Written by: immrape
Compiled by: AididiaoJP, Foresight News
This article describes statistical patterns in the behavior of public accounts. The "camp" affiliations mentioned in the text are based on ecological affinity signals visible in the accounts' public content and interaction patterns; they are inferences and do not constitute an accusation that any institution or individual hired or directed others. "Coordination" here is a behavioral science concept, not a legal finding of collusion. This article does not relay content containing insults or personal attacks; any institution or individual named or involved in the text may respond to the data and inferences.
Key Findings
- Scale: Within approximately 78 hours of the incident, 1,083 sample accounts posted 11,700 hostile tweets targeting Binance, totaling approximately 20.93 million impressions. Of these, 79.6% were not independent posts but replies attached to others' posts; another 3,354 were verified one by one as false information and classified into 15 rumor types.
- Rhythm: The hostile content was not emotional venting that naturally decayed after the incident. It switched themes in step with each of Binance's public actions: after compensation was promised, the topic shifted to "insiders"; after the scale of impact and preliminary investigation were disclosed, it shifted to "insolvency" and "amateur operation"; after the withdrawal timetable was announced, it shifted to "bank run mobilization"; after withdrawals resumed, it shifted to "outflows are exaggerated" and "diverting traffic to competitors."
- Coordination: Among the 641 most active accounts, 452 had observable coordination relationships with other accounts, totaling 1,186 pairwise links. 444 accounts formed a connected network, automatically clustered into 11 groups, with clear differences in language, topics, and coordination style—presenting several relatively independent "camps."
- Dormancy–activation: 964 accounts (89%) almost never mentioned Binance normally, averaging no more than 0.2 posts per day, yet were collectively activated during the incident, with posting frequency 24.6 times the baseline. Of these, 116 had also appeared in two previous Binance-related controversies.
- Purpose: False information concentrated in three categories: denying the authenticity of the incident (staged/insiders), denying solvency (insolvent/second FTX), and denying withdrawal availability (afraid to open withdrawals/collapse as soon as they open). All three point to the same behavioral outcome: urging users to withdraw their coins at the moment they most need to stay calm.
- The other side: The data also shows that reach was mainly driven by a few top accounts: accounts with more than 50,000 followers posted only 6.2% of negative tweets but accounted for 68.0% of impressions; the 134 accounts with the highest scores under troll rules together accounted for only 0.6% of impressions. Focusing only on small accounts would underestimate this operation, and treating all critics as trolls would be equally wrong.
CZ and He Yi have said many times that Binance has suffered organized reputational attacks. The industry's usual reaction is to scoff—every exchange that gets into trouble seems to say this. The starting point of this article is not to defend anyone, but to answer a question that data can test: after Binance was hacked, were those voices on X that talked it down, questioned it, or even insulted it a natural outpouring of retail sentiment, or was someone organizing, dividing labor, and directing them? The answer from the review is: alongside a real security incident, there was indeed an observable social media narrative operation running in parallel, with rhythm and division of labor. Its target was not only Binance, but also every ordinary user who opened X in those days wanting to know whether their assets were safe.
I. The Incident: What Binance Did in 78 Hours
In the early hours of October 30, 2026, a Binance hot wallet was attacked, involving approximately $6.3 billion in assets, the largest security incident in the crypto industry's history measured in U.S. dollars. The table below lists the main public response milestones in the following 78 hours, all in UTC+8, and has been checked one by one against the timestamps embedded in tweet IDs.
Binance's main response timeline (UTC+8)
The timeline itself is not complicated: confirm, stop the bleeding, backstop, replenish, verify, recover. Any financial institution's crisis response consists of this standard set of actions. But when the contemporaneous discussion about Binance on X is overlaid on this timeline, the picture becomes completely different.
Volume of attacks against Binance's response measures (by hour). Dashed lines mark Binance's milestone events; bars show the number of malicious tweets per hour, with false information shown in red.
Key events of the attacking side (top image; dot size represents impressions) and Binance's response measures (bottom image), presented segment by segment. The top image focuses on the first 20 hours after the incident; the bottom image covers the remaining time.
II. Method: How to Define "Attack" and How to Exclude Criticism
First, let us be clear about what this article does not study. After the incident, a large number of users expressed concern on social media, asked about progress, criticized the speed of response, and described their experiences of withdrawals being stuck. This is normal, even healthy. When a platform custodian of hundreds of millions of users' assets has an accident, panic and questioning are entirely reasonable.
The analysis deliberately excludes four types of content: normal panic and concern about funds in the early stage of the incident; reasonable follow-up questions, such as when proof of reserves will be published and why withdrawals of a certain token have not yet opened, without malicious conclusions; factual reporting and on-chain data; and genuine dissatisfaction from real users.
The data in this article was collected by the author in the three days after the incident. With the help of AI tools, a batch scan was conducted of accounts participating in Binance-related discussions on X during the incident. As long as at least one of the following verifiable conditions was met, the account was included in the sample: repeatedly posting falsifiable false information; insulting, threatening, or personally attacking individuals; concentrated, repeated posting of homogeneous hostile content under multiple unrelated posts; and showing stable coordination with other accounts in the sample. For each sample account, the basis for inclusion and the original link were retained, resulting in a final sample of 1,083 accounts.
On this basis, all Binance-related original posts and replies published by these accounts during the incident (from 05:00 on October 30 to 20:00 on November 2) were collected. After excluding pure retweets, 11,700 tweets from 1,083 accounts were obtained, totaling 20.93 million impressions. Of these, 3,354 were judged one by one to be false and classified into 15 rumor types.
Regarding coordination, six observable signals were calculated for each pair of accounts: whether they appeared in the comment section of the same post; whether they @ed or replied to each other; whether they followed each other; whether there was one-way following; whether they interacted with the same third account within a short window; and whether they posted nearly identical content. A single signal may be coincidence, but when multiple signals repeatedly stack for the same pair of accounts, coincidence becomes difficult to explain. The coordination network section focuses on the 641 most active accounts during the incident, with an observation window from 20:00 on October 30 to 20:00 on November 2.
It should be noted: this article can only observe public behavior and cannot and does not attempt to determine the real identity or funding sources of any account.
III. Rhythm: Attacks Follow Responses, Not Emotions
If the negative noise on social media were merely users venting, it should be a relatively simple curve: a sharp spike after the incident, then a slow decline as information becomes clearer. But the data shows that the themes of hostile content kept switching, and each switch closely followed a public action by Binance—sometimes even running ahead of it.
Number of posts per hour by hostile accounts on the first day (solid line) and the proportion of disinformation (dashed line)
The First Few Hours: Panic Dominates, Conspiracy Theories Are Scattered
After the incident in the early hours of October 30, discussion on the platform exploded, with the main tone being panic and curiosity: Is the money still there, who did it, and how big is it. Among the sample accounts, claims of "self-staged" and "insider" appeared within an hour after the news broke, but most were scattered, tentative questions, with a typical phrasing being "Could this be an insider?" At this stage, disinformation accounted for about 30% of the sample output, with the rest mostly emotional expression and forwarded information.
There were only a few identifiable nodes in the early period: at 05:06, an account relayed that "Tether froze 971 million, Binance has not yet issued a statement"—the attack point was not the amount, but the silence; at 05:13, a post saying "Can't withdraw money, it's over" received 181 comments, the most among negative posts. This was more like an alarm in an information vacuum than a systematic narrative.
After the Compensation Promise: Conspiracy Theories Take the Stage
At 08:13, Binance announced it would bear all losses. By common sense, this should most have let anxious users breathe a sigh of relief. But in the data, the "self-staged / insider / accomplice" narrative entered its densest phase precisely after this node, reaching 9.3 posts per hour in the subsequent "loss estimation and preliminary investigation" stage, the highest for this narrative across its entire cycle.
The turning point was around 10 a.m. that day. At 10:11, a Chinese-language account posted that "Binance submitted 50 7702 authorizations on the 14th, one took effect, very likely with insider cooperation," which received 342,000 impressions, making it the most widely spread and most misleading post of this stage, 14 minutes earlier than Binance's disclosure of the attack path at 10:25. The logic of this narrative deserves to be unpacked separately: if Binance is willing to compensate, then the money was originally theirs; if the hacker did not take BNB, then it was an insider; if the freeze came so quickly, then there was preparation in advance. Every fact that should have proven an effective response was reinterpreted as evidence of a crime. This is an unfalsifiable narrative—any rebuttal can be stuffed into the framework of "overreaction."
After the Impact Scale and Preliminary Investigation Were Released: "About to Collapse" and "Amateur Operation"
At 10:25, Binance disclosed an impact scale of about 6.3 billion USD and the preliminary investigation. After that, narratives of "run away," "collapse," "insolvency," and "the next FTX" expanded rapidly, reaching an average of 6.9 posts per hour in the subsequent "recapitalization begins" stage (from 11:00 on October 30 to 14:30 on October 31). This narrative totaled 465 posts, from 219 accounts, with about 3.17 million impressions, making it the single narrative with the highest exposure in this event.
It is worth noting the relationship between this narrative and the suspension of withdrawals. Suspending withdrawals before a security incident is fully investigated is standard practice to prevent the spread of losses; hastily restoring withdrawals before the attack path is completely blocked could invite a second attack. But in the attack narrative, suspending withdrawals was uniformly read as "out of money" or "afraid to open," and was used as leverage to demand that Binance "open withdrawals immediately."
The preliminary investigation mentioned that "a DevOps engineer's laptop may have been compromised." Just three minutes later, at 10:28, rebuttals appeared: "Can one laptop drain 6.3 billion?" The "weak technology" and "amateur operation" narrative reached 4.2 posts per hour at this stage, two to four times that of other stages. Some high-exposure content reprocessed the investigation conclusions—turning "may involve" into a definitive conclusion, or extrapolating unverified claims such as "more than one wallet was compromised" and "BTC was also lost," with single posts exceeding 100,000 impressions.
On the evening of November 1, a rumor began circulating in Chinese- and English-language communities: a Binance operations engineer had a romantic entanglement with a North Korean female spy and left his laptop aside on the day of the incident. The author searched X for related posts since October 30: the earliest traceable version appeared at 21:22 on November 1, posted by an English news aggregation account with about 7,000 followers in the form of an all-caps news flash, claiming the information came from on-chain detective ZachXBT. The post received about 634,000 views, 4,458 likes, 258 reposts, and 367 replies. About 1.5 hours later, an English KOL with about 700,000 followers reposted it under the title "Binance hack may involve an insider," with about 63,000 views. The Chinese version appeared around 21:49, followed by a large number of translated versions with almost identical wording, most beginning with "New, unconfirmed allegations claim..."
Around 1 a.m. on November 2, He Yi publicly responded: "This story is more dramatic, but it is not true, and ZachXBT did not say it either." The English news flash reposting the denial received about 69,000 views. But after the denial, the spread in the Chinese community did not stop. On the morning of November 2, a Chinese account with about 96,000 followers continued posting, beginning with "The largest financial theft in history, the most absurd link may not be code, but a romance," with about 12,000 views and 42 replies; another account with about 90,000 followers posted under the title "The spy drama of a North Korean female spy 'seducing' a Binance engineer," with about 7,600 views; a core account in Cluster 1 of the coordinated network also posted at 08:43 claiming "Rumor has it that a DevOps engineer fell in love with a North Korean female spy," with about 3,000 views, only appending He Yi's denial at the end. Some Chinese users also noticed the anomaly, posting that "Lately I keep seeing identical posts... all AI-generated filler content, repeatedly posted with changes."
To be fair: the originating account of this rumor is not within the sample. According to the sample criteria, related content was about 68 posts with about 230,000 impressions, and sample accounts participated to a limited extent. It is listed here because it reinforced the "weak technology" narrative—the former gave the latter a more spreadable story shell.
After the Timeline Was Announced: The Waiting Period Was Rewritten as "Delay"
At 23:23 on October 30, He Yi released a video giving a 42-hour recovery timeline; at 12:48 on November 1, Binance announced the first-phase withdrawal restoration time. In a normal information environment, this was the moment users should most have breathed a sigh of relief. The attacking side pushed two lines at the same time.
One line rewrote waiting as delay and portrayed the backstop as fraud. One of the main sources of the English "self-staged" narrative posted at 12:26 on October 31 that "Binance faked a multi-billion-dollar hack in order to evade customer liabilities," receiving 279,000 impressions; the "insider" narrative also gained a new reading: announcing the withdrawal time was merely a "delay tactic" to "make it more convenient to transfer assets." The other line called for "run as soon as the door opens": as early as 22:38 on October 30, an account that had 36 reply interactions with another attacking account within three days posted in all caps, "The moment Binance restores withdrawals, immediately transfer your funds out"—nearly 40 hours before withdrawals actually resumed; at 20:22 on October 31, another account wrote, "Suppose Binance opens withdrawals... it will close again soon, triggering a vicious cycle and a bank run, and directly collapse!" It did not state facts, but laid emotional tracks in advance so that readers would automatically slide into them when withdrawals opened.
When Withdrawals Resumed: Bank-Run Mobilization Peaked
Mobilization content—"leave now," "withdraw in the first minute you can," "bank run"—surged to 11.2 posts per hour in the "phased restoration" stage (from 14:00 to 16:12 on November 1), more than four times the average of the previous four stages, and also the highest single-stage intensity among all narratives in this event. Two narratives cooperated here: one created the urgency of "must leave immediately," and the other explained "why official statements are not credible."
Narrative rotation: number of hostile tweets per hour at each stage. Each row represents a narrative type; the darker the color, the closer that narrative is to its peak at that stage, and different narratives peak at different stages.
After Withdrawals Resumed: Exaggerating Outflows, Diverting Traffic to Competitors
After withdrawals resumed, the focus of hostile content shifted to outflow data. At 02:02 on November 2, CZ disclosed that net outflows in the 12 hours after withdrawal restoration were 2.1%. Just six minutes later, at 02:08, a high-frequency English account posted that "Binance is experiencing its highest net outflow in history today, -4.25 billion USD," then posted a Chinese version: "In the past 12 hours... net outflow reached a record 4.36 billion USD," accompanied by the analogy "It took FTX less than 48 hours to go from normal to collapse," and at 07:19 added that "it has exceeded the net outflow before FTX's collapse," with a single post receiving 193,000 impressions; at 12:23 that day, the figure was updated to "6.1 billion USD," along with the claim that "531 of 552 tokens still cannot be withdrawn."
The two sets of data do not necessarily conflict numerically; an absolute outflow of several billion USD and a 2.1% share may be talking about the same thing. The difference lies in the framing: the former removes the denominator, grafts on the FTX analogy, and packages an ordinary withdrawal peak as the eve of a collapse.
At the same stage, content diverting traffic to competitors increased: while discussing the hack, users were advised to "first transfer to such-and-such exchange to avoid the risk," or told that "among all exchanges, only such-and-such has never been hacked." Such content was not large in quantity (31 posts), but individual posts had high dissemination efficiency, totaling nearly 200,000 impressions. A typical sample: on November 1 at 14:37, 17 minutes after BTC withdrawals resumed, a Chinese KOL posted "An A9 friend said he will never put coins on Binance again, even if the annualized rate is above 6%... North Korea opened Binance's Pandora's box," which received 108,000 impressions; the core message was "without sovereign backing, it's safer to put funds elsewhere." Similar wording also appeared in the English community, such as "If Binance falls, will Hyperliquid become the industry-leading exchange?"
Compensation rumors: creating a sense of "being treated differently"
On the evening of November 1, a batch of false claims about "$150 withdrawal compensation" began to appear, with the template sentence "Withdrawals suspended, free compensation of $150, check the rewards center." Of the 35 related posts, 27 were concentrated within the six hours from 19:00 on November 1 to 01:00 on November 2, with 9 in the single hour of 20:00; five accounts posted identical wording, one of which had only two followers. At 21:11, Binance replied under the original post: "This is false information; the screenshot has been digitally altered."
A fake "$150 withdrawal compensation" advertisement: five accounts posted identical content within six hours, including phishing links directing users to a "rewards center."
As for claims like "cash rewards for not withdrawing" or "exclusive to users in specific regions," these appeared only sporadically in the sample and had not yet reached a measurable scale, so this article does not draw quantitative conclusions about them. However, the structure of such claims is consistent with the above narratives: they do not directly attack the platform but create a sense of users "being treated differently," while further prompting withdrawals. Binance has clearly stated that it has never offered rewards to users in any region on the condition of not withdrawing.
Several undercurrents running throughout
- Politicization: claims such as "Binance's protective umbrella is Trump" and "they paid protection money" totaled 377 posts, peaking during the recovery stage.
- Raking up old scores: linking this incident to the severe market volatility in 2025, claiming the hack was to "whitewash old accounts"—280 posts, 690,000 impressions, most concentrated in the first two stages after the incident.
- Market manipulation: "artificial bull market," "the market fell because Binance dumped," "they rewrote the K-line"—253 posts from 148 accounts. On November 1 at 13:32, an account was already asking, "If Binance survives this run, will it proactively push an artificial bull market?"
- Pre-set narratives: before Binance took any action, accounts preemptively claimed it "will definitely push high-yield products next" and "will definitely pump and list coins," and pre-labeled these actions as "evidence of insolvency." On November 2 at 20:25, Binance launched a user reward program with up to 10% annualized yield—a standard post-crisis industry move—which landed exactly within the preset interpretive framework. Whether Binance acted or not, its position was already unfavorable.
IV. Rumor classification: which claims spread farthest
The 3,354 posts judged false were grouped into 15 categories by core claim. Sorted by cumulative impressions, the main types are as follows.
Cumulative impressions, post counts, and account counts for various types of false information
]
Main rumor types
Several details are worth noting. First, the "technical fake proof" category was not large in quantity, but individual posts spread farthest—averaging about 6,800 impressions per post, nearly four times that of the "self-staged" category. Such content usually appeared as long posts, citing real terminology (7702 authorization, multisig, hot wallet numbering) and drawing erroneous conclusions under the shell of technical detail; for example, "BTC uses ECDSA, Solana uses Ed25519, a laptop cannot sign ten chains in 20 minutes." For readers without a technical background, it is more persuasive than purely emotional accusations.
Second, "false information impersonating Binance" had only 5 posts but received nearly 300,000 impressions. Such content forged official compensation plans or coin listing announcements, often accompanied by phishing links, and may be the most directly harmful to users of all types.
Third, these narratives contradict each other. The same batch of accounts said both that "Binance staged it itself" (meaning the money was not really lost) and that "Binance is insolvent" (meaning the money was really lost and cannot be compensated); they said both that "Binance dare not open withdrawals" and, once withdrawals opened, that "opening withdrawals is to transfer assets." In factual discussion, these claims cannot all hold at the same time; in a narrative aimed at creating uncertainty, they do not need to be self-consistent—each only needs to complete its own task at a different moment.
V. Coordination: one network, several camps
If these contents came from unrelated individuals, the relationships among accounts should be sparse and random. The data show another structure. Among the 641 most active accounts, 452 had a coordination relationship with at least one other account, totaling 1,186 pairwise coordination links. Broken down by signal type: 651 mutual @ or replies; 466 appearing simultaneously in the same comment section; 267 interacting with the same third account within a short window; 224 one-way follows; 143 mutual follows; 67 near-identical contents. Of these links, 608 carried two or more signals at the same time.
The 444 accounts formed a connected network—starting from any one account, one could reach the other 443 along coordination relationships.
The coordination network of attacking accounts (largest connected component). The larger the dot, the more coordination links the account has; color markers represent different coordination scopes.
The tightest account pairs best illustrate what "coordination" means: the highest-weighted pair @-mentioned or replied to each other 36 times within three days; another pair appeared together in five identical comment sections, interacted five times, and posted nearly identical content eight times; and two other accounts had two records of "100% identical content." The network's central nodes are equally telling: the most-connected account was linked to 63 accounts, posted 29 hostile tweets, and received 741,000 impressions; another account posted only 7 times in three days yet received 742,000 impressions and was linked to 41 accounts. By contrast, two "spam accounts" each posted over 120 times, each received fewer than a thousand impressions, yet were the densest connection points in the comment sections. The former set the tone, the latter supplied the volume—this division of labor is itself a trace of organization.
Network details: the most-connected core node (center) and its 63 associated accounts. Red lines indicate coordinated connections with the core node; gray lines indicate connections among associated accounts.
Running unsupervised community detection on this network (the algorithm looks only at relational structure and does not reference any manual labels) yields 11 clusters. The top five differ markedly in size, language, and coordination style.
The top five coordinated clusters
Cluster 3 deserves particular attention. 66 accounts posted 1,135 posts over three days, an average of 17 per person, yet total impressions were only about 170,000—fewer than 2,600 per person. These accounts almost never post independently; instead they appear in batches in the comment sections of the same posts, most often under posts by Binance executives and core accounts. Their job is not to make more people see a certain viewpoint, but to make those who see the post feel that "everyone thinks this way."
Network details: Cluster 3 (the comment-thread cluster). Connections among members are mainly manifested as "appearing together in the same comment thread."
Two tactics in the comment sections
The first is "swarming to build momentum." When one account posts hostile content, the same batch of accounts floods the comment section within a short window, echoing, supplementing, and amplifying the accusations. To an ordinary user who casually opens the post, what they see is not one person's viewpoint but a screenful of unanimous voices. In multiple high-impression hostile posts reviewed in the sample, sample accounts accounted for 25% to 47% of comments, and these comments accounted for 22% to 44% of the post's impressions; under one post by a small account, 11 of the 12 commenters belonged to the sample.
The second is "siege and clearing the field." When a user posts in defense of Binance, or merely states official information objectively, the same batch of accounts enters the comment section and attacks the poster with labels such as "bootlicker," "Binance's dog," "how much were you paid," and "paid shill," without addressing the content. During the incident, 133 sample accounts posted 234 such posts, 79% of which were replies under others' posts. The logic resembles the isolation mechanism of school bullying: rather than attacking the target directly, it makes everyone who comes near the target pay a price. An ordinary user posts a single line, "I believe Binance can handle this," and gets dozens of personal attacks in return—next time he will most likely choose silence. This is the chilling effect: what it suppresses is not a viewpoint, but the willingness to express.
Attacks on individuals
During the incident, 421 posts were mainly personal attacks on Binance's founder and co-founder, from 103 accounts. A considerable portion targeted He Yi's pregnancy, using extremely insulting language, with single posts exceeding 100,000 impressions, some escalating to curses on the unborn child. This article does not relay these contents. It should be said that such content has nothing to do with the security incident; its existence shows only one thing—for some participants, the purpose was never to discuss the incident, but to attack people.
Camps
Based on ecosystem-affinity signals visible in accounts' public content (for example, long-term concentrated promotion of a certain platform, high-frequency interaction with that platform's employees, continuously directing traffic to competitors while attacking Binance), camp labels were assigned to some accounts. It must be emphasized once again: these labels describe tendencies in public content, not a determination of any employment relationship.
Accounts and views by camp label (1,083 accounts)
Two structural facts deserve attention. First, the highest per-capita impressions do not belong to the largest group: 69 accounts showing ecosystem-affinity characteristics of a certain derivatives platform averaged about 39,000 impressions each; 19 accounts suspected of being related to rights defenders averaged about 38,000; 107 accounts showing ecosystem-affinity characteristics of a certain exchange averaged about 25,000; while 874 unlabeled accounts averaged about 17,000. Second, "unlabeled" does not equal "isolated individual." They are unlabeled because no clear platform promotion or direct interaction with platform employees was observed in their public content, and out of caution they were kept as "independent"; but in the coordination network, many are in the same cluster as labeled accounts, sharing comment sections, interaction targets, and similar narrative rhythms. The author's inference is that some of them may be hired by third parties and engage in reputation attacks as a profession, but there is currently no direct evidence.
Among the 452 coordination-network accounts, the same standard allows a closer look: 63 are labeled OKX-affinity (including 33 suspected OKX), mostly Chinese-language, posting 343 hostile tweets and 917,000 impressions; 23 are labeled HyperLiquid-affinity, accounting for only 5.1% of the total but taking 14.3% of the impressions, with the highest average connectivity among all camps; 13 are suspected rights defenders, whose rhetoric is mainly personal attacks and old grievances; 4 accounts bear characteristics of a Chinese overseas political group (Guo Wengui's "New Federal State of China"), interpreting the incident as a political conspiracy. Among the 346 independent accounts, 189 (54.6%) are directly connected to at least one camp account; there are 240 links between independent accounts and OKX-affinity accounts, far more than the 42 links within the OKX camp. The data point to this: several groups of accounts with different ecosystem-affinity characteristics densely participated in attacks against Binance within the same window, with cross-collaboration among them; but the data cannot prove that OKX, HyperLiquid, or any institution knew about, organized, or funded these activities. The industry previously suspected that Bitget-related accounts were involved; no corresponding camp accounts were found in this data.
Left chart: number of coordinated links counted by signal type (one link may carry multiple signals); right chart: number of links between camps (the diagonal represents intra-camp links).
What each camp wants is clearly different: some focus on "insolvency" and bank-run mobilization while promoting alternative platforms; some focus on "digging up old scores," using events to rehash earlier controversies; some center on politicized narratives. Intriguingly, an account labeled as OKX-affiliated publicly criticized a news account of a derivatives platform on October 31 for "seizing the opportunity to poach users... feeding on human blood and flesh"—these camps may not have a unified command center, but during these 78 hours, their actions overlapped heavily in time and reinforced each other in effect.
VI. Dormancy and Activation: Accounts That Only Wake Up When Attacking Binance
To test whether these accounts were merely "coincidentally especially active these few days," after completing sampling the author traced back all prior public posts of all 1,083 accounts and compared several time windows: two ordinary ten-day windows without major Binance controversies (June and August 2026), and two prior Binance-related controversy windows (the "Cathie Wood" controversy from January to February 2026 and the Iran-related allegations in March 2026).
Almost silent in normal times. In ordinary windows, these accounts together posted only about 131 Binance-related items per day; among them, 964 (89%) averaged no more than 0.2 items per day—most accounts would not mention Binance even once a week.
Collective activation during the event. During the event, these same accounts posted an average of 3,228 Binance-related items per day, 24.6 times the normal level. By the coordinated-network measure, among 452 accounts, 200 (44.2%) posted only one or two hostile tweets over three days, yet still had verifiable coordinated relationships with other accounts—"low frequency, high connectivity."
They had also activated during previous controversies. During the early 2026 "Cathie Wood" controversy, these same accounts posted an average of 480 Binance-related items per day, 3.7 times the normal level; 382 accounts posted during that window. Within that ten-day window, 72 posts had five or more sample accounts appearing simultaneously in their comment sections, whereas ordinary windows of equal length had only four.
Some accounts recur across events. 116 accounts posted Binance-related content in both the "Cathie Wood" and Iran rounds of events.
To be fair: in the March Iran-related allegations window, the overall posting intensity of these accounts (113 items per day on average) was comparable to the normal baseline, with no obvious overall activation; however, 133 accounts posted in that window, and simultaneous appearances in comment sections rose somewhat. This shows that "cross-event synchronized activation" is not a universal feature of the entire sample but is concentrated in a subset.
A typical example: an English-language account posted no Binance-related content in either ordinary window; during the "Cathie Wood" controversy it averaged about 6 items per day, with the theme "such-and-such coin hasn't been listed on Binance yet"; during this event it averaged more than 17 items per day. It does not discuss the market, does not discuss the industry, and only appears when Binance becomes a topic.
VII. What It Is Fighting For: A Social Engineering Operation
The core of social engineering is not technology but exploiting psychological weaknesses to achieve control. Piecing the above data together, the outline of this narrative operation emerges.
It does not create events; it parasitizes events. The security incident is real, users' concerns are real, and some criticism is also real. What the narrative operation does is graft conclusions onto real emotions: grafting "suspension of withdrawals" onto "out of money," grafting "bearing losses" onto "self-staged," grafting "withdrawal peak" onto "FTX collapse."
It switches topics following responses, sometimes running ahead. Each time Binance announces new progress and the old narrative loses force, a new narrative takes over within the same window: the insider theory appeared 14 minutes before the attack path was disclosed; the "one laptop" question appeared 3 minutes after the disclosure; "record net outflow" appeared 6 minutes after the "2.1% net outflow" announcement; competitor narratives appeared 17 minutes after withdrawals resumed; the "run as soon as the door opens" mobilization appeared nearly 40 hours before withdrawals actually resumed.
It blends in among real users. 79.6% of the content consists of replies rather than original posts, many under real users' posts. Bystanders find it hard to distinguish which comments are real users' concerns and which are organized voices. This confusion is itself one of the goals: it makes any response look like "suppressing users."
It has a clear division of labor. Accounts with fewer than 300 followers posted 44.1% of negative tweets but generated only 5.1% of impressions; accounts with more than 50,000 followers accounted for only 6.2% of posting volume but took 68.0% of impressions. Top accounts set the tone, while small accounts supply volume in comment sections, mount sieges, and set phishing hooks.
Share of negative posts and share of impressions (by author follower tier): small accounts bring "quantity," large accounts bring "reach."
It suppresses rather than debates. Personal attacks on supporters and insults against founders are not factual discussion but attempts to change who dares to speak. And all of this ultimately points to one behavioral outcome: getting as many users as possible to move their assets out in as short a time as possible. This is precisely the most dangerous thing for both the platform and users themselves during a security incident. If a bank run really formed, the harm would not be confined to one company; it would hit every ordinary user who sells off at low prices in panic or misses the window due to congestion.
This time, the bank run did not happen. Twelve hours after withdrawals resumed, 98% of users chose to stay. This is first of all a credit to users' judgment—at the moment of greatest information noise, most people chose to wait for official information, check on-chain data, and make their own judgments.
VIII. Limitations, Counterevidence, and Matters to Be Verified
First, coordination does not equal hiring. Appearing simultaneously in comment sections or replying to each other may also be genuine users with similar views naturally gathering; highly correlated account behavior does not directly mean payment or direction. Second, camp labels do not equal corporate direction. The OKX-affiliated, HyperLiquid-affiliated, and suspected rights-advocate labels in this article are classifications based on public behavior; there is no direct evidence that any institution officially participated in, planned, or funded the attack. Third, this article relies only on public data and cannot cover content from deleted or protected accounts; historical window retrieval is limited by keyword scope and may underestimate actual posting volume. Fourth, the coordinated-network observation window begins at 20:00 on October 30; relationship data for roughly the first 15 hours after the incident is missing, so coordination on the first day may be underestimated.
The data itself also provides facts unfavorable to the "army of water armies" narrative. The 134 suspected water-army accounts with the highest scores under verifiable rules account for 9% of the sample, and their hostile posts together received only about 18,000 impressions—0.6%; content identified as pure "water-army mass-posting" templates received only 5,419 impressions. Among the three rumor types with the highest impressions, suspected water-army accounts accounted for only 8.5% to 27.8%. Grand narratives are mainly driven by a small number of top accounts; water armies do more filling and phishing. In addition, suspected rights advocates have genuine grievances, and their participation is not necessarily an organizational product; many users speak based on real losses and real concerns, and their criticism should be strictly distinguished from the coordinated behavior discussed in this article.
Main arguments and strength of evidence
The institutions named or involved in this article (including OKX, HyperLiquid, and Bitget) and related individual accounts all have the right to respond to and clarify the data and inferences in this article; after receiving responses or contrary evidence, this article will be updated accordingly.
IX. Conclusion: When You See "Leave Now"
Back to the question at the beginning: Did Binance suffer an organized reputational attack? Using the public tweets from these 78 hours as a sample, the data's answer is: there exists a sizable attack network, highly interconnected internally, shifting gears in rhythm with Binance's responses; within it are several groups with different ecosystem-affinity characteristics and different targets, who may not take orders from the same command center, yet act separately within the same window and coordinate with each other in the comment sections. This network's "reach" comes mainly from a small number of top accounts; its "density" comes from a large number of small accounts that are usually silent, have few followers, yet are highly connected.
The data also counsels restraint. Coordination is a measurable fact; hiring and instigation are conclusions requiring more evidence. Criticism itself is not an attack, and most questioners are real users. What truly deserves vigilance is the kind of voice that shifts gears exactly at the peak of panic, appears in clusters exactly where supporters gather, and has its conclusion written exactly before the other side even speaks.
For exchanges, the lesson of this incident is: in crisis communication, only commitments and verifiable numbers can penetrate the noise—backstops, amounts, timelines, proof of reserves. Binance has stated it will continue to disclose information in verifiable form, publish a complete technical post-mortem after the investigation is complete, continue to report fake compensation announcements, fake listing announcements, and phishing links published under impersonation, and preserve evidence and refer content involving personal threats for legal assessment.
For every ordinary user, perhaps there is only one piece of advice: during a crisis, look at platform announcements and on-chain data. When you see a screenful of unanimous voices in the comment section, take one more look at what these accounts usually talk about; when you see astonishing numbers, ask what the denominator is; when you see "leave now, it's too late," ask who most wants you to make this decision at this very moment.
Appendix: Methodology
Observation scope: October 30, 2026, 05:00 to November 2, 20:00 (UTC+8); historical comparison windows (retrospective sampling of accounts' earlier public posts) were January 27 to February 5, March 10 to 14, June 1 to 10, and August 10 to 19, 2026. All times were cross-checked against the timestamps embedded in tweet IDs.
Sample: collected by the author within three days of the incident, using AI to scan accounts participating in discussions on X; 1,083 accounts meeting the criteria were included in the sample, with approximately 11,700 posts collected in total. Pure retweets were excluded, retaining original posts, replies, and quotes. The coordination network section focused on the 641 most active accounts (observation window October 30, 20:00 to November 2, 20:00).
Disinformation judgment: the core claim of each item was judged against official announcements, on-chain data, and authoritative third-party information, and classified into one of 15 categories; opinion statements that can neither be confirmed nor refuted were not counted as disinformation.
Narrative classification: based on keywords and semantic rules, a piece of content can belong to multiple narratives simultaneously; phase intensity was converted to posts per hour according to the duration of each phase.
Coordination: weighted summation of six types of signals between two accounts; clusters were identified using the Louvain modularity algorithm, without using any manual camp labels.
Suspected water-army scoring: scored according to rules such as fewer than 50 followers, following count more than three times follower count, fewer than 500 followers but more than 2,000 posts, recent registration, only posting replies, and repeatedly posting identical text; a total score of 4 or above was judged as suspected.
