Binance reopened withdrawals after the hack: where Bitcoin went in the first five hours
Binance’s new payout wallet sent 13,526 BTC beyond known Binance wallets in the first five hours after withdrawals reopened following the hack. Kraken, OKX and Coinbase each received about 1,300 BTC. Kraken leads the named destinations by amount; Coinbase’s share exceeds every historical comparison window.
For anyone holding Bitcoin on Binance, the hack raises a question of exposure: keep it there or move it elsewhere. Once withdrawals reopened, the payments began to show where Bitcoin leaving the exchange arrived. We follow the first five hours and eight minutes of payments from Binance’s new payout wallet, 06:11:21–11:19:01 UTC on Sunday 1 November. We identify the main receiving platforms and compare their shares with the old payout wallet during the same hours on eight Sundays before the hack.
Binance sent 27.8 times the matching Sunday average
The new wallet sends 13,526 BTC beyond known Binance wallets between 06:11 and 11:19 UTC. Binance’s previous payout wallet averaged 487 BTC during the same hours on eight Sundays before the hack. Even the busiest of those windows reached only 778 BTC.
The comparison covers 6, 13, 20 and 27 September, and 4, 11, 18 and 25 October 2026, always 06:11:21–11:19:01 UTC. Change and known Binance transfers are excluded from both sides.
Kraken receives 1,330 BTC, the most of any named destination
Wallets attributed to Kraken receive 1,329.85 BTC through 354 individual payments to 235 addresses in the 06:11–11:19 UTC reopening window on 1 November. Kraken received payments in all eight matching pre-hack Sunday windows, but never more than 92.22 BTC. Those eight windows together contain 348 individual payments to Kraken.
| Measure | Earlier average | Earlier maximum | Reopening |
|---|---|---|---|
| BTC received | 22.66 | 92.22 | 1,329.85 |
| Individual payments | 43.5 | 73 | 354 |
| Receiving addresses | 36.6 | 58 | 235 |
Removing the largest payment, 300 BTC, still leaves 1,030 BTC—above the 92.22 BTC maximum in any earlier window. The increase extends across payments beyond that single transfer.
Kraken’s 9.8% share of outward Bitcoin also exceeds its 0.6% median across the matching Sundays. Its earlier high is 18.0%, shown in the date-by-date comparison below.
Coinbase’s share reaches 9.5%—above every comparison window
Wallets attributed to Coinbase, including Coinbase Prime, receive 1,287 BTC, compared with an average of 3.73 BTC in the matching pre-hack hours. Coinbase received payments in all eight earlier windows, but its share never exceeded 2.1%.
The increase extends beyond the largest payment of 460.72 BTC. Removing it leaves 826 BTC to Coinbase—still 6.1% of the full outward total, above every earlier share. The route is established; the concentration of payments to it has changed.
OKX receives far more payments while keeping a familiar share
OKX receives 1,304 BTC through 1,118 individual payments to 746 addresses. No matching pre-hack window contained more than 46 OKX payments or 36 receiving addresses.
Its 9.6% share is close to the 8.5% median across those Sundays, within their 6.2%–47.4% range. Here the notable change is the breadth and size of the payments, rather than an exceptional share going to OKX.
Binance fits 6.1 times as many payments into each transaction
The wallet sends 260 payout transactions, compared with an average of 168 in the matching windows. The average batch grows from 10.2 to 62.5 individual payments. The median payment is also 5.6 times larger. The increase in Bitcoin paid out combines more transactions, larger batches and larger individual payments.
| Measure | Before the hack | Reopening |
|---|---|---|
| Payout transactions | 168 average | 260 |
| Individual payments | 1,717 average | 16,254 |
| Payments per transaction | 10.2 | 62.5 |
| Median payment · BTC | 0.0014213 | 0.00798 |
Kraken, OKX and Coinbase receive 3,921 BTC
These three account for 71.8% of the identified amount. Across all named destinations, we identify 40.4% of the 13,526.48 BTC sent beyond known Binance wallets. The table records receiving wallets and services. “Unnamed” covers the remainder whose owners we have not identified.
OKX receives 1,304.42 BTC across 746 addresses. Bybit receives 507.91 BTC across 601 addresses; its largest individual payment is 400.00 BTC, accounting for 78.8% of its total.
Scroll the table sideways for address counts and largest payments.
| Destination | BTC received | Share | Earlier average · BTC | Receiving addresses | Largest payment · BTC |
|---|---|---|---|---|---|
| Kraken | 1,329.85 | 9.8% | 22.66 | 235 | 300.00 |
| OKX | 1,304.42 | 9.6% | 85.75 | 746 | 100.00 |
| Coinbase | 1,286.96 | 9.5% | 3.73 | 192 | 460.72 |
| Bybit | 507.91 | 3.8% | 20.37 | 601 | 400.00 |
| Upbit | 339.84 | 2.5% | 5.67 | 168 | 100.00 |
| Nexo | 249.00 | 1.8% | 11.25 | 1 | 50.00 |
| Flow Traders | 103.70 | 0.8% | 1.24 | 1 | 30.00 |
| MEXC | 86.58 | 0.6% | 4.22 | 38 | 30.00 |
| Galaxy Digital | 80.00 | 0.6% | 0.00 | 1 | 80.00 |
| BIT.com (Matrixport) | 62.55 | 0.5% | 1.24 | 2 | 30.06 |
| KuCoin | 36.10 | 0.3% | 14.29 | 55 | 21.27 |
| Gate | 20.12 | 0.1% | 3.96 | 108 | 4.00 |
| Hyperunit | 15.58 | 0.1% | 0.74 | 18 | 12.00 |
| HTX | 13.30 | 0.1% | 0.00 | 12 | 11.01 |
| Deribit | 7.45 | 0.1% | 1.73 | 10 | 7.00 |
| Bitfinex | 6.97 | 0.1% | 12.08 | 14 | 2.71 |
| Bitstamp | 5.71 | <0.1% | 0.07 | 4 | 3.50 |
| Revolut | 2.46 | <0.1% | 2.05 | 21 | 0.70 |
| Foxbit.com.br | 2.40 | <0.1% | 0.20 | 2 | 2.40 |
| Crypto.com | 0.87 | <0.1% | 1.43 | 25 | 0.23 |
| Cobo.com | 0.75 | <0.1% | 0.05 | 6 | 0.50 |
| Gemini | 0.41 | <0.1% | 0.00 | 2 | 0.39 |
| B2C2 Group | 0.35 | <0.1% | 0.00 | 1 | 0.20 |
| bitFlyer | 0.13 | <0.1% | 0.0017701 | 4 | 0.11 |
| 001K Bot | 0.10 | <0.1% | 0.00 | 3 | 0.10 |
| Poloniex | 0.00426597 | <0.1% | 0.63 | 1 | 0.00216524 |
| Jump Crypto | 0.001 | <0.1% | 15.51 | 1 | 0.001 |
| ViaBTC | 0.00048 | <0.1% | 0.00425167 | 1 | 0.00048 |
| HitBTC | 0.0003435 | <0.1% | 20.17 | 2 | 0.00013324 |
| Unnamed | 8,044.18 | 59.5% | Not compared | 10,657 | 358.34 |
| Conflicting wallet labels | 18.77 | 0.1% | Not compared | 53 | 10.00 |
Earlier averages cover the eight matching Sunday windows listed above, including any with zero payments to that destination. Coinbase includes wallets labelled Coinbase Prime. Receiving addresses are not a count of people.
2,954 BTC goes to known Binance wallets
The payout address sends 16,480.09 BTC during this window. Known Binance addresses receive 2,953.60 BTC, or 17.9% of that total. The other 13,526.48 BTC goes to the other destinations examined here.
Among these movements, two transfers return funds to Binance’s established cold-storage address. A further payment goes to a second address labelled Binance cold storage. These reserve movements take place while the same wallet continues making payments to other destinations.
At 11:19 UTC, the payout address held 2,821.09 BTC.
Change returned to the sending address and network fees are excluded. The source is one Binance payout address, linked in the measurement notes below.
44.2% of the outward BTC is sent before 07:00 UTC
The initial 06:11–07:00 interval accounts for 5,976.81 BTC. The chart shows amounts sent in each interval. The first and last bars cover partial hours.
Across the full window, 260 transactions pay 12,985 different addresses. The full five-hour amount exceeds every matching pre-hack Sunday window; the early concentration shows how much of it moves at the start of reopening.
The largest single payments show another side of the breakdown
The table below follows individual payments within transactions. It shows their amount, receiving address and confirmation time. Named totals above can combine many such payments.
| Time | Destination | BTC received | Receiving address |
|---|---|---|---|
| 06:46:23 | Coinbase | 460.72 | 3EAX9EH…ntyg16 |
| 10:08:12 | Bybit | 400.00 | 1E3gwCB…HME2SE |
| 06:46:23 | Unnamed | 358.34 | 1EUPt7P…xFubsW |
| 06:23:59 | Unnamed | 358.07 | 1EUPt7P…xFubsW |
| 06:18:38 | Kraken | 300.00 | 33UB1zV…CRUG5V |
| 06:23:59 | Kraken | 300.00 | 33UB1zV…CRUG5V |
| 06:23:59 | Kraken | 300.00 | 33UB1zV…CRUG5V |
| 06:30:24 | Coinbase | 300.00 | 3EAX9EH…ntyg16 |
| 11:13:44 | Unnamed | 300.00 | 1Fuz4yY…ePSSi7 |
| 08:09:53 | Unnamed | 280.00 | 187f5QV…Ka6hNb |
The first five hours show three different destination patterns. Kraken leads the named totals, with 1,330 BTC spread across 354 payments. Coinbase’s share rises above every earlier comparison window and remains above their 2.1% high even after excluding its largest payment. OKX receives 1,118 payments while keeping a share close to its historical median. Together, these comparisons show where the reopened withdrawal flow concentrates and which destinations gain an unusually large share.