The Binance hack, from 5 a.m. to the afternoon, and what top traders' positions did in the same hours
Columns · · Satoshi Note Editorial
Read in: 한국어
On October 30, news that funds had left Binance kept coming all day.
Here is the timeline in order, based on TokenPost reports and Binance's announcements. All times are KST.
1. 5:05 a.m.: 233 million XRP moved to one address
Between 5:05 and 5:09 a.m., 233.46 million XRP (about $296 million) moved out of five Binance wallets to a single address.
According to a TRM Labs report, the attacker had prepared for at least 36 hours before the first transfer, and assets spread across 10 blockchains.
2. Morning: Binance said it was "investigating"
At 6:57 a.m., CZ posted on X that "Binance appears to have been attacked, user funds are safe," and claimed Tether and Circle had frozen $1.794 billion in total. Binance's official position was that it was investigating and had not confirmed any impact.
At 7:38 a.m., He Yi said on X that Binance withdrawals would be paused until the security environment was confirmed safe. The Ripple and WLFI teams helped with freezes.
3. 12:57 p.m.: Binance gave the scale
Binance estimated the impact at about $6.3 billion and said it had frozen about $3 billion onchain. It said it would cover user losses in full from SAFU and company funds.
It said the initial entry may have been a compromised laptop of a DevOps engineer. It found no evidence that wallet private keys leaked, and the exact path is still under investigation.
TRM Labs said it had "high confidence" the attack was by a North Korea-linked Lazarus-affiliated group. Binance said it was investigating the identity.
4. Afternoon: more figures and details
At 2:53 p.m., TRM Labs put the total outflow at $6.36 billion.
At 4:03 p.m., Binance's customer support account said an employee PC compromise was the starting point, but that funds did not move from a single PC alone.
Estimates differ by source: Arkham $5.84 billion (not confirmed), Binance $6.3 billion, TRM $6.36 billion. No confirmed stolen total exists.
Markets moved too. At 4:34 p.m., Bitcoin was down 1.70% over 24 hours at $78,497 and Ethereum down 2.61% at $2,249.97. Liquidations across the top 20 assets in 24 hours were $1.197 billion, 82.15% of them longs.
+α. In the same hours, how top traders moved
Satoshi Note's Satoshi Index adds up the positions of the top 100 accounts by 24-hour performance on each of four exchanges: Hyperliquid, Lighter, dYdX and Pacifica. Here are the snapshots before and after, side by side.
| Snapshot (KST) | Long | Short | Long share |
|---|---|---|---|
| Oct 29, 15:31 (before) | about $215M | about $2.825B | 7.1% |
| Oct 30, 05:54 (49 min after the start) | about $568M | about $2.486B | 18.6% |
| Oct 30, 15:28 | about $640M | about $2.426B | 20.9% |
The long share went from 7.1% to 20.9%. Shorts are still about 79% of the total.
By asset, HYPE changed the most. It went from 42 long and 102 short accounts to 130 long and 60 short, and its long share by dollars went from 8.8% to 53.0%. HYPE is up 15.7% over 24 hours at $91.36.
Bitcoin went from 66 long and 171 short accounts to 92 long and 126 short, and its long share by dollars from 4.4% to 17.1%. Ethereum went from 52 long and 152 short to 71 long and 103 short, while its long share by dollars slipped from 9.5% to 8.6%.
Longer-period groups changed less. The 7-day top group's long share went from 8.5% to 16.5%, and the 30-day group's from 8.7% to 11.9%.
The Satoshi Index needs no login.
https://satoshinote.io/traders
Data basis: before the incident, 3:31 p.m. KST on October 29, 2026; after, 5:54 a.m. and 3:28 p.m. KST on October 30. Positions of the top 100 accounts by 24-hour performance on four exchanges, counted per exchange and then added per asset; the 24-hour group is re-ranked every hour. The incident timeline and amounts cite TokenPost (October 30, 2026) and Binance's announcements; amounts differ by who made the estimate. This is not investment advice.