This article discusses the changes in liquidity during the period when Binance's hot wallet was hacked and withdrawals were temporarily paused, analyzed from the perspective of market making and trading technology practices by BigTime. Data verification is up to November 4, 2026. The data comes from public reports and third-party platforms, with varying statistical criteria and timings; some are media paraphrases, unverified, and do not constitute investment advice.

Key Points

• Binance paused withdrawals for about 56 hours, during which spot and contract trading proceeded as normal. Users could still buy and sell, but funds and inventory in their accounts could not be withdrawn to other places.
• One week after the incident, Binance's share of spot trading volume among the top ten exchanges fell from about 48% to about 42%, while OKX rose from about 11% to about 14%. Meanwhile, the hackers were eager to swap currencies, incurring an execution loss of approximately $119 million, with traders and arbitrageurs earning about $60 million after deducting costs.
• After withdrawals resumed, funds flowing to other centralized exchanges accounted for about 10% of the withdrawal amount, and Hyperliquid's daily net inflow was less than 10% of Binance's net outflow. Market makers must also consider the counterparty risk associated with balances remaining on the exchange when assessing these changes.

On the evening of October 29, 2026 (UTC), Binance's hot wallet was hacked, with initial estimates of the impact being around $6.3 billion. In the following two days, a narrative emerged that Binance's withdrawal pause caused liquidity to flow into Hyperliquid and other exchanges. Changes in trading shares supported some claims, but the flow of funds did not indicate a similar scale of transfer. The two should be viewed separately, as price and spread have different causes.

The 56 Hours of Withdrawal Suspension

All times are in UTC

Table 1 | Key time points of the Binance event. Source: See the source column in the table; all are public reports, with discrepancies of several minutes to several tens of minutes for certain time points across different reports

From the suspension of withdrawals to the first phase of resumption took about 56 hours. Estimates of the scale of the theft vary: Chainalysis estimated about $5.912 billion at the time of theft based on market prices, while TRM estimated about $6.36 billion. TRM attributed the event to the North Korean hacker group TraderTraitor with "high confidence," a determination later confirmed by the FBI; Binance stated that its investigation had not assigned responsibility to any individual. For comparison, in February 2025, Bybit was hacked for about $1.46 billion, which had previously been the industry record.

During the withdrawal suspension, Binance's spot and contract trading continued as usual; the limitations were on withdrawals and a few products such as Alpha.

Users could still buy and sell on Binance, and market makers could continue to quote, but neither party could transfer inventory to other exchanges via withdrawals.

Changes in Trading Volume, Positions, and Prices

According to CoinDesk's statistics on October 30, BTC fell 3.1% within 24 hours, hitting a low of about $76,400 overnight; ETH fell about 4%, dipping to about $2,170; BNB dropped 6.2%. Derivatives trading volume increased by 74%, reaching $346.1 billion. During the same period, approximately $1.57 billion was liquidated across the network, primarily affecting long positions. According to CoinGlass data, about half of this occurred on Binance, confirming that contract trading on Binance was still operational during the withdrawal suspension.

Data from Kaiko (Bloomberg) shows that Binance's share of spot trading among the top ten exchanges fell from about 51% in mid-August to about 48% before the incident, further declining to about 42% within seven days afterward. During the same period, OKX rose from about 11% to around 14%, and Coinbase rose from about 9% to 9.6%.

Hyperliquid was the most discussed platform that evening. CoinDesk statistics show that HYPE's open contracts increased by 28%, and trading volume grew nearly eightfold. However, on the same day, Trade.xyz announced receiving investment from Intercontinental Exchange (ICE), with that news coming out before the Binance hack. Existing data cannot distinguish the separate impacts of these two events on the rise of HYPE, thus the increase cannot be entirely attributed to funds fleeing Binance.

These data show a transfer of trading activities; however, they do not establish that funds moved in synchrony. To place an order on OKX while Binance's withdrawals were paused, users needed already existing margins and inventory in their accounts. Binance's share dropped by about 6 percentage points over the week. Our judgment is that funds previously held by leading institutions in multiple exchanges provided conditions for this adjustment.

Price Discrepancies and Arbitrage Gains from Hacker Currency Swaps

The hacker was eager to swap currencies and incurred a cost above the market price, leaving space for arbitrageurs.

Stablecoins may be frozen by the issuer, prompting the hacker to rush to swap USDT for ETH. According to TRM's review, the hacker exchanged about 325 million USDT for about 122,300 ETH, with an implied average price of approximately $2,657, while the market price at that time was around $2,300 to $2,350. With limited on-chain liquidity, this eager-to-execute, price-unconsidered currency swap operation resulted in a significant premium.

Bitquery estimates that the hacker's execution loss relative to market price is about $119 million, of which about half was earned by traders and arbitrage bots, netting about $60 million after costs. Bloomberg reported that Ethereum block builders and validators earned about $29.5 million additionally. Data from DefiLlama shows that Titan Builder earned about $22.83 million in 24 hours that day, ranking first among all protocols.

TRX also experienced price discrepancies. James Aitchison from Caerus Global Management told Bloomberg that the hacker bought TRX on SunSwap for about 36.7 cents, while the price in other places was about 33 cents; this price discrepancy converged only about ten hours later. Prices also deviated among centralized exchanges. According to ChainCatcher, Galaxy's research director Alex Thorn pointed out that the discount of Bitcoin prices on Coinbase relative to Binance priced in USDT expanded to the largest level of the year.

Typically, arbitrageurs can buy in lower-priced places and sell in higher-priced venues, and then rebalance their assets and close positions through withdrawals, gradually narrowing the price difference. After Binance paused withdrawals, this rebalancing channel was obstructed; arbitrageurs found it difficult to move inventory, making it harder to eliminate price discrepancies between different places.

The Flow of Funds After Withdrawal Resumption

After withdrawals resumed, funds began to flow out of Binance accounts.

Table 2 | Flow of funds after withdrawal resumption. Source: See the source column in the table; the statistical timelines of different data platforms vary and cannot be directly summed

According to these statistics, the funds flowing into other centralized exchanges and on-chain exchanges are not sufficient to correspond to most of Binance's withdrawal amounts. We tend to believe that more funds withdrew from trading venues and remained in users' wallets. However, due to differing statistical timelines across platforms, this remains an inference about the direction of funds.

Geoff Kendrick of Standard Chartered believes that this incident may accelerate the shift of trading to decentralized exchanges (ChainCatcher). This medium to long-term judgment has not yet been reflected in the funding data for the week of the incident. According to The Block data, DEX spot trading volume was about 23% of CEX in October; in terms of this scale, on-chain exchanges still primarily serve as a supplementary function.

Market Maker Exposure and Comparison with FTX and Bybit

On the night of the incident, Wintermute and GSR quickly disclosed their exposures. Wintermute CEO Evgeny Gaevoy stated that the company's exposure on Binance was less than 20% of its net assets, and operations would not be affected; GSR CEO Xin Song stated that GSR's exposure was less than 5% of net assets. Both disclosures indicated that they had limited the proportion of assets remaining on a single exchange.

FTX experienced about $6 billion in net withdrawals within 72 hours before halting transfers outside of fiat currencies on November 8, 2022, later confirmed to have a shortfall in user assets. Binance paused withdrawals due to the hot wallet hack, yet trading continued as usual, with losses covered by company funds; as of November 1, about 95% had been replenished. Whether assets have a shortfall and whether losses can be replenished are key factors in understanding the differences in reactions to the two withdrawal pauses and market responses.

Bybit did not pause withdrawals after being hacked for about $1.46 billion in 2025. According to its published timeline, over 350,000 withdrawal requests, 99.994% were processed within 10 hours. A report published by Bybit through Kaiko indicated that its Bitcoin 1% market depth recovered to pre-incident levels after 30 days. Binance's pause of withdrawals aimed to ensure asset security, also restricted inventory reallocation, making it harder to narrow spreads; Bybit, by keeping the withdrawal channel open, had to withstand the pressure of continuous withdrawals.

Institutions can also manage asset storage separately from trading limits through over-the-counter settlements. Ceffu launched Binance Mirror in January 2023, allowing institutions to keep assets in isolated cold wallets, then mirror 1:1 to Binance accounts for trading; MirrorX automatically settles on T+1 in over-the-counter transactions. Public reports have yet to clarify whether these arrangements were affected by the incident, nor have they indicated how clients settled during the withdrawal pause; further disclosure from Binance or Ceffu is awaited.

Five Questions to Assess Exchange Exposure

Table 3 | Exchange exposure verification checklist. Source: Compiled by BigTime Research

In this incident, some trading shifted to places like OKX and Hyperliquid, while price discrepancies arising from hacker currency swaps provided profits for arbitrageurs and block builders. Meanwhile, funds in Binance accounts were difficult to transfer out before withdrawals resumed; the data after resumption further support the judgment of funds leaving trading venues and returning to users' wallets. In addition to comparing exchanges, market makers need to check: how long existing inventory can sustain when withdrawals are interrupted, and whether funds in other places are sufficient to complete hedges. For an overview of the market-making industry, see “The Cryptocurrency Market Making Industry Map: GSR and Its Rivals”; for transparency of terms between market makers and projects, see “Behind the Market Maker's Entry: The Transparency Gap in Market Making Contracts”.

Risk Warning

This article uses data from third-party data platforms and media reports, with differences in statistical criteria, time windows, and time zones. Some data comes from single sources or media paraphrases and may be subject to subsequent disclosures and corrections. The scale of the theft, the amount frozen, and the flow of funds are all estimates from various parties, unverified and not audited; on-chain fund flow statistics may also count internal wallet transfers as inflows or outflows. Descriptions of market makers and exchanges in this article are based on their public statements, which cannot reflect the complete risk situation.

Data description: The timeline and compensation information are derived from Binance announcements and reports from CoinDesk, Forbes, Winbuzzer, Binam, Wu Shuo, CNN, and others; price and liquidation data come from CoinDesk and CoinGlass; market shares are from Kaiko (Bloomberg); arbitrage and execution loss data are from TRM, Bitquery, and Bloomberg; fund flows are sourced from Binance disclosures, DefiLlama, and Artemis (as reported by The Block, BNN Bloomberg, Cointelegraph, ChainCatcher, and TokenPost); OTC settlement arrangements are from Ceffu and Binance official pages. The synthesis of liquidity migration is from BigTime Research analysis and does not constitute investment advice.

Disclaimer: This report is produced by BigTime Industry Research, based on publicly available data and does not constitute investment advice, an offer, or profit guarantees; past performance does not represent future results. Reproduction or extraction without written permission is prohibited.

BigTime Industry Research continues to cover market making, liquidity, and institutional asset markets, with a series of reports released successively.

[Disclaimer] The market has risks, and investment should be conducted with caution. This article does not constitute investment advice, and users should consider whether any opinions, viewpoints, or conclusions in this article are suitable for their specific circumstances. Investing based on this is at one's own risk.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。