Binance’s withdrawal freeze after its hot wallet hack lasted about 56 hours, and the market impact split into two different stories: trading moved, but funds did not appear to move on the same scale.
During the suspension, spot and derivatives trading on Binance continued. Users could still buy and sell, and market makers could keep quoting prices, but balances and inventory held on the exchange could not be withdrawn and redeployed elsewhere.
A 56-hour freeze after the hack
The report says Binance suspended withdrawals for roughly 56 hours from the initial halt to the first phase of restoration. Estimates of the stolen amount varied. Chainalysis put the figure at about $5.912 billion based on market prices at the time of the theft, while TRM estimated about $6.36 billion. TRM attributed the incident to North Korean hacking group TraderTraitor with what it described as “high confidence,” and the FBI later reached the same conclusion. Binance, for its part, said its investigation had not assigned responsibility to any individual.
For comparison, the report notes that the roughly $1.46 billion stolen from Bybit in February 2025 had previously stood as the industry record.
While withdrawals were paused, Binance kept spot and futures trading open. The restrictions applied to withdrawals and a small number of products including Alpha. That meant users and market makers could continue trading on Binance, but they could not move inventory to other exchanges through the withdrawal channel.
Volume shifted, but that does not prove capital moved with it
CoinDesk data from Oct. 30 showed BTC fell 3.1% over 24 hours and touched an overnight low of about $76,400. ETH dropped about 4% and briefly fell to around $2,170, while BNB lost 6.2%. Derivatives volume rose 74% to $346.1 billion. Total liquidations across the market reached about $1.57 billion, mostly on the long side. CoinGlass data showed about half of those liquidations occurred on Binance, which also confirmed that Binance derivatives trading remained active during the withdrawal halt.
Kaiko data cited by Bloomberg showed Binance’s share of spot trading across the top 10 exchanges had already slipped from about 51% in mid-August to around 48% before the incident, then fell further to roughly 42% in the seven days after it. Over the same period, OKX rose from about 11% to around 14%, while Coinbase moved from about 9% to 9.6%.
Hyperliquid drew some of the most attention that night. CoinDesk said HYPE open interest rose 28% and trading volume jumped nearly eightfold. But the report also notes that Trade.xyz announced an investment from Intercontinental Exchange, or ICE, on the same day, and that news came before the Binance hack. The available data does not separate the effect of those two events, so the move in HYPE cannot be fully attributed to capital leaving Binance.
The article’s conclusion is narrower: the data shows trading activity shifted, but it does not show that funds moved in equal size. If traders wanted to place orders on OKX while Binance withdrawals were frozen, they needed margin and inventory already sitting there. Binance’s roughly 6 percentage point drop in share over a week may say more about large institutions keeping capital across multiple venues in advance than about a sudden transfer after the hack.
The hacker’s swaps created spreads and arbitrage profits
The report says the attacker’s rush to swap assets on-chain led to execution far above market prices and opened room for arbitrage.
Because stablecoins can potentially be frozen by issuers, the hacker moved quickly to exchange USDT for ETH. TRM’s reconstruction said about 325 million USDT was swapped for roughly 122,300 ETH, implying a price near $2,657 per ETH, versus a prevailing market range of about $2,300 to $2,350. With limited on-chain liquidity, that kind of urgent, price-insensitive execution came at a steep premium.
Bitquery estimated the attacker’s execution loss relative to market prices at about $119 million. Roughly half of that went to traders and arbitrage bots, which netted about $60 million after costs. Bloomberg separately reported that Ethereum block builders and validators earned another roughly $29.5 million. DefiLlama data showed Titan Builder generated about $22.83 million in revenue over 24 hours that day, the highest among all protocols.
TRX also traded at a notable premium. James Aitchison of Caerus Global Management told Bloomberg that the hacker bought TRX on SunSwap at about 36.7 cents while the token traded around 33 cents on other venues, and that spread did not close for about 10 hours. Price gaps also appeared across centralized exchanges. ChainCatcher, citing Galaxy head of research Alex Thorn, said the discount in Coinbase’s bitcoin price relative to Binance’s USDT-based pricing widened to the largest level of the year.
Under normal conditions, arbitrageurs can buy on the cheaper venue, sell on the more expensive one, then move assets through withdrawals to flatten positions and help close the spread. Once Binance paused withdrawals, that inventory transfer route was blocked. Traders could not move balances as easily, and cross-venue dislocations became harder to eliminate.
After withdrawals resumed, the money still did not appear to flood into other venues
The report says funds only began leaving Binance accounts after withdrawals were restored.
Based on the figures compiled in the article, flows into other centralized exchanges and on-chain trading venues were both too small to account for most of Binance’s withdrawal volume. The authors lean toward the view that more of the money left trading venues altogether and ended up in users’ own wallets. They also caution that the reporting windows differ across data providers, so those figures cannot be added directly and the conclusion remains an inference rather than a definitive count.
Geoff Kendrick of Standard Chartered said the incident could accelerate a shift in trading toward decentralized exchanges, according to ChainCatcher. The article says that longer-term view was not yet visible in the week-of-event flow data. The Block’s data showed DEX spot volume in October was about 23% of CEX spot volume, suggesting on-chain venues still play more of a supplementary role at current scale.
Market makers disclosed exposure, and the report compares Binance with FTX and Bybit
Wintermute and GSR moved quickly to disclose their exposure that night. Wintermute CEO Evgeny Gaevoy said the firm’s Binance exposure was below 20% of net assets and operations would not be affected. GSR CEO Xin Song said GSR’s exposure was below 5% of net assets. In both cases, the disclosures showed limits on how much capital the firms leave on any single exchange.
The article also compares the episode with FTX and Bybit. After about $6 billion in net withdrawals over 72 hours, FTX halted transfers other than fiat on Nov. 8, 2022, and was later found to have a shortfall in customer assets. Binance, by contrast, paused withdrawals because of a hot wallet hack while keeping trading open, with losses covered by company funds. As of Nov. 1, about 95% of the loss had been replenished. The report argues that whether customer assets are missing, and whether losses can be covered, is central to understanding the different market reactions to the two withdrawal suspensions.
Bybit did not suspend withdrawals after its roughly $1.46 billion hack in 2025. According to its published timeline, 99.994% of more than 350,000 withdrawal requests were processed within 10 hours. A Kaiko report released by Bybit said its bitcoin 1% market depth recovered to pre-incident levels 30 days later. The article says Binance’s choice to pause withdrawals protected asset security but also restricted inventory transfers, making spreads harder to close. Bybit kept the withdrawal channel open, but had to absorb the pressure of continued outflows.
Questions remain around off-exchange settlement arrangements
Institutions can also separate asset custody from trading balances through off-exchange settlement. Ceffu launched Binance Mirror in January 2023, allowing institutions to keep assets in segregated cold wallets and mirror them 1:1 into Binance accounts for trading. MirrorX then handles T+1 automatic settlement off exchange.
Public reporting has not said whether those arrangements were affected by this incident, nor how clients settled during the withdrawal freeze. The article says further disclosure from Binance or Ceffu is still needed.
For market makers, venue comparison is only part of the risk check
The report closes with a practical point. Some trading clearly shifted to venues including OKX and Hyperliquid, and the hacker’s forced swaps created spreads that benefited arbitrageurs and block builders. At the same time, funds sitting in Binance accounts were hard to move before withdrawals resumed, and the post-reopening data points more toward money leaving trading venues and returning to user wallets.
For market makers, the key questions go beyond comparing exchanges. They also need to know how long existing inventory can support operations if withdrawals stop, and whether balances on other venues are enough to complete hedges.
