The run on Binance was a run of whales
Teiten Research · a wallet-by-wallet comparison with a normal week · on-chain data to 5 November, 18:00 UTC
| After the reopening | For comparison | |
|---|---|---|
| Withdrawn in 39 hours | $11.2bn | $6.1bn normal |
| Whales (wallets that received $1M or more) | 938 | 419 the week before |
| To other exchanges | $1.36bn | $307M the week before |
| Whale money back at Binance | 38% | 29% in 48 hours, 42% normal |
On the night of 29 October, hackers drained Binance wallets on ten blockchains, in an attack the exchange itself puts at about $6.3 billion, more than four times the previous record, the $1.5 billion stolen from Bybit in February 2025. The FBI attributed the attack to the North Korean group TraderTraitor; North Korea denies it. Binance suspended withdrawals at about 22:30 UTC that night and reopened them in stages in the early hours of 1 November.
The number of withdrawals and of deposits is already close to normal. So we went past the total volume and compared, wallet by wallet, the 39 hours after the reopening (1 November, 05:00, to 2 November, 20:00, UTC) with the same 39 hours a week earlier (25 to 26 October, also a Sunday and a Monday). The charts below show who ran, where the money went and who has already come back. Hover over a chart, or touch it, to see the values.
The full data, updated every hour, is on the live dashboard: Binance bank run.
THE RUN
The panic passed quickly; the whales did not
In the first six hours after the reopening, withdrawals reached 3.6 times normal in dollars. The number of withdrawals was back at its normal level by 2 November. In dollars, though, withdrawals kept swinging between normal and almost double, pulled by large customers. In the first 39 hours $11.2 billion left, against $6.1 billion in a normal period: an excess of about $5.1 billion.
Hourly withdrawals from Binance wallets, 29 October to 2 November
The theft, the suspension, and the peak three hours after reopening
The dashed line is normal for that hour of day. The dark band is the theft; the light one, the almost three days with withdrawals suspended. Times on this chart are Brasília time, three hours behind UTC.
Withdrawals against normal, every six hours
The value withdrawn stayed above normal; the number of withdrawals did not
WHO RAN
It was the whales, not retail
The number of customer wallets that received more than $1 million more than doubled: 938, against 419 a week earlier. Together they received $6.4 billion, 57% of everything that left. Withdrawals between $1 million and $10 million added up to $2.5 billion, 2.2 times the week before, and those between $100,000 and $1 million almost tripled (2.9 times). The total number of withdrawals rose only 9% over normal.
How much each wallet received, by band
The difference is in the bands above $100,000
WHO CAME BACK
And the whales are coming back
In a normal week, large customers return 42% of what they withdraw to Binance within 48 hours, the usual back-and-forth of traders and market makers. After the reopening they returned 29% in 48 hours, and by 4 November, 12:00 UTC, they had returned 38%: 275 of the 938 whales have already sent money back. Over the same 48 hours, the share that went to other exchanges rose from 7% to 16%.
What the whales sent back, hour by hour
Slower than in a normal week, but returning
THE RIVALS
To other exchanges, 4.4 times more
$1.36 billion went on to other exchanges within two hops, against $307 million the week before (4.4 times more). OKX received $417 million (against $75 million), Bybit $394 million (against $59 million), Coinbase $75 million (against $14 million) and Gate $83 million (against $5 million).
Which exchanges the money went to
OKX and Bybit took most of it
WHERE IT WENT
More money sitting in customers' own wallets
About $1.9 billion sat for at least 48 hours in unidentified wallets, largely self-custody, against $1.0 billion the week before (1.8 times more). That count leaves out, in both weeks, the wallets that received $100 million or more, which in the week before were almost all one-off transfers. Another $545 million went into decentralised finance (DeFi) protocols, 4.5 times the week before.
Where the withdrawn money went
More to other exchanges, more held, more in DeFi
The whole path of the same 39 hours, from the network the money left on to where it was two wallets later, is the "Where it went" panel of the live dashboard, drawn here for this window. Unlike the chart above, it shows every withdrawal, including the largest recipients, Tether's treasury and the wallets that behave as Binance's own payout wallets.
Where it went: withdrawals in the 39 hours after reopening, from network to destination
Most of the money stayed in private wallets; rival exchanges and DeFi took the rest
THE DEPOSITS
Deposits have recovered
In a sample of 400 Binance deposit addresses per network, the number of deposits ran between 18% and 60% of normal from 30 October to 2 November. On Ethereum it was back at 80% of normal on 3 November and at 90% on 4 November; on BNB Chain, on 4 November, it was already running at 1.22 times normal. In dollars, Binance's own data shows deposits close to normal in the first 46 hours and, on 3 November, more coming in than going out.
Customer deposits per day, against normal
From less than half to close to normal in a week
A NOTE ON BITFINEX
About $851 million in USDT that left Binance in those 39 hours went to Tether's treasury address, which public label sets record as Bitfinex. These are Binance's own transactions with the issuer of USDT, not customers moving to Bitfinex, and they are left out of the figures above.
"What the averages do not show is that the run was made by a few large customers. Fewer than a thousand wallets took more than half of the money. The sign of confidence now is whether those whales come back in full over the coming weeks." Rodrigo Trindade, owner of Teiten Research.
Wallets. Binance's wallets are the ones labelled in public label sets plus the ones we identified by their behaviour, on ten networks. Values are in dollars at the hour of each transfer.
Normal. The hourly and six-hour charts and the total withdrawn compare with the median of the same hour of day between 22 October and the attack. The charts of wallets by size, whales, exchanges and destinations compare with the same 39 hours a week earlier (25 October, 05:00, to 26 October, 20:00, UTC). The deposits chart compares with the average of 26 to 28 October.
Destinations. Every wallet that received withdrawals was followed for 48 hours from its first withdrawal in the window, and whoever it paid was classified by public labels. Customer deposit addresses are the ones that have sent to a Binance wallet since 22 October.
The full data, updated every hour, is on the Teiten Research dashboard.