Aperiodic Replay · 29.10.2026
On Thursday night someone emptied Binance’s hot wallets – $6.36B across ten chains, the largest crypto theft on record. The first wallets went at 20:05 UTC and the market didn’t notice for 20 minutes. Then, 92 seconds after the main Ethereum wallet was swept, BNB broke away from BTC on every venue at once. We rebuilt the night from every trade, book and position on Binance, OKX and Hyperliquid, in 15-second bars, and second by second where it matters.
You’re running $10M of perps on Binance, $5M long BNB and $5M long BTC from 20:15. The tape stops at 20:25, 20:48 and 00:14 with only what the market knew then. At each stop you can cut, hedge, add or flip short, and see what your trade did to the book next to the ones you didn’t make.
Prices fell, but nothing broke – no venue gapped, no stablecoin lost its peg and Binance’s prices stayed in line with everyone else’s. What the tape does show is how the market found out, and what it sold.
Binance hot wallets on ten chains get emptied. XRP goes first at 20:05, Bitcoin and Tron at 20:20, then the main Ethereum wallet at 20:23:24. TRM Labs attributes it to North Korea’s TraderTraitor.
TRM Labs ↗92 seconds after the Ethereum sweep, BNB breaks away from BTC on Binance, OKX and Hyperliquid at the same time. The first three drains didn’t move anything.
Aperiodic trades, 1-secondTether, Circle, Ripple and World Liberty freeze about $2.7B of what was taken. Binance pauses withdrawals at 22:15 and posts $2.54B frozen at 23:22.
TRM Labs ↗The same post confirms the hack and suspends deposits and withdrawals. The bigger leg down starts five minutes later.
FinanceFeeds ↗The replay
Eight coins, three venues, every 15 seconds from 19:30 to 03:00 UTC. Watch BNB first. Switch to BTC for the wider market, TRX for the coin that went up, or AAVE and ENA for the worst of the DeFi selling. The ladder on the right is the order book at the playhead – the dashed outline is its normal size, from 19:30 to 20:00.
The first dip of the night came from Amazon’s earnings. At 20:00 UTC the US market closes and Big Tech reports. Hyperliquid lists perps on stocks, so you can watch it on the same screen as crypto: Amazon’s perp fell 11.8% in three minutes, Intel’s 21%. The Nasdaq-100 perp slid — and BTC — with it.
Binance’s wallets were being drained at the same time – XRP from 20:05, then Solana and Optimism, then 18,270 BTC and 612.7M USDT on Tron at 20:20. The tape doesn’t show any of it. BNB, Binance’s own token, stayed within — of BTC the whole time.
Then the Ethereum wallet went, at 20:23:24: 167,464 ETH and 1.615B USDT in one sweep, from an address block explorers label as Binance’s. At 20:24:56 someone sold — of BNB perps on Binance in one second. The busiest second in the minute and a half before was —. OKX’s book got hit in the same second, and from there BNB fell away from BTC on every venue.
Everything fell that night, so I’ll take BTC’s move out of BNB’s. What’s left is the market’s view on one thing: how bad this is for Binance specifically. BNB is Binance’s own token, and most of what it’s used for happens on Binance and BNB Chain.
That line moved first and furthest – by — BNB was — against BTC. Binance and OKX drew almost exactly the same line. Hyperliquid’s ran a bit lower. Whoever was selling was selling everywhere.
People weren’t only selling. BNB open interest went up while the price went down, so new shorts were opening: — on Binance and — on OKX by 21:00, and — on Hyperliquid. Hyperliquid’s BNB funding flipped negative at — and got to — an hour, so shorts were paying longs to keep the bet on. Its BNB also traded — bps under Binance’s from 20:30 to 21:15, against — bps before.
Then it came back. BNB was still — against BTC at 00:12, the minute before Binance said it would cover all losses, and — by 03:00 - pretty much where it started.
open_interest (1-minute) and l2_liquidity (15-second).Binance lists the same perps in more than one stablecoin. BTC-USDT and BTC-USDC are the same bet, so the ratio of their prices is what the market thinks a USDT is worth in USDC. You get that every 15 seconds, from the venue at the center of the story.
Before the hack a USDT bought — bps less than a USDC. Tether froze 971M of the stolen USDT at 21:01, and by 21:30 the gap was — bps. It kept widening after withdrawals stopped, to — bps at —. The BTC, ETH, SOL and XRP books all show the same thing, so the move is in the coin itself.
It’s still nowhere near a depeg. But the attacker took about $2.5B of USDT, TRM traced 325M of it being sold for ETH at roughly 10% under market, and once withdrawals stopped there was nothing pulling Binance’s books back into line. Switch to USD1, World Liberty’s coin, which was also stolen and frozen that night – it slipped — under USDT.
TRM’s report names the chains the money left on and the protocols it went through. Line those coins up against BTC and you can see what the market sold: BNB Chain tokens with BNB, and the protocols the attacker used even more – Aave (it borrowed there until the markets were frozen), Uniswap, Arbitrum and Optimism.
Tron went the other way. TRX gained on BTC through the night, with the tokens of JustLend and SUN.io (Tron’s lender and exchange) alongside it. The data shows the buying, not who did it. TRM puts 612.7M stolen USDT on Tron and 300M of it into JustLend.
There were two legs down. The first, from 20:40, was the market pricing the theft: longs on Binance and OKX got liquidated for — in ten minutes, — of it in the 15 seconds from —. The median Binance perp fell — from 20:23, and only — printed their low of the night.
The second came after Binance’s 00:13 post. It promised to cover all losses and, in the same post, confirmed the hack and suspended deposits and withdrawals. Fewer positions got force-closed (—), the books were just as thin, and prices went further: — Binance perps printed their low of the night at 00:22 or 00:23, and the median was — under its 20:23 close.
Forced selling drove the first wave. The second had less of it and still went further, once Binance itself had confirmed the hack.
liquidations, 15-second.We built this the morning after, from our live capture: every trade on every perp on Binance, OKX and Hyperliquid, about 10 GB for the night. Trades are bucketed by exchange time into 15-second bars, and 1-second bars around the sweep. Book depth, slippage and liquidations come from our 15-second metrics, open interest, mark price and funding from the 1-minute ones.
It’s not perfect – the live metrics are keyed by receive time, not exchange time, and Hyperliquid doesn’t publish liquidations. The raw trades for October land in the API archive shortly. Once they do, the snippet below rebuilds the BNB line from chapter 02.
raw/tradesEvery trade with its taker side, for the 15-second and 1-second barsl2_liquiditySize resting in the top 5, 10, 20 and 25 levels of each bookopen_interestPositions open on each perpetual, in coins and dollarsl1_liquiditySpread and dollars at the best bid and askflowMarket buys and sells, split by order sizefrom datetime import date, datetime
import aperiodic as ap
import polars as pl
def bars(coin):
trades = ap.get_raw(
api_key="YOUR_KEY",
dataset="trades",
exchange="binance-futures",
symbol=f"perpetual-{coin}-USDT:USDT",
start_date=date(2026, 10, 29),
end_date=date(2026, 10, 29),
)
return (
trades.sort("exchange_timestamp")
.group_by_dynamic("exchange_timestamp", every="15s")
.agg(pl.col("price").last().alias(coin))
)
# BNB with BTC's move taken out, from the 20:23 close
meter = bars("BNB").join(bars("BTC"), on="exchange_timestamp")
ref = meter.filter(pl.col("exchange_timestamp") == datetime(2026, 10, 29, 20, 23, 45))
meter.with_columns(
vs_btc=(pl.col("BNB") / ref["BNB"][0]) / (pl.col("BTC") / ref["BTC"][0]) - 1
)Track an exchange token against BTC, read stablecoin rates off a venue’s own books, or watch open interest build into a falling price. Every trade, book and perp on Binance, OKX and Hyperliquid, point-in-time.
Aperiodic Replays · No. 05 · Market data: Aperiodic metrics. News timeline: sources linked in place.aperiodic.io