Key Highlights:
- Bitcoin fell to an overnight low of $76,400—its weakest level since September 18—following a $6.3 billion security breach on Binance linked by analysts to North Korean hackers.
- Crypto futures liquidations surged fourfold to $1.57 billion as $3 billion of the stolen assets were frozen and Binance paused platform withdrawals.
- Broader markets added further pressure as tech stocks slumped, though spot Bitcoin ETFs had recorded $17 million in net inflows on Thursday before the breach occurred.
Binance Hit by Massive $6.3 Billion Exploit Tied to North Korean Hackers
The cryptocurrency market faced intense selling pressure after Binance, the world’s largest digital asset exchange, suffered an unprecedented $6.3 billion exploit. The breach, which blockchain analytics firms TRM Labs and Elliptic have linked to North Korea-associated threat actors, prompted Binance to temporarily pause all platform withdrawals. Law enforcement and security teams managed to freeze approximately $3 billion of the compromised funds, but the initial shockwave triggered severe turbulence across centralized and decentralized markets.
Bitcoin slipped to an overnight low of $76,400—marking its lowest valuation since September 18—before staging a modest rebound back to around $77,602.07. Ether dropped sharply to an intraday low of $2,170 before clawing back ground toward $2,220. The crypto downturn coincided with a broader risk-off session across traditional equity markets. Technology equities faced heavy losses, with Nasdaq-100 index futures tumbling 2.3% in the wake of Amazon’s increased capital spending forecast and a 25% plunge in Intel shares driven by weak corporate guidance. The selloff abruptly halted recent momentum, despite U.S. spot Bitcoin exchange-traded funds (ETFs) collecting $17 million on Thursday in their fourth consecutive day of net inflows, according to data from Farside Investors.
Derivatives Face $1.57 Billion Liquidation Shockwave
The fallout from the breach triggered cascading liquidations across the derivatives landscape. Crypto futures liquidations jumped fourfold to $1.57 billion as volatility accelerated. Total trading volume spiked 74% to $346.1 billion, while global open interest retreated 3% to $136.3 billion, demonstrating that a substantial contingent of traders opted to close open positions and extract capital from futures markets.
Bitcoin derivatives held relatively resilient compared to altcoins; while Bitcoin fell 3.1% over 24 hours, its open interest contracted by just 1.4%, signaling that some fresh capital entered during the drop. In contrast, Ether experienced a 4% price decline alongside a 5.8% drop in open interest, reflecting capital flight. Combined, Bitcoin and Ether accounted for more than half of the total market liquidations, racking up $522 million and $361 million, respectively.
Capital flight was pronounced across major altcoins, with Solana’s open interest declining 13.3% alongside a 3.3% price drop, and NEAR open interest falling 11.8% in its second straight day of declines. Funding rates across both assets flipped from positive to negative, indicating that short sellers began paying long holders as market sell orders dominated. Binance Coin (BNB) experienced the most severe decline among prominent assets, falling 6.2% as trading volumes more than tripled, even while open interest held flat in dollar terms.
In contrast, Hyperliquid (HYPE) defied the overarching market drawdown, rallying 15% on an eightfold jump in volume and a 28% increase in open interest. LayerZero (ZRO) registered a 12% advance, leading the CoinDesk 100 benchmark. Options markets, meanwhile, adopted a distinctly defensive stance. The 25-delta skew climbed across all maturities for both Bitcoin and Ether, reflecting heightened demand for downside protection. Put contracts dominated open activity, led by the $74,000 Bitcoin put and the $2,000 Ether put set to expire on November 13.
On-Chain Swaps and DeFi Sector Reactions
On-chain tracking revealed aggressive asset-shuffling by the attacker across decentralized finance protocols. Lookonchain reported that Uniswap (UNI) and Aave (AAVE) had plunged roughly 11% on Thursday as the exploiter dumped various tokens in exchange for Ether. Following that wave, several tokens held and sold by the attacker staged sharp rebounds: Ethena (ENA) advanced 8.4%, Pepe (PEPE) gained 7.3%, Uniswap gained 4.6%, and Chainlink (LINK) rose 3.7%.
Aave subsequently recovered 4.5% alongside Arbitrum (ARB), though Aave moved quickly to freeze its lending markets across 16 different blockchain networks after the exploiter used stolen USDT to borrow roughly $44.6 million worth of Ether. Thorchain (RUNE) gained 6.2% as on-chain analyst ZachXBT and Elliptic detected that the attacker routed a portion of the illicit proceeds through the cross-chain protocol into the Ethereum network. Market sentiment indicators deteriorated quickly amid the crisis, with CoinMarketCap’s Fear and Greed index falling from 43 to 36, entering “fear” territory, while the Altcoin Season index slumped from 54 to 45.
Why This Matters
A multi-billion-dollar breach on the largest exchange in the digital asset ecosystem presents serious systemic challenges to industry infrastructure and liquidity. The attribution of the attack to North Korea-linked actors highlights ongoing national security concerns and state-sponsored cyber warfare targeting centralized cryptocurrency platforms. Furthermore, the rapid cross-chain movement through bridges and decentralized lending protocols such as Aave and Thorchain demonstrates the persistent vulnerability of interconnected web3 rails when large volumes of stolen capital are laundered in real time. The ability of authorities and exchanges to freeze roughly half of the stolen funds underscores growing coordination in incident response, but paused withdrawals and defensive options flows signal that institutions and traders remain braced for lingering aftershocks.
Frequently Asked Questions
How much money was stolen in the Binance breach, and how much has been recovered?
The total exploit amounted to $6.3 billion. Security teams and relevant authorities have managed to freeze approximately $3 billion of the stolen proceeds so far, while withdrawals on Binance remain temporarily paused.
Who carried out the Binance exploit?
Blockchain security and analytics firms TRM Labs and Elliptic have attributed the attack to hackers linked to North Korea.
How did decentralized finance (DeFi) protocols respond to the stolen funds?
After the exploiter deposited stolen USDT to borrow approximately $44.6 million in Ether, Aave froze its lending markets across 16 networks. Additionally, on-chain investigators including ZachXBT and Elliptic tracked the movement of the attacker’s funds as portions were routed into Ethereum via Thorchain.
