Bitcoin’s first reaction to the Binance Hack was a liquidation wick, not a drain of a Bitcoin hot wallet. In the hour the reports hit, Nebraskangooner printed $BTC from $80.8k to $78.8k. The wallet debit underneath that print, on the Ethereum transaction I opened, was 167,464.25 ETH and about 1.615 billion USDT, plus a long list of other tokens. Wrapped bitcoin in that same transfer was 82.54351401 WBTC. That is a small line inside an ether and stablecoin debit. It is not a Bitcoin-chain hot wallet being emptied, and nothing in the posts opened for this piece shows that any bitcoin from the debit was sold.
Desks that treated the tape as “Bitcoin was hacked” mixed two books. One book is the BTC/USDT perp and spot ladder, which gapped while longs were forced out. The other book is an Ethereum hot wallet labeled Binance 14 on Etherscan, which moved ether, tether, and a stack of ERC-20s into a fresh address. Those are different facts. The Binance Hack price path is the story here. The wallet narrative is already filed in the FinanceFeeds incident piece on the transfers. This article does not re-try that case. It records the Bitcoin move that had already printed by the time the posts and the 5-minute closes below were pulled.
The Binance Hack print on the Bitcoin tape
The only Bitcoin price path in the posts opened for this piece is the one Nebraskangooner wrote at 20:51:48 UTC. The text is plain: market already reacting in the last hour, $BTC $80.8k to $78.8k, $ETH $2,335 to $2,255, be cautious until Binance confirms. He also put the outflow at about $2.77 billion across five chains, “reportedly through a contract call funded by Tornado Cash,” and he marked the hack unconfirmed.
That $80.8k to $78.8k line is a rounded print from a trader’s post. It is not a 5-minute close, and it is not a calculated percent. The post does not state a percentage. This article does not invent one from the two rounded figures.
The exchange candles are a second source, and they do not match that print one for one. On the Binance public market API, the BTC/USDT 5-minute bar that opened at 19:55 UTC closed at 80,848.64. The bar that opened at 20:40 UTC closed at 78,884.52. The bar that opened at 20:55 UTC closed at 78,851.99, the lowest close in the chart window. Those closes sit near the rounded $80.8k and $78.8k wording. They are not the same numbers.
The low inside the bar that opened at 20:45 UTC was 78,297.05. That low is not a close. The same bar closed at 78,986.60. Nebraskangooner’s post went up at 20:51:48 UTC, after that 20:45 bar had finished and while the 20:50 bar was still open. His “$78.8k” is his print. The 78,297.05 low is the exchange candle’s low. They disagree if a desk treats them as one figure. They are printed here as two figures.
Later closes in the same pulled series were already back above that low. The bar that opened at 21:15 UTC, the minute Changpeng Zhao posted, closed at 79,566.97. The last closed bar in the chart, the one that opened at 21:40 UTC, closed at 79,169.86. The series was pulled from the Binance API at 21:46:07 UTC, after that bar had closed. Those are recorded closes. They are not a view on the next bar.
The debit was ether and stablecoins
I opened the Binance 14 transaction on Etherscan before using the Bitcoin print as if it were a stolen-coin sale. The hash is 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3. Etherscan timestamps it Oct-29-2026 08:24:23 PM UTC, which is 20:24:23 UTC. Status is success. The sender name on that page is Binance 14, address 0x28C6c06298d514Db089934071355E5743bf21d60. The recipient is 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c.
The native ETH line on that page is 167,464.247856558836135296 ETH. Etherscan’s summary row rounds the same transfer to 167,464.25 ETH and shows its own dollar mark of $378,288,338.76. That dollar mark is the explorer’s, not an X post. The ERC-20 list on the same page contains 63 token transfers. The largest stablecoin line is 1,615,409,498.97324 Tether USD. The page’s dollar column marks that USDT line at $1.61 billion. RLUSD is 62,597,239.679797044969015518. USDe is 9,707,546.773204598785601727. FDUSD is 3,454,894.923080018305112463. USD1 is 27,760,801.816896471320891162.
Wrapped bitcoin is on the list, and it is not the debit. The page shows 82.54351401 WBTC, with the explorer’s dollar mark at $6,601,554.74. Set next to 1.615 billion USDT and 167,464.25 ETH, that WBTC line is a residual token in a hot-wallet sweep, not a Bitcoin hot-wallet drain. Native bitcoin does not move inside an Ethereum transaction. A desk that is long BTC/USDT was not watching the coin that left Binance 14.
A second transaction, read on Blockscout because the Etherscan page for this hash returned a bot check, is 0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481. Blockscout timestamps it 29 October 2026, 20:41:23 UTC. Status is success. The token transfer is 780,000,000 USDC, six decimals, from an ERC-1967 proxy to the same recipient, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c. The outer call lands on Binance 14. foobar, who describes himself as ceo of Circuit, posted at 20:48:00 UTC that another $780 million USDC clip had just been taken from the hot wallet and that the compromise looked still active. His post links the recipient address, not this hash. The amount on the transaction matches the amount in his sentence. His sentence is his reading. The transfer amount is the chain record.
Spreek’s post at 20:32:51 UTC is the early alert CoinDesk’s developing story linked. The words are: “Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash.” The photo on that post is an explorer view of 0x5227f603…DfCCB2f8c. In the frame, the ETH balance reads 195,469.347761814629008509 ETH, token holdings read $1,752,048,534.56 across 63 tokens, and the multichain portfolio reads $2,711,720,018.8. The page in the screenshot says the address was funded by Binance 14. A row in the same screenshot shows Binance 16 sending 28,005.6 ETH in. Adding the Etherscan ETH amount from Binance 14 to that 28,005.6 ETH lands near the 195,469 ETH balance in the screenshot. That is a composition check, not a conclusion that the coins were stolen or sold.
The same screenshot already shows two small outbound transfers from the new address, one marked 0.5 ETH and one marked 0 ETH toward an address labeled like a Tether stablecoin contract. Those rows are minutes old in the screenshot. They are not a bitcoin sale. This piece does not claim the ETH, the USDT, the USDC, or the 82.54 WBTC was sold. No post opened here shows a sale of that WBTC.
The dollar totals do not agree, so they are not blended
Five outflow headlines were opened as posts, plus the screenshot. They are close. They are not the same number. Blending them into a single “about $2.8 billion” would invent a figure nobody posted.
Walter Bloomberg, posting as @DeItaone at 20:42:17 UTC, wrote in all caps: “BINANCE WALLETS SEE $2.77 BILLION OUTFLOW ACROSS FIVE BLOCKCHAINS AMID DRAIN SUSPICIONS; HACK UNCONFIRMED.” Nebraskangooner, nine minutes later, used about $2.77 billion across five chains. Those two match on $2.77 billion. They do not match the later round numbers.
SolanaFloor at 20:47:37 UTC wrote that Binance wallets recorded almost $3 billion in outflows, and that no hack had been confirmed as of yet. “Almost $3 billion” is a different print from $2.77 billion. foobar at 20:48:00 UTC wrote “$2 billion drained and counting,” and then the additional $780 million USDC. Two billion plus 780 million is his running tally, not a reconciled total, and it is not $2.77 billion either.
Michaël van de Poppe, CIO and founder at MN Fund and MN Capital, posted at 20:48:37 UTC: “Breaking news: Binance is potentially hacked for $2.8 billion. Stay safe out there everyone.” That post quotes the Walter Bloomberg item, which says $2.77 billion, not $2.8 billion. The quote and the quote-tweet disagree by a rounding step. Both are left as posted.
The Kobeissi Letter at 21:14:21 UTC used $2.8 billion across five blockchains, tied to a Tether freeze of $971 million USDT, and said Binance had yet to comment. Tree News at 21:05:27 UTC, the post Zhao quoted, said: “TETHER FREEZES $971M USDT IN LIKELY BINANCE HACK, WITH NO UPDATE FROM BINANCE STILL.” The $971 million Tether figure is the one point these later posts share with Zhao. The outflow gross is not shared. Spreek’s screenshot, earlier, showed $2,711,720,018.8. That is below $2.77 billion and well below “almost $3 billion.”
What Zhao said, and what the exchange account had not said
Changpeng Zhao posted at 21:15:23 UTC, quoting Tree News. The post, in his words: “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”
The gap is the exchange account. Tree at 21:05:27 UTC said there was still no update from Binance. Kobeissi at 21:14:21 UTC said Binance had yet to comment. Zhao’s post one minute later is explicitly not a management post. As of those three timestamps, the record is a shareholder calling it a hack and the news accounts saying the company account had not spoken. A later company post, if one landed after 21:15 UTC, is outside the posts opened here. It is not filled in.
That gap matters for the Bitcoin book because the wick did not wait for the company line. Nebraskangooner’s $80.8k to $78.8k print was timestamped 20:51:48 UTC, about 24 minutes before Zhao and about 27 minutes after the Binance 14 Ethereum transfer. The forced-selling window sat between the on-chain debit and the shareholder post. Traders who needed an official label did not have one when the low close printed.
Zhao’s coverage line also sits next to a fund that is already held in bitcoin, which is a different inventory from the coins that moved on Ethereum. FinanceFeeds has explained the Secure Asset Fund for Users as the pool Binance built for breach losses. On February 2, 2026 FinanceFeeds reported that Binance had started converting that reserve into bitcoin, with an initial purchase of 1,315 BTC worth roughly $101 million at an average price of $77,409.89, citing Blockchain.com. On February 9, 2026 FinanceFeeds reported a further purchase of 4,225 bitcoin, about $300 million, which the piece said took bitcoin holdings in the fund above $720 million at the prices then. Those are prior reported purchases. They are not a live balance pulled tonight, and they are not a statement that the fund was used on 29 October.
Why bitcoin wicked when bitcoin was not the drained coin
A liquidation wick is the print when leveraged longs no longer clear margin and the venue closes them into the book. The coin being closed does not have to be the coin that left the wallet.
On Thursday that coin was bitcoin in the perp and spot books, while the wallet post was an Ethereum hot wallet. Nebraskangooner put both facts in one post: the $2.77 billion chain figure, and the $BTC move from $80.8k to $78.8k, alongside ether from $2,335 to $2,255. He did not write that stolen bitcoin was sold. He wrote that the market was already reacting.
The 5-minute closes show the shape of that reaction without turning it into a percent. From the 19:55 close at 80,848.64, the 20:00 close was already 80,412.20. That bar opened before the 20:24:23 UTC Ethereum timestamp. The heavy step in the closes comes later. The 20:40 close was 78,884.52. The 20:55 close was 78,851.99. A move of that size in a handful of 5-minute closes is the window in which cross-margin and isolated-margin longs get reduced by the venue, not by a holder deciding to sell spot. The chart is closes only. It does not draw the 78,297.05 low, because that low is inside the 20:45 bar and the series specified for the chart is closes.
Cross-margin is the mechanical link between an ether wallet story and a bitcoin print. A book that is long bitcoin perps and long ether, or that uses a stablecoin balance as margin for a bitcoin perp, gets marked on both. A headline that says a Binance hot wallet moved is enough to pull bids in BTC/USDT even when the wallet’s largest lines are USDT and ETH. The 82.54351401 WBTC on the Ethereum transfer is too small, next to those lines, to be the spot supply that printed a move from the $80.8k area to the $78.8k area. Using it as the explanation would ignore the size.
The label was still open when the book moved. Spreek, Walter Bloomberg, and SolanaFloor marked the hack unconfirmed. foobar and van de Poppe treated it as active or potential. Zhao said it looked like a hack and that he does not manage the company. Kobeissi said the company had not commented.
What the desk does not get from this record is a liquidation notional. None of the posts opened for the price path stated a dollar amount of forced closes. A news rewrite cited a CoinGlass hour. That rewrite is not used here, because the figure was not in an X post this piece opened and was not on a page those posts linked. The operational record is the print itself: $80.8k to $78.8k in the post, and the 5-minute closes and the 78,297.05 low on the exchange API, kept separate.
What desks check next, without a price call
The checks that were still open when these posts were read are operational. They are not a bitcoin target.
The first check is whether Binance.com, as opposed to a shareholder, identifies the destination address. Tree and Kobeissi said that update was not up at 21:05 and 21:14 UTC. Zhao’s post does not fill that hole. Until a company post maps 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c to a custody wallet or to an unauthorized holder, the transfer remains a debit with a disputed label. The Bitcoin print does not settle the label.
The second check is the freezes Zhao named. Tether at about $971 million is in his post, in Tree’s post, and in Kobeissi’s post. Circle at about $823 million is in his post. A freeze is a stop on a stablecoin contract. It is not a bitcoin transaction, and it does not by itself say whether the 167,464.25 ETH can still move. Desks watching the bitcoin book still watch those freezes, because a frozen stablecoin changes how quickly any later sale of the ether or the ERC-20s could be turned into dollars. That is a plumbing check. It is not a call on the next BTC/USDT close.
The third check is what the recipient does with the coins already there. Spreek’s screenshot showed the address newly funded and already sending small outbound transactions. foobar said the USDC clip meant the issue still looked active at 20:48 UTC. A later movement of the 167,464.25 ETH, of the 1,615,409,498.97324 USDT, or of the 82.54351401 WBTC would be a new on-chain fact. This article does not report that later movement, because it was not in the posts or the transactions opened here. In particular, the WBTC line is recorded as a transfer into the recipient, not as a sale on a bitcoin venue.
The fourth check is whether open interest and funding on BTC/USDT were reduced by the wick or only marked through it. The 20:55 close at 78,851.99 and the 21:40 close at 79,169.86 are already recorded. Open interest and funding were not in the posts opened here, so no figure is added.
The fifth check is the bitcoin already reported inside SAFU. Thursday’s X print went to $78.8k, near the $77,409.89 average on the first 1,315 coins, and the API low went through that average to 78,297.05. That is a mark on a reserve that already exists. It is not a claim the reserve was spent, and it is not a claim the print stops there.
None of those checks is a future bitcoin price. The recorded move is the X print from $80.8k to $78.8k, the closes around that print, and the 78,297.05 low inside the 20:45 bar.
Questions the posts actually answer
Was bitcoin the asset that left the hot wallet?
No. The Binance 14 Ethereum transfer at 20:24:23 UTC sent 167,464.25 ETH and 1,615,409,498.97324 USDT, plus 63 ERC-20s. Wrapped bitcoin in that batch was 82.54351401 WBTC. A later transfer to the same address was 780,000,000 USDC. That is an ether and stablecoin debit, not a Bitcoin hot-wallet drain.
What Bitcoin price did the X post print?
Nebraskangooner at 20:51:48 UTC printed $BTC from $80.8k to $78.8k and did not state a percent. The nearest Binance 5-minute closes were 80,848.64 and 78,851.99. The 20:45 bar low was 78,297.05. Those figures are not averaged.
Did Binance confirm a hack in the posts opened here?
Not on the company account through 21:15 UTC. Tree News at 21:05 UTC and The Kobeissi Letter at 21:14 UTC said Binance had not updated. Changpeng Zhao at 21:15 UTC said it looks like a hack and that he does not manage Binance.com. Coverage was his expectation as a shareholder.
Why do the outflow dollars differ?
Because the posts printed different numbers. Walter Bloomberg and Nebraskangooner used about $2.77 billion. SolanaFloor said almost $3 billion. Kobeissi and van de Poppe used $2.8 billion, while the post van de Poppe quoted says $2.77 billion. foobar said $2 billion and counting, plus $780 million USDC. Spreek’s screenshot showed $2,711,720,018.8.
This article records the move that already happened. It is not a price prediction.
This is not financial advice.