| Coin | Hacked | Hacker sold | Program buys | Excess net spot | On-chain deliveries | Live Binance CVD | Clip rate now |
|---|
Percentages are of the amount hacked. The three server-side estimates refresh every 5 to 10 minutes; the live column refreshes every minute straight from Binance. Click a row for the detail.
| Venue | Net taker | Buy share | Volume |
|---|
| Coin | Hacked | Hacker sold | Excess net spot | Live Binance CVD | On-chain deliveries | Price vs t0 |
|---|
| Time (SGT) | Coin | Units | USD | From | Type | Tx |
|---|
Program buys (the print). Every Binance spot trade since the drain is pulled from the public aggTrades feed and rebuilt into taker orders (trades sharing a millisecond and a side). Orders are bucketed by notional on a log scale (5% steps from $500 to $5M), so each coin's own order-size distribution decides where its program shows up: a $2k clip on UNI and a $40k clip on ETH are found by the same rule. A bucket where the market has bought far more often than it has sold (z ≥ 3, at least 20 excess orders) is a program bucket. Program volume per 10 minutes is the signed count difference in those buckets times the average buy size, so ordinary two-sided flow cancels. Control: the same rule on the 24 hours before the drain is each coin's noise floor (UNI 1%, LINK 0.5%, WLD 11% of hacked). The headline program number is the raw program minus that floor scaled to the elapsed hours; raw and floor are shown beside it, and the floor is pending for coins whose pre-hack tape is still loading.
Excess net spot buying. Velo's 1-minute taker buy and sell volume on Binance, Bybit, OKX and Coinbase spot, summed, minus what the coin's own 30-day history says is normal for that many hours (median hourly net flow). Positive means the market as a whole is net lifting offers; it is not attributed to Binance.
On-chain deliveries. Arkham transfers of at least $100k arriving in Binance hot or cold wallets, classified by sender: market makers and OTC desks, other exchanges, or DEX and bridge contracts (Binance's own on-chain swaps). User deposit sweeps are shown separately and never counted. A 7-day pre-hack window gives the normal daily rate.
Live Binance CVD. Your browser pulls Binance spot klines since the drain and sums taker-buy minus taker-sell base volume. Raw, not baseline-adjusted, so it includes the hacker-related selling of the first hours.
What none of this sees. Binance can refill user balances by buying on its own book, which leaves no on-chain trace; an OTC fill settled off-exchange leaves no tape trace either. A passive buyer (resting bids) shows up as taker selling, not buying. Treat every column except on-chain deliveries as a footprint estimate, and on-chain deliveries as a floor.
Data: Binance public API, Velo, Arkham. Server-side layers run on the research box and are served from a read-only endpoint; nothing here places orders. Hacked amounts from the Arkham stolen-asset ledger (snapshot 30 Oct 04:15 UTC); XRP from the XRP Ledger directly.