After the Binance hack, hurried cash-outs pushed prices on some venues up to 38% above the market
Columns · · Satoshi Note Editorial
Read in: 한국어
Eleven days after the October 30 Binance hack, reports are still coming in about how the stolen funds moved through the market. This piece covers the price-gap part of that story.
At a glance
- Per reports, the FBI and the US Secret Service pointed to North Korea's TraderTraitor group, and part of the stolen assets was frozen quickly.
- While the rest was rushed into Bitcoin and Ethereum on decentralized exchanges, prices on those venues rose up to 38% above the market, SBS News reported.
- The same coin can trade at different prices on different venues. Satoshi Note shows your records from several exchanges in one place.
1. Part of the funds was frozen, and the rest was swapped in a hurry
According to The Record on November 2, the hack exceeded $6.3 billion, and the FBI and the US Secret Service named North Korea's TraderTraitor group. Loss figures differ by source; $6.3 billion is Binance's own estimate of the impact.
SBS News reported on November 9 that US authorities and token issuers froze about 44% right away. The rest was swapped into Bitcoin and Ethereum on decentralized exchanges in a rush. The analytics firm Elliptic counted about 12,000 wallets and about 40,000 transactions, with funds moving to a new wallet every 25 seconds.
2. When a large order lands on one venue, only that venue's price jumps
SBS reported that on the venues where this swapping piled up, prices rose up to 38% above the market. When the hackers' volume lands on one venue, that venue's order book gets pushed up first.
Ordinary traders and bots used the gap: they bought the same coins on regular exchanges and sold them at the higher price. SBS, citing Bitquery's analysis, estimated their profit at about $60 million. We could not find Bitquery's original report, so the figure is cited through SBS.
3. A coin's price is really that venue's price
The price in a market app is usually computed from several exchanges. Actual trades happen on each exchange separately, each with its own order book and volume. Usually the gaps are tiny, so prices look identical.
This case shows that a rush of trading on one venue can push its price far from the rest of the market. The same structure explains why Korean and overseas exchanges, or centralized and decentralized ones, can show different prices.
4. What Satoshi Note shows
Satoshi Note collects trade records and holdings from several exchanges through read-only API keys. If you bought the same coin on two exchanges, you can see average cost and unrealized profit and loss per exchange. It does not show the kind of price gap described here.
For exchange security incidents there is the Exchange Hack Alert. After a person confirms a report about an incident at one of 15 exchanges (Upbit, Bithumb, Coinone, Korbit, GOPAX, Binance, Bybit, OKX, Bitget, Coinbase, Kraken, KuCoin, MEXC, HTX and Hyperliquid), it goes out as a notification. The first alert tells all members that a report exists. The second goes only to members who have linked that exchange and hold the affected coin. Alerts state the incident only and do not suggest withdrawing or selling.
Wrapping up — what the numbers can't tell us
These reports don't tell us how much of the stolen money will be recovered. The hackers' losses from the rushed swaps and the exact size of the traders' profit are estimates. The October 30 timeline and the top-trader position changes are in the earlier post below.
Satoshi Note
Satoshi Note gathers your records from several digital asset exchanges in one place. Exchange links use read-only API keys, and the Satoshi Index shows top-trader positions without a login.
https://satoshinote.io
Sources: The Record (November 2, 2026), SBS News subtitled report (November 9, 2026, citing Bitquery's analysis). The SBS video was read from its description text. Loss figures and freeze ratios may differ by source. This is not investment advice.