On Thursday evening at 20:05 UTC, funds began leaving Binance wallets. Around twenty minutes later, most of $6.36 billion had changed hands across ten blockchains. The world's largest exchange had just suffered the biggest theft in crypto history—and reminded traders of a risk no stop can cover: the platform itself.
In brief
- $6.36 billion left Binance wallets on October 29, according to TRM Labs, which attributed the attack to North Korea. That's roughly four times the size of the Bybit hack ($1.5 billion, February 2025).
- Bitcoin fell after the announcement, according to CoinDesk. Binance suspended withdrawals on several networks.
- The U.S. 10-year yield fell back toward 4.90%, its lowest level in more than a month. That same day, investors sold AI stocks and moved into bonds for safety.
Twenty minutes, ten blockchains
TRM Labs' account reads like a meticulously timed heist. On the morning of October 28, the attacker’s wallet received three small withdrawals from Tornado Cash, a service that obscures the origin of funds. Early on the 29th, the attacker deployed an initial piece of code and tested it on two wallets. That evening, the attack spread across ten blockchains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
TRM identified TraderTraitor, a North Korean group, as the culprit. Its evidence suggests that the attacker took control of the system used to sign transactions for “hot” wallets. These wallets remain connected to the internet so they can process your daily withdrawals. According to Axios, the platform’s initial investigation traced the breach back to the hacked laptop of a single engineer.
Binance initially described the event as a “security incident.” The platform told TechCrunch that user funds were not at risk, while freezing withdrawals on several networks. Its co-founder, Yi He, later promised that Binance would cover all losses. Tether, meanwhile, froze funds linked to the hack.
Put that figure into perspective. Binance held assets before the attack, according to DefiLlama data cited by CoinDesk. On paper, the platform can absorb the blow. But markets do not react to balance sheets. They react to trust.
Why the market pays for a theft that does not affect it directly
You did not lose anything on Binance? Your bitcoin position still fell. Three mechanisms explain why.
First, the market fears a forced seller. A hacker sitting on billions in crypto will often eventually try to sell it. Everyone tracks those addresses in real time, and every movement becomes a signal. The market sells ahead of the hacker.
Then the machinery linking exchanges starts to seize up. When the largest exchange shuts withdrawals, arbitrage traders cannot move funds from one platform to another. Prices diverge, liquidity fragments and order books thin out. An order that would have passed quietly on Tuesday can move the market on Thursday night.
Finally, large accounts pull out. CoinDesk reports that institutional investors rushed to withdraw funds from platforms, while Standard Chartered expects further turbulence. Add leverage in perpetual contracts: every decline triggers liquidations, which fuel the next one.
A stop protects you from a price move. It does not protect you from a platform closing its doors.
Wall Street was already looking for shelter
The hack came during a week dominated by central banks. On Wednesday, the Fed left rates unchanged, reports CNBC. Two members voted for a hike, according to CNN. On Thursday, the ECB kept its refinancing rate at 2.65%. Christine Lagarde referred to a “no-hike” decision, while several governors questioned whether tightening should already begin, notes Central Banking.
Thursday’s U.S. figures disappointed those hoping for easier policy: growth exceeded expectations and core inflation failed to slow.
Taken in isolation, a PCE reading in line with expectations says little. Compare it with the measured impact of core PCE in previous releases: that will tell you whether Thursday’s reaction was unusual.
The real move came from Alphabet’s results, which reignited concerns about the cost of AI. Investors rushed into U.S. government bonds. The 10-year yield fell toward 4.90% and the 30-year toward 5.26%, their lowest levels in more than a month, according to investingLive. A strategist quoted by the site sees this as a threat to U.S. growth and corporate profits, not an inflation shock. Hence lower yields and a softer dollar.
Focus on the contrast. That same night, money flowed into government bonds while bitcoin fell. If you still considered it a safe haven, Thursday settled the question. Bitcoin behaves like a risk asset, with an additional danger of its own: the platforms.
Scenarios for the next few days
| Scenario | What would trigger it | What you would see |
|---|---|---|
| Calm returns | Binance quantifies the loss, confirms it will cover it and reopens withdrawals | Price gaps between platforms narrow and volatility subsides |
| Contagion | Mass withdrawals elsewhere and doubts about other platforms’ reserves | Chain liquidations and abnormal spreads between exchanges |
Contagion is not merely theoretical. That same Thursday, CoinDesk reported that Polymarket had announced a hack involving one of its service providers. Monitor four indicators: Binance’s official statements, the amounts frozen by stablecoin issuers, bitcoin’s price gap across major platforms and perpetual funding rates. A deeply negative funding rate signals a crowd of short sellers and therefore a risk of a violent short squeeze.
Costly mistakes
Reacting to the headline in the first five minutes. Spreads widen and wicks lengthen. You enter at the worst price of the day, with a stop taken out by nothing more than a liquidity gap.
Confusing “funds are safe” with “funds are available.” A platform can remain solvent and still block you. If your margin is held there, you can neither withdraw it nor transfer it to cover a position elsewhere.
Buying the dip based on a promise. “We will cover the losses” is reassuring. But nothing has been said about the timing—or what the hacker will do with the loot.
Keeping the same position size when volatility doubles. This is the most common mistake, and the easiest one to fix.
Work on this last point in your journal. Record the platform for every trade, not just the asset. In Edgyx’s AI trading journal, Ora then shows you how much of your risk rests with a single intermediary. Most traders discover this on the day withdrawals are suspended.
The essentials
- Approximately $6.36 billion was stolen from Binance on October 29. According to TRM Labs, it is the largest crypto theft ever recorded.
- Bitcoin fell while U.S. bonds acted as safe havens. Bitcoin did not fulfill that role.
- The Fed and ECB kept rates unchanged, but both left the door open to a hike.
- Reduce your position size when volatility rises, and spread your capital across multiple platforms.
- A repayment promise is no substitute for reopened withdrawals or a verified figure.
