Decrypt’s Morning Minute, written by Tyler Warner, said a roughly $6.4 billion theft from Binance became the day’s defining crypto story, overwhelming what had otherwise been one of Hyperliquid’s strongest news cycles on record. The newsletter noted that the analysis and opinions expressed were Warner’s own and did not necessarily reflect Decrypt’s views.
$6.4 billion leaves Binance across three blockchains
According to the report, about $6.4 billion was stolen from Binance, making it by far the largest crypto theft ever recorded and roughly four times the $1.5 billion taken from Bybit in February 2025.
The funds were said to have moved across three blockchains: about $3.5 billion in ETH, $1.4 billion in BTC, and $630 million on Tron, with final accounting still underway.
Stablecoin issuers were able to act because USDT and USDC include issuer-controlled freeze functions. Tether and Circle used those controls to lock about $2.39 billion in total, equal to 43% of the stolen amount. That left an estimated $2.6 billion to $3.2 billion still outside those freezes.
Binance says user funds are safe and losses will be covered
As the situation unfolded, Binance said it was “aware of reports of a potential security issue” and that user funds were “completely safe.” The exchange also paused withdrawals on multiple networks.
The clearest public comment cited in the newsletter came from Changpeng Zhao, who no longer runs Binance but remains its largest shareholder. He said it “does look like a hack” and that he expected user funds to be “fully covered.” Later in the evening, Binance said it had reserved more than $6.34 billion in company funds to cover losses.
ZachXBT said the Binance hack funds were commingled with funds from the $388 million Bitget exploit, leading him to believe the same North Korean hacker group was behind both incidents. On the attack path itself, Binance pointed to a compromised DevOps engineer laptop that allowed unauthorized transactions to be submitted, then said it identified “additional points of breach” in the following hours.
Aave freezes markets after wallet tied to exploiter borrows against deposits
Aave moved to freeze its V3 and V4 markets on Ethereum as a precaution. The concern described in the report was that an attacker could use stolen funds as collateral, borrow against them, and leave the protocol with bad debt.
In the market roundup section, Decrypt said Aave froze every DAO-operated V3 and V4 market, covering 292 reserves across 16 networks, after a wallet tied to the Binance exploiter deposited $60 million in USDT and borrowed 19,762 WETH worth about $44.6 million in a three-minute window.
Market reaction hits majors and liquidations top $1.33 billion
The newsletter said markets reacted as expected. Bitcoin fell below $79,700, ETH dropped below $2,200, and BNB slipped under $700. More than $1.33 billion in positions were liquidated over the day.
In its macro and market section, Decrypt listed BTC down 3.6% at $77,500, ETH down 4% at $2,235, SOL down 4% at $97, HYPE up 8% at $92, and ZEC down 2% at $1,250.
Among altcoins, PEPE was up 8%, SKY rose 5%, and ZRO added 2%. In traditional markets, oil was up 2% at $104 and gold was down 1.2% at $3,980. Stock futures were lower after Amazon fell 12% following earnings, with the Dow flat and the Nasdaq down 2.6%.
Hyperliquid’s major day gets pushed aside
Before the Binance incident took over the narrative, Thursday had been shaping up as a standout day for Hyperliquid. Earlier in the day, Trade.xyz said Intercontinental Exchange, the parent company of the New York Stock Exchange, was investing in it.
The plan described in the report was for a regulated U.S. venue offering 24/7 perpetual futures built on Hyperliquid, spanning stocks, indices, commodities, currencies, and crypto, with its own exchange and clearing setup, pending approval from the Commodity Futures Trading Commission.
Stanley Druckenmiller was also set to join as the first in a small group of outside market figures. The newsletter said he already owned the trade and that his family office had disclosed a $23 million position in Hyperliquid Strategies earlier this year.
The report said Hyperliquid now had a path toward a fully regulated perpetual futures offering inside the U.S., with Druckenmiller backing the effort as an investor and promoting it on X. It also said ICE’s CEO described Hyperliquid as “bigger than NASDAQ.”
Druckenmiller wrote on X: “I am excited to be an investor in trade(xyz) as they partner with ICE to bring 24/7 perpetual futures on Hyperliquid to the United States. As a market participant, I am looking forward to to using their innovative product to enhance my investment process.”
HYPE climbed as high as $97 during the day, up more than 20% at its peak, before falling to $89 in the wake of the Binance hack. By the following morning, it was at $93 and still up 8% on the day.
Polymarket pauses trading after front-end compromise
Polymarket paused trading after users reported funds leaving their accounts. Hudson Rock traced the attack to a compromised script from web monitoring service DebugBear that searches for logged-in trading sessions.
ETF flows, Coinbase earnings, and options expiry
Spot Bitcoin ETFs recorded $17 million in net inflows on Thursday, while spot Ethereum ETFs saw $105 million in net outflows.
Strategy reported $19.53 billion in third-quarter net income, with nearly all of it coming from a $20.91 billion paper gain on Bitcoin.
About $11 billion in Bitcoin options were set to expire on Deribit on Friday, covering about 135,000 BTC and roughly one-third of open interest. The report put max pain at $78,000 against a market near $81,500, with calls outnumbering puts by nearly two to one.
Coinbase beats expectations; more companies block tokenized shares
Coinbase posted $719 million in third-quarter profit against analyst expectations for a 15-cent loss, though about $715 million of that came from gains on crypto held by the company.
Walmart, Eli Lilly, Cigna, Carnival, and Arcos Dorados blocked tokenized versions of their shares on the OKX-ICE venue, bringing the total number of companies that had done so over two weeks to 38.
The newsletter also said crypto groups had spent about $176 million across more than 100 midterm races, with Fairshake and its affiliates accounting for $150.8 million through October 20.
Trezor warning after reported hardware implant
Trezor said anyone who bought one of its wallets from reseller CryptoBilis since March should move funds immediately. The warning followed a report from a customer in Indonesia who said an extra circuit board had been found inside a Safe 5 device, including a cellular module capable of reading whatever appeared on the screen.
Protocol revenue, Polygon on Solana, and NFT prices
Hyperliquid led on-chain protocols by daily revenue at $4.87 million, which the report linked to liquidation activity. Papertrade followed at $2.34 million, Uniswap at $1.7 million, and Pump at $1.69 million.
Polygon brought its Open Money Stack to Solana, allowing businesses on a chain that has processed more than $5 trillion in stablecoin volume this year to connect with banks.
NFT leaders were mixed. CryptoPunks rose 2% to 29.9 ETH, BAYC fell 1% to 6.2 ETH, and Pudgy slipped 1% to 2.5 ETH. Minds dot Games and OTC Desks each gained 12% and led the top movers.
Meme coins, Robinhood chain tokens, and Solana movers
Meme coin leaders were mostly lower, with DOGE down 4%, SHIB down 3%, PEPE up 8%, PENGU down 8%, TRUMP down 8%, SPX down 10%, and BONK down 4%.
On Robinhood chain, leaders were also lower. Pons fell 15% to $160 million, Cashcat dropped 10% to $90 million, and AI lost 12% to $63 million, while Index jumped 50% and led the top movers.
Among Solana movers, Hyperchan rose 40x, Purr gained 50%, and GTA6 added 25%, while Stonk fell 8% to $105 million.
