Binance stopped paying out 12 minutes into the hack. Over the next two days, Bybit drew 2.4 times its usual depositors

01 · What happenedBinance stopped paying out 12 minutes into the hack

On the evening of 29 October, Binance stopped sending money to its customers. A hacker had begun draining the exchange 12 minutes earlier. For the next two days, almost nothing went out.

Binance is the world's biggest crypto exchange, and on a normal day it pays out money nonstop. In the same hours a week earlier, it made more than a million payouts across five blockchains. During the halt it made 2,248.

Bitquery records every transfer on those chains, so we followed what the halt did to the rest of crypto. We timed the stop on each chain and measured the money that stayed put. Then we counted the people who turned up at Binance's rivals instead. We also looked for the shock in stablecoins, the dollar tokens that crypto runs on, and in BNB and the lending apps on Ethereum.

Users did not wait. Within hours, Bybit, OKX and Bitget were taking in far more deposits than usual, while Coinbase, which serves mostly US customers, stayed in its normal range. Stablecoins held their dollar peg. BNB, Binance's own coin, took the hardest hit among the big coins. Our trace of the Binance hack covers the theft itself: $6.3 billion taken, $2.75 billion frozen and where the rest went.

02 · How it worksHow an exchange pays you, and how a halt shows up on-chain

A centralized exchange like Binance keeps most customer coins offline, in cold storage. It pays withdrawals from hot wallets, online wallets that send coins out all day. When you deposit, you send coins to a deposit address that belongs to you alone. The exchange then sweeps those coins into a hot wallet.

Every one of those moves is a public transfer on a blockchain. So anyone can see a withdrawal halt, because the hot wallets go quiet. And since each deposit address belongs to one customer, counting the addresses that pay into an exchange gives a fair count of its depositors.

We used Bitquery's address labels to find 206 Binance hot wallets on Ethereum, BNB Chain, TRON, Solana and Bitcoin, and the wallets of eight rival exchanges. Each comparison sets the halt against the same hours of the same weekdays a week earlier, so weekday habits cancel out.

03 · The stopThree chains went quiet within 6 seconds

Binance's last customer payouts on Solana, BNB Chain and TRON all went out at 20:36 UTC, seconds apart. Three chains stopping at once looks like a single switch thrown for the whole exchange.

Ethereum took a little longer. Normal payouts there paused at about the same moment. One last batch went out a few minutes later, and after that nothing went to customers. Bitcoin's last batch went into a block mined soon after.

Binance's first full statement on the hack came early the next morning, in a post on X. By then its wallets had been silent for almost six hours.

On TRON, Solana and Bitcoin, what still moved during the halt went to Binance's own wallets. On Ethereum, the biggest transfer out went to the hacker. Binance topped up one of its hot wallets later that evening, and the hacker swept $200 million of USDT, Tether's dollar token, out of it within minutes.

04 · Money held backAbout $3.7 billion of stablecoin payouts did not go out

In the same hours a week earlier, Binance's hot wallets paid out $3.7 billion in stablecoins, most of it USDT. During the halt, that flow stopped.

Deposits kept arriving. On TRON, sweeps from customer deposit addresses into Binance's hot wallets stopped just before 22:00 UTC, and on Ethereum they stopped in the same hour. Coins sent to Binance after that sat in their deposit addresses, unswept. As of early on 1 November, the latest data we checked, Binance's TRON hot wallets had still sent nothing to customers.

05 · Where users wentBybit drew 2.4 times its usual depositors

People who needed to move money took it to the exchanges that serve the same offshore crowd.

On Ethereum, Bybit had 2.4 times as many depositors during the halt as in the same hours a week earlier. The median deposit was a third of its usual size, so the rush came from many small accounts.

OKX took in 2.8 times its usual stablecoin deposits on Ethereum. Coinbase works as a check. Most of its customers are in the US, where Binance's main exchange does not operate. Its depositors rose 17% on the week before and 2% on the week before that, which is inside its normal range.

Could the jump be old balances swept in late? We checked a sample of Bybit's depositors. In the halt, 36% of them had never received coins before it began. A week earlier the share was 33%. The share held steady while the count more than doubled, which fits new deposits.

One caution. The hack night was also a wild night for prices, and volatility alone pulls money onto exchanges. But the jump lasted two days after prices calmed. It also landed on Binance's direct rivals and skipped Coinbase.

06 · TRONOn TRON, small USDT deposits at rivals rose 42%

TRON is where much of the world moves USDT, because transfers there are cheap. During the halt, deposits under $1 million into eight rival exchanges rose 42% on the week before. Friday 30 October, the first full day of the halt, was the busiest day for them in the 16 we measured.

Large transfers more than doubled that Friday. Treat those with care. One Bitfinex wallet alone took $673 million, and transfers that size are often funds or exchanges moving their own money.

Bitget had 2.3 times its usual depositors on TRON, and Bybit gained too. OKX, the biggest of the group, had about as many depositors as usual, but they sent more money. Gate had fewer.

Some traders skipped exchanges altogether. Hyperliquid, an on-chain trading venue, takes deposits through a bridge on Arbitrum. That bridge received 2.4 times as much USDC as the week before, from only 20% more depositors. More money came in from roughly the same people. Our study of Hyperliquid's deposits shows what a normal week there looks like, and the full Arbitrum history sits in the Arbitrum dataset on the Bitquery Data Store.

07 · StablecoinsNo lasting stablecoin depeg, only a brief dip in USDT

A halt at the biggest exchange is the kind of shock that can knock a stablecoin off its dollar. Apart from one hour on the hack night, that did not happen.

During the hack itself, the hacker's swaps pushed USDT 2% to 10% below USDC inside the big Ethereum pools, and the gap closed within the hour. After that, USDT traded about 0.1 cents below its usual price for 10 hours, then recovered. On TRON there was no discount at all. Curve's 3pool, a large pool of USDT, USDC and DAI, shows the same small wobble. Holders swapped USDT for the other two overnight, and the pool was back in its normal range by the next evening.

Some of the money that left USDT went to USDC. Circle's USDC supply on Ethereum grew by $428 million during the halt, after shrinking the week before. Tether minted no new USDT on Ethereum or TRON in either window. Our audit of Tether's freezes explains how the issuer can lock a wallet's USDT, as it did to the hacker that night.

08 · BNBBNB fell 5.8%, more than bitcoin or ether

BNB is the coin Binance created, and it pays the fees on BNB Chain. From the hour before the hack to the end of the halt, BNB lost 5.8%, more than bitcoin, ether or SOL. Most of the drop came in the first hour, when BNB briefly traded 10% lower. Ether fell almost as far that night, then won back half of the drop. BNB stayed down.

Futures traders piled in. Over the halt, BNB perpetual volume on Hyperliquid was 24 times that of the week before, and most of it came on the hack night.

Binance's own blockchain went quiet. BNB Chain was busy on the hack night, then slowed. In the median hour after that, fees and DEX trading volume were both about a third lower than a week before.

One group of users all but vanished. Binance withdrawals normally fund about 1,800 brand-new BNB Chain wallets per hour. During the halt, new wallets first funded by Binance fell by nine in ten. They make up only about 10% of new wallets on the chain, so new wallets overall fell just 4.8%. Bitquery's BNB Chain API and the BNB Chain dataset on the Bitquery Data Store hold the same data.

09 · DeFiAave froze 32 assets, and GHO holders cashed out

Aave, the biggest lending app, reacted to the hack itself. Later that evening it froze 32 assets on its main Ethereum market. Among them was WETH, the wrapped ETH that Aave lends. The freeze came 46 minutes after the hacker's last ETH loan there, taken against stolen USDT. Aave set out its reasons in a forum post.

Just before the freeze, borrowing went wild. In a single hour, users borrowed 17 times as much WETH as in the whole day before. The hacker's own loan was part of it. Most of the rest came from traders who borrowed ETH to sell into DEX pools, where the hacker's buying had pushed ETH far above its market price. Our look at who profited from the hack follows that trade.

Then nothing. For more than 14 hours, nobody took out a WETH loan. Lenders could still withdraw, and they pulled more than 90,000 WETH out of the frozen market, some of it straight to OKX.

Cash ran short elsewhere in Aave too. By the next morning its USDT market was almost fully lent out, with only $7.27 million left to withdraw. Compound, another lender, paused its own markets for 15 hours or more.

GHO, Aave's own dollar token, had a run of its own. Holders can hand GHO back for USDT at about a dollar through a stability module. Since the hack they have redeemed 36.5 million GHO, 6 times as much as in the two weeks before, and one wallet accounted for most of it. GHO's price on DEXs dipped to just over 99 cents in the hack hour and was back near a dollar by early morning.

Aave also froze tBTC, a bitcoin token, again on 31 October. We found no link to the hack. No tBTC was among the stolen coins, and the hacker's bitcoin had not moved as of 31 October.

10 · What it meansWhat a halt at the biggest exchange does

The halt stopped Binance's payouts almost at once. The money found other routes within hours, through Bybit, OKX, Bitget and Hyperliquid. Stablecoins wobbled overnight and held.

The damage stayed close to Binance. BNB fell hardest among the big coins, and the stream of new wallets that Binance feeds on its own chain shrank by nine in ten. The next test is the reopening. When Binance's hot wallets start sending again, the first hours will show how much of the money held back comes out, and whether the depositors who left come back.

11 · The methodHow we measured it

We used Bitquery's address labels to pick out the hot wallets of Binance and eight rival exchanges, then counted the transfers in and out of them on each chain. A payout is a transfer from a Binance hot wallet to an address outside that set. A depositor is a distinct address paying into a rival's wallets. We left out very large transfers, which are often exchanges moving their own money. Each window is set against the same hours a week earlier, and for rival exchanges two weeks earlier too. Prices come from Hyperliquid. The transfers come from Bitquery's Ethereum dataset, TRON dataset and BNB Chain dataset.

12 · The recordThe addresses behind these findings

FAQ

When did Binance suspend withdrawals after the hack?

On the evening of the hack. The last customer payouts on Solana, BNB Chain and TRON went out at 20:36 UTC on 29 October, minutes after the hacker began draining Binance. Ethereum's stopped a few minutes later. Binance's first full statement came early the next morning.

Which Binance alternatives did users turn to during the halt?

Mostly other offshore exchanges. Bybit had 2.4 times its usual depositors on Ethereum, and Bitget and OKX also took in far more than usual. Deposits into Hyperliquid's bridge more than doubled. Coinbase, whose customers are mostly in the US, saw no unusual rise.

Was there a stablecoin depeg after the Binance hack?

Not a lasting one. During the hack, the hacker's own swaps pushed USDT 2% to 10% below USDC inside the big Ethereum pools for under an hour. After that, USDT traded about 0.1 cents below its usual level for 10 hours, then recovered. On TRON it showed no discount.

Why did BNB fall more than bitcoin?

BNB is Binance's own coin, so bad news about Binance hits it first. It fell 5.8% over the halt, more than bitcoin or ether, and most of the drop came in the first hour.

How much money did the halt keep on Binance?

In the same hours the week before, Binance paid out $3.7 billion in stablecoins, plus ETH. During the halt almost none of that went out.

Have Binance withdrawals reopened?

Not as of early 1 November, the latest data we checked. Binance's TRON hot wallets had sent nothing to customers since the evening of the hack.