Binance Hack Liquidations: $607M of Longs in One Hour as Withdrawals Froze

Bitcoin traded at $80,327 at 20:15 UTC on October 29. By 21:00 it printed $78,763, and by 02:07 UTC on October 30 it was down to $76,418, according to a minute-by-minute timeline from CryptoTicker. In between, Binance disclosed a security incident it later put at $6.3 billion, suspended withdrawals, and longs were flushed in a single hour. The Binance hack liquidations matter for orderflow traders less because of the headline number and more because the largest venue in crypto stopped letting inventory leave while its order books stayed open.

How the Binance hack unfolded on-chain, minute by minute

The on-chain sequence started before any statement. Per CryptoTicker, a wallet labeled "Binance 14" delegated via EIP-7702 to an outside contract at 20:20 UTC. At 20:24, 167,464 ETH and 63 other tokens moved in one transaction. At 20:39 around 195,460 ETH went to another address, and at 20:41, 780 million USDC left a second linked address.

Price reacted before the disclosure did. BNB hit an evening low of $692 at 20:50 UTC, 6.3% below its 20:15 level, while bitcoin bottomed at 21:00 and ether, Solana and XRP at 21:05. Changpeng Zhao said at 21:15 that it "does look like a hack", and Binance only said it was investigating a "potential security issue" at 21:24. Anyone watching wallet flows and BNB tape had roughly half an hour of lead time on the official word.

Binance later attributed the entry point to a compromised DevOps engineer's laptop, with no evidence of a private key leak, according to the Cointelegraph live blog. TRM Labs attributed the attack "with high confidence" to North Korea's TraderTraitor unit, linked to the Lazarus Group, per Al Jazeera, which also noted the previous record was the $1.5 billion Bybit theft in 2025.

Binance hack liquidations: $607M of longs in one hour

The forced selling was concentrated and one-sided. About $628 million of positions were force-closed within one hour, and about $607 million of that was longs, per CoinGlass data via PANews cited by CryptoTicker. That is roughly 97% of the hour's liquidations on one side of the book.

Over a full 24 hours the totals vary with the window each outlet used. CoinGlass data cited by CryptoTicker put it at $1.54 billion across 237,314 accounts, with $1.29 billion, or 83.8%, from longs. CoinDesk headlined $1.57 billion, and Decrypt reported over $1.33 billion on the day.

The structure is the useful part. A 1.9% bitcoin drop to the 21:00 low was enough to clear most of an hour's liquidations, which says long positioning was crowded close to price going into the evening. The second leg, from $77,771 at midnight to $76,418 at 02:07 UTC, came with a smaller flush, which fits a book that had already been cleaned out.

Frozen withdrawals and the broken arbitrage loop

Cross-venue arbitrage works because inventory can move. When one venue trades cheap, arbitrageurs buy there, withdraw, and sell elsewhere. With Binance withdrawals suspended, that loop is cut: coins and stablecoins on Binance can still trade inside the exchange, but they cannot leave to close a price gap on another venue.

The gap showed up. At 10:18 EDT on October 30, CoinDesk reported the Coinbase bitcoin premium measured against Binance had fallen to two standard deviations below its rolling annual average, a z-score around -2. In plain terms, US spot was trading weak relative to Binance, and the usual mechanism that pulls the two back together was jammed.

Liquidity providers were also hit directly. Wintermute disclosed exposure of under 20% of net equity and GSR under 5%, per the Cointelegraph live blog. When market makers are managing their own balance sheet stress, quoted depth tends to thin, and thinner books are exactly where liquidation cascades travel further per dollar of forced selling.

Standard Chartered said the hack could boost DEX volume, per the same live blog, which cited CoinGecko data putting the top-10 spot DEX-to-CEX ratio at 23.5% in Q2 2026. Hyperliquid led onchain protocols in revenue on October 29 with $4.87 million, per Decrypt, though that day also carried the ICE and trade[XYZ] news, so it is not clean evidence of migration.

What the $3B freeze means for the supply overhang

Not all of the stolen value is stuck. Decrypt reported the funds were spread across about $3.5 billion in ETH, $1.4 billion in BTC and $630 million on Tron, and that Tether and Circle froze about $2.39 billion, leaving an estimated $2.6 billion to $3.2 billion unfrozen. Tether CEO Paolo Ardoino put the USDT freeze at more than $1.567 billion and Circle's Jeremy Allaire put USDC at more than $800 million, per Cointelegraph.

The unfrozen part is in assets an attacker can actually sell or borrow against. At around 21:00 UTC on October 29 the exploiter deposited 60 million USDT on Aave and borrowed 19,762 WETH, about $44.6 million, before Aave froze its V3 and V4 markets. ZachXBT said funds from this hack and the Bitget exploit were commingled at one THORChain address.

For ETH and BTC traders, that means a known seller with billions in non-freezable assets whose exits route through bridges and DEXs. Binance said it had reserved more than $6.34 billion to cover losses and already held about $5 billion of the affected tokens, per CoinDesk, so the exchange is a potential buyer of the remainder while the attacker is a potential seller.

What to watch when Binance withdrawals reopen

Binance said on October 30 it found "additional points of breach" and expected withdrawals to resume in 45 hours, per Cointelegraph. That reopening is the event to trade around, because it reconnects the arbitrage loop at once.

Three things are worth tracking at reopen. First, the Coinbase versus Binance spread: a fast snap back toward its average means the gap was mechanical, not a vote on Binance solvency. Second, net outflows from Binance in the first hours, which tell you how much inventory wants to leave. Third, aggressor side on perps across venues: if spot gets sold on outflows and perp CVD stays flat, the selling is transfer driven rather than directional.

The liquidation map is where this turns into levels. After a 97% long flush, the next cluster of liquidations usually builds wherever new longs reload, and Buildix shows that on its liquidation map alongside CVD by venue, so you can see whether the reopening bid is real absorption or just shorts covering.

A $6.3 billion theft is a headline. A frozen withdrawal rail on the largest exchange is a market structure event, and it ends at a stated hour that the whole market can see coming.