosures showed that they had limited the proportion of assets held on a single exchange.

FTX experienced about $6 billion in net withdrawals within 72 hours before stopping transfers other than fiat on November 8, 2022, and later it was confirmed that there was a user asset shortfall. Binance suspended withdrawals due to the hack of its hot wallet, but trading continued as usual, with losses borne by the company's funds, and approximately 95% had been compensated as of November 1. Whether there is an asset shortfall and whether losses can be compensated are important factors in understanding the differences in the market reactions to the two instances of withdrawal suspension.

Bybit did not suspend withdrawals after being hacked for about $1.46 billion in 2025. According to its published timeline, over 350,000 withdrawal requests were processed, with 99.994% handled within 10 hours. A Kaiko report published by Bybit indicated that its Bitcoin 1% market depth returned to pre-incident levels after 30 days. Binance’s withdrawal suspension aimed to safeguard asset security but limited the adjustment of inventory, making it harder for price differences to converge; Bybit kept its withdrawal channels open, which meant facing continuous withdrawal pressure from users.

Institutions can also manage asset storage and trading limits separately through over-the-counter settlements. Ceffu launched Binance Mirror in January 2023, where institutions keep assets in isolated cold wallets, and then mirror them 1:1 to Binance accounts for trading; MirrorX, on the other hand, automatically settles on a T+1 basis off-exchange. Public reports have not specified whether these arrangements were affected by this incident, nor have they detailed how clients settled during the withdrawal suspension, which still requires disclosure from Binance or Ceffu.

6. Five Questions to Assess Exchange Exposure

Table 3｜Exchange Exposure Checklist. Source: Compiled by BigTime Research

In this incident, some transactions shifted to places like OKX and Hyperliquid, and the price differences created by the hacker's currency exchange provided profits for arbitrageurs and block builders. At the same time, funds in Binance accounts were difficult to transfer out before the resumption of withdrawals; the data after resumption more strongly supports the judgment that funds left trading venues and returned to users’ wallets. Market makers, in addition to comparing exchanges, need to check: once withdrawals are interrupted, how long existing inventory can be maintained and whether funds at other venues are sufficient to complete hedging. For insights into the overall landscape of the market-making industry, see the article “Crypto Market Making Industry Map: GSR and Its Competitors”; for insights on the transparency of terms between market makers and projects, see the article “Behind the Market Makers: The Transparency Gap of Market Making Contracts”.