(Bloomberg) — For most crypto investors, the theft of $6.3 billion from Binance was a reminder of the risks that still surround digital assets. For a small group of fast-moving trading firms and skilled investors, it was a chance to make a quick buck.
As apparent North Korean hackers rushed to convert funds stolen from the world’s biggest crypto exchange, they accepted punishing prices. That handed well-prepared traders a fleeting but lucrative opportunity. Bitquery, a blockchain data firm, estimates the attackers lost about $119 million through poor execution in their haste.
“The hack created sharp price volatility and a single, large, price-insensitive seller moving through thin liquidity,” said James Aitchison, chief investment officer at Caerus Global Management. That aggressive, one-way torrent distorted crypto prices across disparate venues and blockchains, he said, adding: “We traded the event and found several attractive dislocations.”
After gaining control of Binance funds on Oct. 29, the attackers focused on getting rid of the stablecoin portion of the haul, knowing issuers would soon begin freezing those stolen tokens. Within roughly half an hour, they began aggressively swapping stablecoins such as USDT into other cryptocurrencies like Ether, which can’t be frozen, buying the tokens wherever they could and jacking up the price.
Tether and Circle froze roughly $1.8 billion worth of their stablecoins about 40 minutes after the main Ethereum leg of the hack began, according to blockchain intelligence firm TRM Labs.
Binance, meanwhile, stopped withdrawals while it investigated the breach. That disrupted the usual flow of money between trading venues and allowed price gaps that normally disappear in seconds to remain open far longer.
Explainer: How Hackers Steal Crypto — and What They Do With It
Luca Parlamento, founder and chief investment officer of D2 Finance, said his firm spent the night “on the other side of the thief’s trades.”
Parlamento said the attackers paid an average of about $2,657 for Ether through decentralized exchanges such as Uniswap, well above the roughly $2,300 price on Hyperliquid, a crypto derivatives platform.
“The gap was ours to close,” Parlamento said.
For traders with funds already sitting on such venues, the basic trade was straightforward: sell Ether where the hackers’ frantic buying had pushed the price unusually high and buy it where the price remained lower.
Annanay Kapila, a former quant trader who runs derivatives exchange QFEX, was working in his central London office on Thursday night when he noticed that the price of Ether had skyrocketed on decentralized exchanges, reaching over $3,000 in some cases.
Kapila began to borrow large amounts of Ether on decentralized lending platform Aave, depositing stablecoins in return. He then sold his Ether on exchanges where its price was highest. Kapila said he made a 25% profit on the trades within five minutes.
Crypto’s lack of persistent volatility in recent years means this kind of window is increasingly uncommon, Kapila said, with the last such event being when prices collapsed in October 2025.
“Crypto’s been a little bit dead this year. Anytime there’s big dislocation, there’s big opportunities,” Kapila said. “I’ve been around since 2021 where this was almost a weekly occurrence, stuff like this. But nowadays it’s relatively rare.”
The scale of the price gap showed the extent to which crypto’s typical market structure had been weakened. Achieving a fair price usually depends on traders being able to move coins quickly from one venue to another. Binance’s suspension of withdrawals also didn’t help, with locked funds preventing more traders from cashing in on the opportunity.
The dislocations spread quickly to other tokens.
One of the largest appeared on Tron, another blockchain network. Aitchison said the attackers swapped about $234 million of USDT for 638 million TRX, Tron’s native token, in 16 trades. The average purchase price on a small venue called SunSwap was about 36.7 cents, compared with a wider market price near 33 cents.
The buying briefly pushed the main trading pool as much as 18% above the broader market, and the gap took roughly 10 hours to fully disappear, he said.
Elsewhere, the attackers dumped $48 million of RLUSD, a dollar-backed stablecoin issued by Ripple, so abruptly into a shallow pool of buyers that its price momentarily plunged to 81 cents, before snapping back to parity minutes later.
Seizing these price discrepancies triggered an all-out electronic turf war. Firms deployed high-speed algorithms to race each other. Because blockchain networks process transactions based on who pays the highest processing fee, trading bots engaged in bidding wars that sent fees soaring.
Of the estimated $119 million the attackers lost through poor execution, about half was captured by traders and arbitrage bots, according to Bitquery. Operators who help assemble and approve Ethereum transactions received another $29.5 million as bots competed to have their trades processed first.
Not every firm chose to jump in. Rajiv Sawhney, head of international portfolio management at Waves Digital Assets, said his team monitored the price differences but didn’t trade them. He said the biggest gains were available to firms that already had capital positioned in the right places.
Sawhney said the window was narrow: price gaps could close quickly, transaction costs had surged and some lending markets began restricting activity as the night wore on.
On Sunday, Binance began restoring withdrawals in phases. The exchange said it had worked with industry partners to freeze about $3 billion of affected assets and was using company funds to replace what was stolen.
North Korea has meanwhile denied it was responsible for the hack. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, said in a statement carried by state media that the claim is “absurd” and “a grave political provocation.”
(Updates with North Korea’s denial)
More stories like this are available on bloomberg.com
