Case fileliveupdated Sat, 31 Oct 2026, 00:13 UTCWhale Street, after the US close 29–30 Oct 2026
Binance hack, 29 October 2026
The largest exchange hack on record, and what the largest wallets on Hyperliquid did in the hours around it: the timeline, the figures with their sources, whale positions before and after.
- First outflow
- Thu 29 Oct, 20:20 UTC on Bitcoin, 20:24 UTC on Ethereum
- Taken
- About $6.3B, per Binance, about $3.74B of it on Ethereum and 18,270 BTC
- Frozen
- About $3B, per Binance on 30 Oct, $2.3B of it in USDT and USDC
- Withdrawals
- Paused. Binance aims to restart them on Sunday, 1 Nov (30 Oct)
- BTC on Hyperliquid
- $80,821 at 20:00 UTC, low $76,443 on 30 Oct at 02:00–02:15 UTC (−5.4%)
What we know
- What was taken, per chain, and how much is frozen, as Binance and the stablecoin issuers report it.
- Binance says user funds are safe and that it covers the losses from its own funds.
- Where the tracked whales on Hyperliquid stood before and after, and which of them traded in the hours after the first outflow (below, refreshed every few minutes).
What we don’t know yet
- How much more can be frozen. About $3.3B in BTC and ETH can still be moved by the attacker, per analyst Dickson Wu.
- When withdrawals fully resume, and whether traders move money to on-chain venues afterwards.
The markets whale moves of $1M or more, numbers mark the timeline
- $78,006
- Short 64%
- Whale Tide 20
- $1.59B of whale money
- −3.5% since the outflow on ethereum
- $128M toward shorts
| Whale | Side and leverage | Size | To liquidationwithin 20% | Recordof 100 |
|---|---|---|---|---|
| Grey Leviathanshort 5× | short 5× | $181M | – | 83 |
| Ancient Narwhalshort 5× | short 5× | $142M | – | 87 |
| Cold Meridianshort 25× | short 25× | $128M | 12.4% | 83 |
| Cobalt Monsoonlong 30× | long 30× | $76.1M | 10.3% | 23 |
| Boreal Horizonshort 8× | short 8× | $63.1M | 11.9% | 86 |
- $2,269.30
- Short 54%
- Whale Tide 28
- $1.47B of whale money
- −2.8% since the outflow on ethereum
- $1.9M toward shorts
| Whale | Side and leverage | Size | To liquidationwithin 20% | Recordof 100 |
|---|---|---|---|---|
| Grey Leviathanshort 5× | short 5× | $221M | – | 83 |
| Ancient Narwhalshort 5× | short 5× | $83.4M | – | 87 |
| Gusty Glacierlong 10× | long 10× | $69.5M | 6.5% | 14 |
| Serene Basinlong 9× | long 9× | $59.1M | 6.1% | 13 |
| Cobalt Mantashort 15× | short 15× | $48.6M | – | 92 |
- $87.33
- Short 60%
- Whale Tide 34
- $900M of whale money
- −7.0% since the outflow on ethereum
- $29.1M toward shorts
| Whale | Side and leverage | Size | To liquidationwithin 20% | Recordof 100 |
|---|---|---|---|---|
| Ancient Narwhalshort 5× | short 5× | $53.3M | – | 87 |
| Grey Leviathanshort 5× | short 5× | $41.6M | – | 83 |
| Iron Nautilusshort 10× | short 10× | $37.7M | – | 81 |
| Cobalt Rorqualshort 5× | short 5× | $33.2M | – | 95 |
| Polar Nautilusshort 5× | short 5× | $22.8M | – | 71 |
Opened or addedClosed or trimmedFlippedLiquidatedLongShortTimeline entryDot size is the money, moves close together add up · moves of $1M or more
How to read this
Read it: Line up the whale dots with the numbered flags. Moves before the news, around it and after it read differently.
Won’t show: why a whale moved. A move close to an entry is timing, not a motive.
Timeline newest first · 26 entries
- 26
WhaleRadar follows the hack’s wallets on their own chains: the 19 Bitcoin addresses of the split, the 21 Ethereum wallets labelled as the exploiter’s and one wallet the funds moved on to. At 00:13 UTC on 31 Oct, $2.41B sits frozen by the tokens’ issuers, $2.45B is still in the first wallets, including all 18,270 BTC, and $77M is in the wallet followed onward. $686M has gone to addresses not followed here: $266M into Uniswap trading pools, $60M into Aave v3 and $360M to contracts without a clear public name. Binance reported $779M more on TRON, Solana, Arbitrum and Avalanche, which are not followed here. The last move of $1M or more was at 00:59 UTC on 30 Oct.
- 25
In a video on X, co-CEO Richard Teng says the investigation found more points of entry than the engineer’s laptop first suspected. The attackers used EIP-7702 to take control of a hot wallet outside the normal approval steps and a self-destruct mechanism to erase traces. Binance aims to resume withdrawals by Sunday and plans a first proof-of-reserves update before a full report on Monday.
- 24
Analysts at Cantor Fitzgerald, TD Cowen and Compass Point call the hack a blow for Binance rather than for the wider market. Compass Point names Coinbase, Bullish and decentralized venues such as Hyperliquid as possible winners of market share.
- 23
Chainalysis reports laundering it had not seen before: thousands of automated transactions within a short time, circling the funds among many addresses and often back to wallets that appeared earlier in the chain.
- 22
Binance sets aside more than $6.34B of its own funds to restore customer balances. $5B of it is already held in the affected tokens, the rest is being bought on markets and over the counter. Partners froze about $3B of the stolen assets, which is not counted in that sum.
- 21
In a later count CoinDesk puts liquidations across exchanges at $1.57B, $522M of it in bitcoin and $361M in ether, with bitcoin near $77,350. HYPE rises 15% while most of the market falls, and its open interest grows 28%.
- 20
Co-CEO Yi He says Binance expects to begin resuming withdrawals within the next 48 hours.
- 19
CoinDesk reports that an address fed by the attacker sold 134.1 million FUN into a Uniswap pool holding about $16,000 between 23:31 and 04:17 UTC, for 111.5 ETH (about $250,000). FUN fell more than 90% in that pool. Other small tokens from the haul fell 9–18% in 24 hours.
- 18
CoinDesk counts $1.53B of liquidations across exchanges in 24 hours, 83.8% of it longs. Binance accounts for $754.6M, Hyperliquid for $251.4M and Bybit for $186.5M. The largest single one was an $11M bitcoin long on Binance.
- 17
A CoinDesk trace shows all 18,270 BTC sent to one address at 20:20 UTC and split within minutes into 19 wallets, 17 of them holding exactly 1,000 BTC. None of the 19 had sent a coin as of 04:23 UTC. Bitcoin has no issuer that can freeze it. The coins went through a peel chain, each step carving 1,000 BTC off into a fresh address, and every transfer was built like an ordinary Binance withdrawal with a valid signature.
- 16
Eight hours after the first outflow, tracked whales on Hyperliquid keep their split. In BTC they hold $1.07B short and $657M long, 62% short against 63% at 20:00 UTC. In ETH both sides shrank, longs from $652M to $565M and shorts from $993M to $878M, 61% short. The Whale Tide closed the UTC day at 27, two points lower, while the crowd’s long share fell from 69 to 47.
- 15
Binance puts the total taken at about $6.3B: about $3.74B on Ethereum, 18,270 BTC (about $1.47B), the rest on TRON, Solana, Arbitrum and Avalanche. About $2.8B is frozen by issuers and networks.
- 14
BTC reaches $76,443 on Hyperliquid between 02:00 and 02:15 UTC, 5.4% below its level at 20:00 UTC. ETH’s low came at 01:00 UTC, $2,173.
- 13
Between 00:33 and 00:52 UTC three tracked wallets cut large longs at a loss, none of them by liquidation: Gusty Glacier sells $39.4M of its ETH long (realised −$7.23M), Serene Basin $41.3M of ETH (−$5.87M) and Seaward Estuary $43.5M of BTC (−$2.77M). Gusty Glacier and Serene Basin keep the rest of their ETH longs. On Hyperliquid BTC trades at $77.1K and ETH at $2,205.
- 12
Al Jazeera reports that Binance traced the breach to a compromised engineer’s laptop and that TRM attributes it with high confidence to North Korea’s TraderTraitor group. Binance says user funds are safe and that it covers all losses.
- 11
CoinDesk reports that the drained wallets, Binance 14 and Binance 16, are listed in Binance’s proof of reserves of 1 October. The roughly 204,500 ETH taken equal about 5.6% of its ETH reserves, leaving ether backing near 94% until the exchange replaces them. Binance publishes its next reserve report on 1 November.
- 10
Binance 14 revokes the permission after nearly four hours. In that time the attacker swept new customer deposits out again at 21:04 and 21:44 UTC and, through the same code, pulled 823M USDC out of a second Binance wallet, TRM Labs says.
- 9
Binance confirms an exploit of its main Ethereum hot wallet and pauses withdrawals while it investigates.
- 8
Between 21:41 and 22:08 UTC the tracked wallet Silent Spray opens a $49.0M BTC short at 40x, at $78.6K–79.4K, and a $50.1M ETH short at 25x, at $2,259–2,279. The two are the largest new positions among tracked whales that night.
- 7
Binance says it is aware of reports of a potential security issue and is investigating. Circle reports more than 800 million USDC frozen (21:18 UTC), Tether more than 1.567 billion USDT (21:25 UTC).
- 6
Binance founder Changpeng Zhao writes on X that it looks like a hack on Binance and that user funds are safe.
- 5
On Hyperliquid, BTC falls from $80,462 to $78,200 between 20:30 and 20:45 UTC, the sharpest quarter hour of the day. BNB is down 10% within the hour, from $745 to $670.
- 4
CoinDesk reports the first large bitcoin options block at 20:38 UTC, before the news was public: 250 BTC of $78,000 puts expiring on 31 October, about $20M notional. Before Binance’s first statement, two blocks of 1,000 BTC each of mid-November $74,000 puts followed. In the eight hours after the hack, about $590M of bitcoin option blocks traded on Paradigm, most of them puts.
- 3
On-chain records show 167,464 ETH and 63 other tokens leaving a Binance hot wallet in one transaction, four minutes after the wallet was delegated to an outside contract. More outflows follow at 20:39 and 20:41 UTC, among them 780 million USDC.
- 2
CoinDesk reconstructs the Ethereum part. At 20:20:59 UTC one transaction carries 50 permissions signed by the Binance 14 wallet under EIP-7702, each for a different transaction number, and the network accepts the one that matches. It lets the attacker’s contract operate the wallet. At 20:24:23 UTC that contract moves about 167,464 ETH and 63 tokens out in one transaction, among them about 1.6B USDT.
- 1
Before the hack, HYPE had risen from $79.3 at 10:00 UTC to $96.3 at 17:00 UTC on Hyperliquid, the day trade[XYZ] and ICE, owner of the New York Stock Exchange, announced an agreement for a regulated US perpetual futures market on Hyperliquid’s technology, pending approval. Stanley Druckenmiller disclosed an investment in trade[XYZ] the same day and Elon Musk shared it with one word. Tracked whales’ HYPE longs grew from $283M to $442M over those hours.
WhaleRadar, from the Hyperliquid blockchain, news via FinanceFeeds
Trade timing alone says nothing about what a trader knew. Many traders position before scheduled events. Times are when a move was first seen on Hyperliquid and when a report was first published.
Onchain Lens reported Silent Spray’s two shorts as the return of a wallet idle for about three months.
Hyperliquid has had incidents of its own, among them the SK Hynix perp drop of 27 July 2026.
Whale moves around the event $1M or more since 29 Oct, 00:00 UTC
- BTCTrims a short
Breezy Sounder trims its BTC short by $12.3M to $20M at $76.7K (+$83K realised).
- BTCAdds to a short
Breezy Sounder adds $8.4M to its BTC short, now $32.3M. Track record 23/100.
- BTCTrims a long
Polar Mistral trims its BTC long by $31.2M to $15.6M at $77.9K (−$394K realised).
- BTCAdds to a short
Breezy Sounder adds $21.6M to its BTC short, now $37.6M. Track record 27/100.
- BTCTrims a long
Seaward Estuary trims its BTC long by $27.8M to $67.4M at $77.1K (−$1.8M realised).
- ETHTrims a long
Serene Basin trims its ETH long by $41.4M to $57.6M at $2,204.97 (−$5.9M realised).
- ETHTrims a long
Gusty Glacier trims its ETH long by $39.6M to $67.9M at $2,205.40 (−$7.2M realised).
- ETHCloses a long
Quiet Manta closes its $36.4M ETH long at $2,278.04 after 28 minutes (+$396K realised).
- BTCCloses a long
Arctic Cape closes its $35.4M BTC long at $78.7K after 26 hours (−$904K realised).
- ETHOpens a long
Quiet Manta opens a $36.2M ETH long at $2,253.24. Track record 77/100.
- BTCAdds to a long
Polar Mistral adds $11.9M to its BTC long, now $31.8M. Track record 54/100.
- ETHCloses a long
Quiet Manta closes its $54.9M ETH long at $2,282.12 after 33 minutes (+$612K realised).
- BTCAdds to a long
Polar Fathom adds $11.9M to its BTC long, now $32.2M. Track record 82/100.
- ETHAdds to a long
Quiet Manta adds $35.7M to its ETH long, now $53.9M. Track record 77/100.
- BTCTrims a long
Arctic Cape trims its BTC long by $25.8M to $27.9M at $78.7K (−$792K realised).
The 15 largest of 1313 whale moves in these markets, newest first. The charts and the table above count all of them.
Share this page
The card shows where BTC whales stand now, with the time and the source.
On Telegram
The brief before and after big events arrives in the WhaleRadar channel, with no setup. Open the channel
As of Sun, 1 Nov 2026, 08:32 UTC. Curated entries link their sources. Whale moves and prices come from Hyperliquid, whale moves 15 minutes after Pro. Not financial advice.