EL7.AI
CryptoMedium•3 November 2026•
4 min read

Bybit Depositors Rise 2.4-Fold During Binance Withdrawal Halt After Hack Estimated at $6.3 Billion

Key Facts

1Bybit had 31,539 depositors on Ethereum during the suspension, compared with 13,038 in the comparison period.
2Bitget depositors on TRON reached 2.3 times their usual level, with $87.0 million in USDT deposits compared with $66.0 million.
3Binance estimated the hack’s total impact at about $6.3 billion and said about $3 billion had been frozen on-chain.
4The attacker still held about $3.0 billion at 09:10 UTC on November 3.

The number of deposit addresses on Bybit’s Ethereum network rose to 31,539 during Binance’s withdrawal halt, compared with 13,038 in the corresponding hours of the previous week, according to an analysis published by Bitquery. That was 2.4 times the comparison level, indicating that on-chain deposit activity shifted toward a competing platform while withdrawals were suspended. The number of Bitget depositors on the TRON network also rose to 2.3 times its usual level, and its USDT deposits reached $87.0 million, compared with $66.0 million in the corresponding hours of the previous week. These movements followed a hack whose total impact Binance estimated at about $6.3 billion. Binance had temporarily suspended deposits and withdrawals to conduct security checks before announcing a phased resumption of withdrawals.

The figures show growth in the number of depositors and the value of USDT deposits on two different networks during the suspension window, but they do not identify each depositor’s motives or establish whether the transfers were to a trading platform rather than another destination. On Ethereum, Bybit had 31,539 deposit addresses between October 29 and November 1, compared with 13,038 in the corresponding hours of the previous week. On TRON, Bitquery compared Bitget activity during the suspension with the previous week’s level and recorded deposits worth $87.0 million, versus $66.0 million. The comparison provides context for cryptocurrency movements during the withdrawal disruption, without making the figures a comprehensive measure of all customer funds or all competing platforms. These flows remain tied to the suspension window that followed the incident, rather than the withdrawal status when the analysis was published.

Binance estimated the hack’s total impact at about $6.3 billion and said about $3 billion had been frozen on-chain at the time of an Associated Press report. The figures therefore vary depending on the update’s timing and the scope of the funds covered by each estimate.

Binance said its initial investigation indicated that a DevOps engineer’s laptop may have been compromised, allowing the attacker to access a service container and send unauthorized withdrawal transactions. It added that it had found no evidence of private wallet key leaks. On October 30, the company said it had allocated more than $6.34 billion of its funds to cover losses, including $5 billion held in the same affected assets. It said customers’ underlying assets were fully backed and that it would cover the stolen funds from the SAFU fund and company treasury. In an October 31 update, it said the assets it had covered had reached 90% and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC assets were now 100% fully backed.

The wallet draining began on October 29, and Bitquery’s analysis said the last customer payouts on the Solana, BNB Chain and TRON networks went out at 20:36 UTC. The agency reported that bitcoin fell 3.2% on Thursday evening to below $79,000 after the incident. But customer activity was not limited to the withdrawal halt; Bloomberg reported that Binance recorded $3.6 billion in net outflows of crypto assets after withdrawals resumed on November 1, and that the pace of outflows eased after the initial surge. These later flows put movements to competing platforms in the broader context of the response to the suspension itself.

At 09:10 UTC on November 3, the attacker still held about $3.0 billion, mostly in BTC and ETH, according to Bitquery tracking. The company said it had not observed the funds it tracked reaching an exchange deposit address or a mixing tool. Binance had announced that withdrawals would resume in phases starting November 1, setting the first-phase window between 14:00 and 17:00 UTC+8, while deposits continued as normal. With service resumed, tracking assets that had not been frozen and outflows from the platform remained central to developments related to the incident.