Key Highlights:
- A massive flash liquidation wave forced the closure of roughly $628 million in leveraged crypto positions within a single hour, with $607 million consisting of long bets.
- Binance’s native token, BNB, absorbed the heaviest hit among top assets with a 6.1% drop, while Bitcoin lost its $80,000 support level as overall market cap fell to $2.65 trillion.
- Blockchain records show the attacker’s wallet was initiated with 0.1 ETH routed through Tornado Cash before draining Ether and stablecoins, leaving approximately 195,000 ETH unfreezable.
The global cryptocurrency market experienced a severe shock following an exploit targeting assets associated with Binance, triggering automated liquidations across major exchanges. Blockchain data verified on Etherscan indicates the perpetrator initially funded their operations using 0.1 ETH transferred via the privacy mixer Tornado Cash to obscure the transaction trail. As news of the incident spread, leading digital currencies posted immediate downward corrections, dragging the aggregate crypto market capitalization down to $2.65 trillion.
Market Selloff: BNB, Bitcoin, and Major Altcoins Plummet
Binance’s native utility token, BNB, bore the primary brunt of trader panic, tumbling 6.1% over a 24-hour window by 21:23 UTC according to CoinMarketCap metrics. While Bitcoin resisted the steepest declines seen in alternative tokens, it surrendered the $80,000 threshold that it held earlier in the afternoon, settling down 2.6%. Ethereum declined 3.6%, Solana dropped 5.3%, and XRP slipped 5.8%.
Bucking the dominant market slide were Hyperliquid (HYPE) and Tron (TRX). Hyperliquid surged 15% across 24 hours, benefiting directly from its status as a decentralized exchange operating on its dedicated blockchain, a profile that shielded users from centralized custody risks. Tron similarly advanced nearly 5% despite the broader market turbulence.
Leverage Unwind: $628 Million Liquidated in One Hour
The sharp downswing was predominantly driven by structural cascades in derivative markets rather than spot asset offloading alone. CoinGlass data cited by PANews revealed that approximately $628 million worth of derivative positions were automatically liquidated within a single hour. Long bets anticipating upside price action accounted for $607 million of that total volume.
Because margin platforms automatically liquidate collateralized positions when threshold margins are crossed—such as a 10% drop erasing a 10x leveraged trade or a 5% drop wiping out 20x leverage—the forced automated sales triggered consecutive waves of down-bids. This dynamic accelerated BNB’s decline despite the fact that no BNB was directly stolen during the underlying breach.
Why Did Solana and Unrelated Altcoins Slump?
Although the attacker strictly siphoned Ether, stablecoins, and Ethereum tokens, non-target assets like Solana endured deeper drawdowns than Bitcoin. This divergence stems from centralized market structure: the vast majority of digital tokens trade primarily against base pairs like Bitcoin, Ether, USDT, and USDC across Binance’s order books. When liquidity pools on these pairs fluctuate rapidly, prices across entire altcoin ecosystems shift concurrently.
Furthermore, Solana had already exhibited underlying structural weakness, slipping below $100 after spot Solana ETFs registered $24.8 million in net outflows across October 27 and 28. Heightened concerns surrounding centralized exchange processing speeds pushed market participants to de-risk holdings across interconnected trading pairs.
Why This Matters: Next Steps and Strategic Context
The broader implications of the security incident rest on immediate developments across Asian trading hubs—such as Tokyo, Seoul, and Hong Kong—where a substantial portion of retail and institutional crypto volume originates. Key determinants of market stabilization include:
- Exchange Official Communication: Binance has confirmed it is actively investigating the occurrence. If losses are fully absorbed through internal corporate balance sheets or the platform’s Secure Asset Fund for Users (SAFU), market confidence may rapidly stabilize, mirroring historical recoveries such as the Bybit incident in February 2025.
- Custodial Solvency & Outflows: Maintaining uninterrupted processing for standard customer withdrawals remains critical. DefiLlama records indicated roughly $144 billion in verifiable customer assets stationed across Binance cold and warm addresses at 21:15 UTC.
- Unfrozen Capital Disposition: While central issuers can blacklist illicit stablecoin reserves, approximately 195,000 ETH remain immune to smart contract freezes. If routed onto automated decentralized market makers, this supply could create persistent downward price pressure on Ether.
- Derivatives Expiry: Market volatility faces an additional near-term catalyst as Deribit’s monthly October options contract expires at 08:00 UTC on Friday, an event known to heighten price swings.
Frequently Asked Questions
Which cryptocurrencies were directly stolen in the incident?
Blockchain data confirms that the exploiter targeted Ether, stablecoins (USDT and USDC), and select Ethereum-based tokens. Native tokens such as BNB and external layer-1 assets like Solana were not directly taken from the affected reserves.
Why did Solana drop if it was not part of the exploited funds?
Solana dropped 5.3% primarily due to exchange-wide cross-pair trading mechanisms and pre-existing institutional weakness. Because Solana trades against Ether and stablecoin liquidity pairs, sudden disruptions on major venues like Binance trigger algorithmic sales across correlated assets, compounded by recent $24.8 million spot ETF outflows.
What should current exchange users consider right now?
Users are encouraged to verify that account withdrawals function normally, avoid utilizing leveraged positions during high-volatility liquidation events, and consider transferring significant balances to self-custodial hardware wallets.
