"Traded with hackers the whole night", Binance was hacked, people make a fortune in the cryptocurrency circle

Binance suffered the largest theft in its history, with $6.3 billion in assets stolen, but the incident unexpectedly generated huge profits for a small group of fast-acting traders. The more panicked the hackers were, the more losses they incurred, and the faster the traders made gains.

According to Bloomberg's report on Tuesday, the hackers, eager to cash out the stolen funds, concluded transactions at steep discounts, leaving massive price mismatches across multiple blockchains and trading platforms.

According to estimates by blockchain data firm Bitquery, the attackers lost up to approximately $119 million due to hasty execution. A large proportion of this sum ended up in the pockets of well-prepared arbitrageurs.

After Binance detected a security vulnerability on October 29, it immediately suspended withdrawals, a move that inadvertently exacerbated market fragmentation — cross-platform price gaps that would normally disappear within seconds were forced to persist for minutes or even hours, creating opportunities for traders to exploit.

Data from blockchain intelligence firm TRM Labs shows that Tether and Circle froze approximately $1.8 billion worth of stablecoins on the Ethereum chain about 40 minutes after the attack, before which the hackers had frantically completed a large number of token swap operations.

01

The Hackers' Desperate Trades: Rushing to Offload Stablecoins Regardless of Price

After seizing control of Binance's funds, the attackers' top priority was to dispose of the stablecoins in the stolen assets. Since stablecoins such as USDT can be frozen by their issuers, the hackers had to convert them into untraceable assets such as Ether before the freeze order was issued.

Within about half an hour, the attackers began aggressively swapping tokens through decentralized exchanges such as Uniswap, buying large amounts wherever there was liquidity regardless of the price. This "cost-agnostic, one-way dash" operation pattern caused extremely distorted prices in the decentralized market where liquidity was already thin.

Luca Parlamento, Founder and Chief Investment Officer of D2 Finance, said that his company operated on "the other side of the hackers' trades" the entire night.

He revealed that the average cost for the attackers to buy Ether through decentralized exchanges was around $2,657, while the quote on crypto derivatives platform Hyperliquid during the same period was only about $2,300. "This spread was supposed to be filled by us," Parlamento said.

James Aitchison, Chief Investment Officer of Caerus Global Management, described this market state as "a single seller with a huge capital size that is extremely price-insensitive forcibly dumping assets in thin liquidity."

He said this aggressive one-way sell-off created multiple significant mismatches across different trading venues and blockchains. "We traded on this event and found several very attractive mismatch opportunities."

02

Textbook Operation by Arbitrageurs: Earning 25% in Five Minutes

For traders who had deployed funds on relevant platforms in advance, the operation logic was simple and straightforward — sell where the hackers pushed up prices, buy where prices were unaffected, and pocket the spread in between.

Annanay Kapila, a former quant trader and founder of derivatives exchange QFEX, keenly spotted this signal while working in his office in central London. He found that the price of Ether skyrocketed on decentralized exchanges, with quotes on some exchanges temporarily exceeding $3,000.

Kapila immediately borrowed a large amount of Ether on decentralized lending platform Aave using stablecoins as collateral, then sold all of it on the exchanges with high prices. He said the entire operation was completed in five minutes, with a profit of 25%.

Kapila said bluntly that the volatility of the cryptocurrency market has tended to stabilize in recent years, and such opportunities are increasingly rare. The last similar window dates back to the market crash in October 2025. "The cryptocurrency market has been a bit quiet this year. Whenever a major market imbalance occurs, it brings huge opportunities," he said, "I entered the market in 2021, when this kind of thing happened almost every week, but now it is relatively rare."

03

Price War Among Bots: Fees Surge, Half of the Gains Are Seized by Algorithms

The hackers' panic spread not only to Ethereum, but also to other chains and tokens.

Aitchison revealed that the attackers bought about 638 million TRX at an average price of around 36.7 cents in 16 transactions through small decentralized platform SunSwap on the Tron chain, while the average market price at that time was about 33 cents. This wave of buying once pushed the price of this trading pool to more than 18% above the overall market price, and the price gap took about 10 hours to fully close.

Another obvious anomaly occurred on RLUSD, the U.S. dollar stablecoin under Ripple — the attackers suddenly poured $48 million worth of RLUSD into an extremely illiquid buy pool, causing its price to plummet to 81 cents instantly, before quickly returning to the $1 parity within a few minutes.

Such significant price mismatches quickly triggered fierce competition among trading bots. Since the blockchain network determines the order of transaction processing based on the level of transaction fees paid, various algorithms competed to raise prices for priority execution, driving a sharp surge in network fees.

According to Bitquery's statistics, of the approximately $119 million lost by the attackers due to poor execution, about half went to traders and arbitrage bots; another approximately $29.5 million flowed to the Ethereum block packers in the form of fees, who reaped the benefits from the bots' bidding war.

04

Not Everyone Joined the Fray: Entry Threshold Determines the Upper Limit of Returns

Not every institution chose to participate in this melee. Rajiv Sawhney, Head of International Portfolio Management at Waves Digital Assets, said his team monitored the relevant price differences throughout the process but ultimately chose to stay put. He pointed out that the biggest profit opportunities belonged to institutions that had already deployed funds in the right positions in advance.

Sawhney also noted the limitations of this trade: the window period was extremely short, transaction costs rose sharply during the event, and some lending markets also began to tighten activity restrictions as night fell.

Binance has begun phased withdrawal resumptions since Sunday, stating that it has frozen approximately $3 billion of related assets in collaboration with industry partners, and used its own funds to cover the stolen losses.

This article is from the WeChat Official Account "Wall Street CN Max", author: Zhao Ying, authorized for release by 36Kr.