Where Did the Liquidity Go the Night Binance Suspended Withdrawals?

Written by: BigTime

Key Takeaways

Binance suspended withdrawals for approximately 56 hours, during which spot and contracts trading continued as normal. Users could still buy and sell, but funds and inventory in their accounts could not be transferred to other venues via withdrawal.

In the week following the incident, Binance's spot trading share among the top ten exchanges dropped from approximately 48% to 42%, while OKX rose from about 11% to 14%. Meanwhile, the hackers' urgency to convert assets resulted in an execution loss of approximately $119 million, which traders and arbitrageurs captured as net profits of around $60 million after costs.

After withdrawals resumed, capital flowing to other centralized exchanges accounted for roughly 10% of the total withdrawn amount, and Hyperliquid's single-day net inflow was also less than 10% of Binance's net outflow. When evaluating these shifts, market makers must also consider the counterparty risk associated with balances remaining on the exchange.

On the evening of October 29, 2026 (UTC), Binance's hot wallet was hacked, with initial estimates indicating an impact of approximately $6.3 billion. Over the following two days, a narrative gained traction: Binance's withdrawal suspension caused liquidity to flood into Hyperliquid and other exchanges. Changes in trading volume shares support part of this narrative, but fund flow data does not show a transfer on a comparable scale. The two phenomena must be analyzed separately, as price movements and spreads have distinct drivers.

I. The 56-Hour Withdrawal Suspension

All times are in UTC

Table 1 | Key timeline of the Binance incident. Source: Refer to the source column within the table; all are public reports, with some timestamps varying by minutes to tens of minutes across different outlets.

The period from the withdrawal suspension to the first phase of resumption lasted approximately 56 hours. Estimates of the stolen amount vary: Chainalysis valued it at approximately $5.912 billion based on market prices at the time of theft, while TRM estimated around $6.36 billion. TRM attributed the incident to the North Korean hacking group TraderTraitor with "high confidence," a conclusion later echoed by the FBI; Binance stated that its investigation has not yet assigned blame to any specific individual. For comparison, Bybit was hacked for approximately $1.46 billion in February 2025, which previously held the industry record.

During the withdrawal suspension, Binance's spot and derivatives trading continued normally, with only a limited number of products such as withdrawals and Alpha restricted.

Users could still trade on Binance, and market makers could continue providing quotes, but neither party could rebalance inventory by transferring funds to other exchanges via withdrawal.

II. Shifts in Volume, Positions, and Prices

According to CoinDesk statistics from October 30, BTC fell 3.1% over 24 hours, hitting a low of approximately $76,400 overnight; ETH dropped roughly 4%, briefly falling to around $2,170; and BNB declined by 6.2%. Derivatives trading volume surged 74% to reach $346.1 billion. During the same period, total liquidations across the network amounted to approximately $1.57 billion, predominantly consisting of long positions. Data from CoinGlass indicates that roughly half of these liquidations occurred on Binance, further confirming that Binance's futures trading remained operational during the withdrawal halt.

Kaiko data (via Bloomberg) shows that among the top ten exchanges, Binance's spot trading share declined from approximately 51% in mid-August to about 48% prior to the incident, and further dropped to around 42% seven days afterward. Meanwhile, OKX's share rose from roughly 11% to 14%, and Coinbase increased from about 9% to 9.6%.

Hyperliquid was the most discussed platform that evening. CoinDesk reported that HYPE open interest increased by 28%, and trading volume grew nearly eightfold. However, on the same day, Trade.xyz announced funding from the Intercontinental Exchange (ICE), breaking news ahead of the Binance hack. Current data cannot isolate the respective impacts of these two events on HYPE's price surge, so the entire gain cannot be solely attributed to capital fleeing Binance.

While these figures indicate a shift in trading activity, they do not conclusively prove a synchronous transfer of capital. To place orders on OKX during Binance's withdrawal suspension, traders require existing margin and inventory in their accounts. Binance's market share fell by approximately 6 percentage points within a week. We believe that capital previously allocated by leading institutions across multiple exchanges facilitated this reallocation.

III. Price Dislocations and Arbitrage Profits from the Hacker's Conversions

The hackers' urgency to convert stolen assets forced them to incur costs above market rates in on-chain trades, creating lucrative opportunities for arbitrageurs.

Fearing that stablecoins might be frozen by issuers, the hackers were eager to swap USDT for ETH. According to TRM's analysis, the attackers exchanged approximately 325 million USDT for roughly 122,300 ETH, implying a weighted average price of about $2,657, whereas the prevailing market price was between $2,300 and $2,350. Due to limited on-chain liquidity, this desperate, price-insensitive swapping operation incurred a significant premium.

Bitquery estimates the hackers' execution loss relative to market prices at approximately $119 million. Roughly half of this amount was captured by traders and arbitrage bots, yielding net profits of around $60 million after costs. Bloomberg reported that Ethereum block builders and validators additionally earned about $29.5 million. DefiLlama data shows Titan Builder generated approximately $22.83 million in 24-hour revenue that day, ranking first among all protocols.

Price dislocations also emerged for TRX. James Aitchison of Caerus Global Management told Bloomberg that the hackers purchased TRX on SunSwap at approximately $0.367, while the price across other venues was around $0.33; this spread took roughly 10 hours to converge. Pricing deviations similarly occurred between centralized exchanges. Citing ChainCatcher, Galaxy Research Managing Director Alex Thorn noted that the discount of Bitcoin on Coinbase relative to Binance's USDT pair widened to its largest level of the year.

Typically, arbitrageurs can buy at lower-priced venues, sell at higher ones, and then use withdrawals to rebalance assets and flatten positions, allowing spreads to gradually normalize. Following Binance's withdrawal suspension, this rebalancing channel was blocked, making it difficult for arbitrageurs to move inventory and thereby hindering the convergence of cross-venue spreads.

IV. Capital Flows Following Withdrawal Resumption

Capital began exiting Binance accounts only after withdrawals were resumed.

Table 2 | Fund flows post-withdrawal resumption. Source: Refer to the source column within the table; statistical windows differ across data platforms and cannot be directly summed.

Based on these metrics, the capital flowing into other centralized and on-chain exchanges is insufficient to account for the majority of Binance's withdrawal volume. We lean toward the conclusion that more funds exited trading venues entirely, returning to users' private wallets. Nevertheless, differing statistical windows across platforms mean this remains an inference regarding capital destinations.

Geoff Kendrick of Standard Chartered Bank suggests this incident may accelerate trading migration toward decentralized exchanges (per ChainCatcher). This medium-to-long-term thesis has not yet materialized in the capital flow data from the week of the incident. According to The Block, DEX spot trading volume accounted for approximately 23% of CEX volume in October; at this scale, on-chain exchanges remain primarily supplementary.

V. Market Maker Exposure and Comparisons with FTX and Bybit

That evening, Wintermute and GSR quickly disclosed their exposures. Wintermute CEO Evgeny Gaevoy stated that the firm's exposure on Binance was below 20% of its net worth, with no impact on operations; GSR CEO Xin Song reported GSR's exposure was under 5%. Both disclosures highlight their practice of capping the proportion of assets retained on any single exchange.

After experiencing approximately $6 billion in net withdrawals over 72 hours, FTX halted transfers (excluding fiat) on November 8, 2022, and was later found to have a shortfall in user assets. In contrast, Binance's withdrawal suspension was triggered by a hot wallet hack, trading continued uninterrupted, and losses were covered by company capital, with approximately 95% replenished by November 1. Whether there is an asset shortfall and whether losses can be fully covered are critical factors in understanding the divergence between these two suspension events and subsequent market reactions.

Bybit did not suspend withdrawals following its ~$1.46 billion hack in 2025. Per its published timeline, 99.994% of over 350,000 withdrawal requests were processed within 10 hours. A Kaiko report released by Bybit indicated that its 1% market depth for Bitcoin recovered to pre-incident levels after 30 days. Binance's withdrawal suspension was implemented to safeguard assets but inadvertently restricted inventory rebalancing, complicating spread convergence; Bybit, by keeping withdrawal channels open, had to endure the run-on pressure of continuous withdrawals.

Institutions can also separate custody and trading allocations through OTC clearing. Launched in January 2023, Ceffu's Binance Mirror allows firms to keep assets in segregated cold wallets while mirroring them 1:1 into Binance accounts for trading; MirrorX facilitates automatic T+1 OTC settlement. Public reporting has not yet clarified whether these arrangements were impacted by the incident, nor how clients settled during the withdrawal halt, pending further disclosure from Binance or Ceffu.

VI. Five Questions for Assessing Exchange Exposure

Table 3 | Exchange exposure checklist. Source: BigTime Research compilation

In this incident, trading volume partially shifted to venues like OKX and Hyperliquid, and the price dislocations created by the hacker's conversions generated profits for arbitrageurs and block builders. Meanwhile, funds trapped in Binance accounts could not be moved before withdrawals resumed; post-resumption data further supports the view that capital exited trading venues and returned to user wallets. Beyond comparing exchanges, market makers must also evaluate: if withdrawals halt, how long current inventory can sustain operations, and whether sufficient capital exists at alternative venues to complete hedging. For a broader landscape of the market-making industry, see Crypto Market-Making Landscape: GSR and Its Rivals; for transparency gaps in contract terms between market makers and projects, see Behind Market Maker Entry: The Transparency Gap in Trading Contracts.