Binance hacked for $6.36bn

Binance, the world’s largest crypto exchange, were hacked for $6.36 billion last week. It's the biggest crypto theft on record, and probably the biggest theft in history, period.

It’s not often I cover a ‘pure’ crypto story, but when I saw it plastered on BBC News Television ahead of companies like… GOOGLE dropping 10%+ in the market, in their worst day, week and month ever, then I think it’s worthwhile getting into this.

These are market movements that would ordinarily shake the desk of a market news editor. An earthquake for most Bloomberg analysts and nauseating reading for most prosumer stock evangelists.

But instead, the Binance hack took attention away from perilous macro conditions.

Discussed in this edition of Sporting Crypto:

1) What happened to Binance? 🔓

2) Market reaction 📉

3) Crypto and Finance in 2026 📝

Haven’t already subscribed? Join 6000+ Leaders in Blockchain & Sports from brands like FIFA, NBA, Premier League, NHL, reading Sporting Crypto every week 👇️

What happened to Binance? 🔓

At 20:05 UTC on Thursday 29 October 2026, money started leaving Binance's hot wallets. Most of it was gone in about 20 minutes, across ten blockchains.

For the uninitiated, a hot wallet is connected to the internet, so an exchange can pay out withdrawals quickly. A cold wallet is kept offline, which makes it much harder to hack, but slower to move money out of. So typically, an exchange will keep most of their funds segregated in multiple cold-storage wallets, some with professional custodians and some in ‘hot’ wallets that require quick liquidity events or events of volatility.

Here's how it played out:

1) The attackers spent at least 36 hours getting ready to exploit Binance.

2) On the morning before the hack, they made three small withdrawals from Tornado Cash into the wallet they'd use for the job. For the uninitiated, Tornado Cash is a mixer. Lots of people deposit crypto; it all gets pooled together, and when you take some out, it's harder to trace where it originally came from. This was created in the first place by developers to protect themselves and make crypto transactions more private… but it is also commonly used by criminals to make illicit money harder to trace.

3) At 20:20 UTC, they pushed through 50 withdrawal approvals in one go. Money can't leave an exchange's wallets until a withdrawal is approved, and these 50 had all been signed in advance, ready to fire.

4) Three minutes later, the money moved. 167,464 ETH and 63 other crypto assets, including 1.6 billion USDT, went out in a single sweep.

How did they get the approvals?

Well, Binance first said a DevOps engineer's laptop was compromised, which gave the attacker access to the systems that submit withdrawals. Richard Teng, Binance's co-CEO, has since called it a “complex attack” involving a compromised laptop and malicious software designed to delete evidence. Binance haven't published a full post-mortem yet. But a single DevOps engineer’s laptop as an attack vector that compromises $6bn+ dollars… for an exchange with $140-150bn assets under management feels a bit far-fetched to me personally. I’m no cyber or crypto custody expert, but I find it hard to believe that this was the only attack vector, so the post-mortem analysis will be fascinating reading.

On Saturday, 31st October, the FBI said North Korea were behind it, naming TraderTraitor, the same state-backed unit the FBI blamed for the $1.5 billion Bybit hack in February 2025. That makes this one roughly four times bigger than the previous record.

For comparison, the biggest bank theft usually cited is the Central Bank of Iraq in March 2003, when around $1 billion in cash was taken from the vaults just before the US invasion.

This is, most certainly, an earth-shattering moment for crypto and cybersecurity in general.

So what happened to the money?

Here's the split by blockchain.

  1. Ethereum, about $3.79 billion, including 200,630 ETH, 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.

  2. Bitcoin, 18,270 BTC, about $1.47 billion.

  3. Tron, about $628 million, mostly USDT.

  4. XRP Ledger, about $296 million.

  5. Solana, about $96 million, and smaller amounts on Arbitrum, Optimism, Base, Avalanche and Polygon.

About $3.4 billion of the haul was in stablecoins. Stablecoins have an issuer, and an issuer can freeze them. Because they still custody the underlying asset pegged against it.

Tether froze 971.1 million USDT at 21:01 UTC, 37 minutes after the main sweep.

Circle froze 823 million USDC three minutes later.

Ripple froze RLUSD and World Liberty Financial froze USD1 within the next hour and a half, and Arbitrum's Security Council froze about $30 million of ETH and ARB just after midnight.

By 00:30 UTC on Friday, about $2.7 billion was frozen.

The attackers raced against these freezes. They sold about 325 million USDT to market makers for roughly 122,300 ETH at an implied $2,650 per ETH, when ETH was trading at around $2,300 to $2,350, which means paying more than 10% over the market price.

Another wallet deposited 60 million USDT on Aave, the lending app, and borrowed about 19,760 ETH against it. Presumably, with no intention of paying the loan back.

The attackers' wallets still hold more than 420,000 ETH and 18,270 BTC. That's around $2.4 billion that's now beyond the reach of any issuer, according to TRM Labs, the blockchain analytics firm.

Binance say users won't lose anything. Teng posted on X:

“We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%.”

The money has come from SAFU (Secure Asset Fund for Users), part of their futures insurance fund and their corporate treasury, about $6.34 billion in all, and withdrawals reopened on Sunday.

It’s certainly incredibly impressive that Binance were able to almost shrug this off, to some extent. Although I am sure there is a story to be told down the line regarding just how painful this is for the crypto exchange powerhouse.

Market Reaction 📉

Bitcoin fell 4.3% on Thursday, and Ethereum fell 4.6%.

On the same day, Alphabet fell 12.6% after their third quarter results, losing $475 billion of market value. That's the second biggest one-day loss for any US-listed company, behind Nvidia's $593 billion in January 2025. Amazon fell 4.2% in the day and dropped again after hours on their own results.

So whilst chaos ensued in crypto, the macro markets were also taking a hit. And almost, in some respects, shielded by the incredible eyewatering numbers at stake for Binance.

Bitcoin closed Sunday at around $78,000, about 4% below where it was before the hack.

This probably shows the maturity, more than weakness, in crypto markets.

The last time we saw something this big was probably FTX, who couldn’t account for $8bn of customer funds, four years ago this month.

That was devastating for the industry. Bitcoin fell from $20,603 on 7 November 2022 to $15,881 two days later, down 23%, and bottomed at $15,787 on 21 November 2022. Ethereum fell 30% over the same two days.

Of course, a full collapse of an exchange likely warrants more market pain, but in terms of pure money, it’s not far off.

And indeed, the headlines were at the time, morbid to say the least, celebrating the death of crypto.

FTX-era headlines from The Economist, The Times of India, Noahpinion, Daily Maverick, Paul Krugman in the Star Tribune and BusinessDay, November 2022

Source: The Economist, The Times of India, Noahpinion, Daily Maverick, Star Tribune, BusinessDay

And of course, they were all wrong. Every time crypto dies, it’s always long live crypto, etc. etc.

But, that’s not to say the industry hasn’t changed drastically since then.

Crypto and Finance in 2026 📝

Beyond this major incident, there is a lot going for the crypto industry. Sure, there is sanitisation beyond the euphoric speculation we saw during the period leading up to FTX’s demise, but it is still groundbreaking by nature. Alongside AI, it is one of two truly transformative technologies right now.

If you split crypto right now, very simply, into three ‘parts’

1) The price (the market itself)
2) Financial infrastructure
3) Consumer

The latter of those, consumer, is struggling badly. There are few breakout apps outside of prediction markets that themselves, in their own right, are going onshore and US-centric more and more. Stablecoin-linked cards and neobanks have been breakouts, however, and continue to grow. But in terms of consumer applications outside of payments, there are few and far between. The gaming, social and application era has ground to a halt.

But in finance, and financial infrastructure, there are some groundbreaking announcements that would have seemed unfathomable even a year ago.

Here are some major headlines in 2026 alone:

  • Robinhood launched a blockchain, Robinhood Chain, on 1 July 2026. It's built on Arbitrum, and it went live with tokenised stocks and onchain lending. Four months in, it holds about $1.08 billion in DeFi (decentralised finance) deposits, according to DefiLlama, more than double the $473 million it had in August 2026, when it also hit a record 11.6 million daily transactions.

  • ICE, the owner of the New York Stock Exchange, invested in trade[XYZ] to bring Hyperliquid perpetual futures to US traders, on 29 October 2026, the same day as the Binance hack (more below).

  • The DTCC switched on their tokenisation service for US stocks, ETFs and Treasuries on 28 October 2026 (more below).

  • Mastercard acquired BVNK, the stablecoin payments company, for up to $1.8 billion. The deal was agreed in March 2026, and finalised in August 2026.

  • Visa's stablecoin settlement passed a $25 billion annualised run rate, about 10x YoY.

Crypto assets themselves might not be in a bull market, but their institutional utility is becoming one. And in such crypto fashion, ICE announced a deal with trade[XYZ] on the same day as the Binance hack, as mentioned above.

On Thursday, ICE (Intercontinental Exchange), the owner of the New York Stock Exchange, announced a strategic investment in trade[XYZ], to bring perpetual futures on Hyperliquid to US traders. The size of the investment wasn't disclosed.

For the uninitiated, a perpetual future, or perp, lets you bet on the price of something going up or down without ever owning it, and unlike a normal futures contract, it never expires. You can trade it any time of day, any day of the week, usually with leverage.

Hyperliquid is a crypto exchange that runs on its own blockchain. Through a feature called HIP-3, outside teams can launch their own markets on top of it. trade[XYZ] is one of those teams, and their markets cover stocks, indices and commodities as well as crypto.

trade[XYZ] say their Hyperliquid markets have passed $650 billion in volume in just over a year. None of that has been open to Americans, thus far.

Under the deal, Hyperliquid supplies the technology, trade[XYZ] design the markets, and ICE operate the regulated exchange and clearing. It still needs sign-off from US regulators before it goes live.

Jeffrey Sprecher, ICE's CEO, said “We intend to find retail traders where they want to be, through the partners, brokers, and platforms they already use.” And “We see these perp markets as additive to our futures markets, not a replacement for them.”

Stan Druckenmiller, the billionaire investor, posted that he'd invested in trade[XYZ] too. And HYPE, Hyperliquid's token, closed the day up 10.5%. It was his first and only ever tweet, which was also a quirk in the announcement.

A day earlier, on Wednesday, the DTCC (Depository Trust & Clearing Corporation) launched their own tokenisation service.

The DTCC sit underneath the US stock market. When you buy a share through your broker, it's the DTCC that clears the trade and makes sure the share and the cash end up in the right places. Their subsidiary, the Depository Trust Company, holds $114 trillion of securities in custody.

The new service turns those holdings into tokens and sends them to a digital wallet, and it can convert them back again. The SEC's (Securities and Exchange Commission) sign-off covers stocks in the Russell 1000, the ETFs (exchange-traded funds) that track the major indices, and US Treasuries. It runs on the Canton Network and on DTCC's own private blockchain.

Twenty firms have signed up to use it, including J.P. Morgan, Bank of America, Citi, Morgan Stanley, Fidelity, Citadel Securities, State Street and UBS.

Frank La Salla, DTCC's CEO, said “Today marks the culmination of years of work to bring tokenized securities into a regulated framework.”

All this to say: It just shows you that this is an industry that is still pretty transformative.

We're going to have 24/7 money, aka stablecoins and crypto assets, and now 24/7 assets onchain, and that is all because of blockchains. And many of those blockchains are underpinned by crypto assets. So before we sing ‘crypto is dead’ for the 1000th time, let’s remember that.

It won't happen overnight, and there are a lot of things to work out here. But the entire financial industry is being rewired by this technology.

We will not have bank holidays in the future. And that might not be the ‘utopian’ outcome that crypto evangelists of yesteryear had hoped for as the culmination of an industry, but it is a damn big mark on the world.

Thanks for reading the latest edition of the Sporting Crypto newsletter!

If you enjoyed this, please tell your friends who might be interested and share it on socials.

Disclaimers
This newsletter is for informational purposes only and is not financial, business or legal advice. These are the author’s thoughts & opinions and do not represent the opinions of any other person, business, entity or sponsor. Any companies or projects mentioned are for illustrative purposes unless specified.
The contents of this newsletter should not be used in any public or private domain without the express permission of the author.
The contents of this newsletter should not be used for any commercial activity, for example - research report, consultancy activity, or paywalled article without the express permission of the author.
Please note, the services and products advertised by our sponsors (by use of terminology such as but not limited to; supported by, sponsored by or brought to you by) in this newsletter carry inherent risks and should not be regarded as completely safe or risk-free. Third-party entities provide these services and products, and we do not control, endorse, or guarantee the accuracy, efficacy, or safety of their offerings.
It's crucial to provide our readers with clear information regarding the inherent nature of services and products that might be covered in this newsletter, including those advertised by our sponsors from time to time. When you buy cryptoassets (including NFTs) your capital is at risk. Risks associated with cryptoassets include price volatility, loss of capital (the value of your cryptoassets could drop to zero), complexity, lack of regulation and lack of protection. Most service providers operating in the cryptoasset industry do not currently operate in a regulated industry. Therefore, please be aware that when you buy cryptoassets, you are not protected under financial compensation schemes and protections typically afforded to investors when dealing with regulated and authorised entities to operate as financial services firm.