“The concept of progress acts as a protective mechanism to shield us from the terrors of the future.” – Frank Herbert
*Hi everyone! I hope you’re all ready for one of the most visually striking weekends of the year – I’m not into Halloween, I confess, but the iconography of the Día de los Muertos is stunning, and the legends behind it are timeless. *💀🎃
Sincere apologies for the late send today, but the news flow this morning, just… 😖😖
The Binance hack stress-test
Macro: strong growth, slowing consumption
Crypto is Macro Now offers ~daily commentary and updates on crypto’s evolving role in the changing geopolitical and financial landscapes. Plus links and more.
If you’re a premium subscriber, thank you!! ❤
Most stablecoin payment value involved a business while most payments were between consumers. Businesses were involved in 64% of $482B in payments Jan-Sept 2026, but consumer-to-consumer transfers made up 64% of the payments count (1.04 billion).
Download Allium’s ** State of Stablecoins and Payments Q3 2026**.
And get weekly onchain data and more analysis like this from the Allium Research team on Substack.
Well, this is bad. But perhaps not quite as catastrophic as it might at first seem.
I woke up this morning to the news that Binance, the world’s largest crypto trading platform in terms of volume, has suffered the largest crypto hack to date, with roughly $6.3 *billion *worth of crypto assets drained from accounts. Evidence points to it being 𝕏a North Korean operation, like so many other big hacks in crypto history.
Before, we look at the market reaction, here’s what happened:
Starting at around 20:00 UTC yesterday, funds started leaving Binance wallets, with the bulk exiting in just 20 minutes.
(chart via @anti_fragile)
At first, it looked like the hackers gained access to transaction authorization rights via a developer’s laptop, but Binance 𝕏now says an investigation has found multiple points of entry.
Shortly after, Tether, Circle, Arbitrum and others froze roughly $2.83 billion of stablecoins. Before the freeze, some were transferred over to Aave, where they were used as collateral for an ETH loan. The attacker currently holds around $3.2 billion worth of assets, mainly BTC and ETH – these cannot be frozen.
Executives are assuring users that their funds are safe and that any losses 𝕏will be compensated. To stem outflows, withdrawals have been suspended, but are 𝕏expected to resume once a security scan is complete.
Earlier this morning, Binance 𝕏announced that it was setting aside a reserve of $6.34 billion to cover losses from the theft - $5 billion is already held by Binance in the affected tokens, and the balance will be purchased in the open market, which should give some support to prices. That figure does not include the $3 billion frozen in stablecoins as those balances will be subject to recovery and verification.
Understandably, BTC dropped sharply on the news:
(chart via TradingView)
Not great, but… it’s just over 3% down on 24 hours ago. That kind of a daily move is not unusual. And it’s more or less what Japan’s Nikkei index fell in today’s trading. The US Nasdaq was down 1.4% yesterday. Put differently, given the scale of the theft, 3% is nothing.
Perhaps we’ll see a bigger downward move when the US market wakes up. Futures are suggesting that US stocks are in trouble today, likely to brutally extend yesterday’s losses – which means BTC will probably be dragged down as well.
But it is likely to be more a macro-driven drag than a hack-driven panic.
The timing is unfortunate - Monday marks the four-year anniversary of that CoinDesk article on Alameda’s balance sheet that set off the cascade of revelations that a week later would lead to the end of FTX and many other crypto institutions.
But this situation is completely different. FTX was outright fraud that left devastation in its wake. The Binance hit is a hack, and the industry has come together. The crypto market will be fine, and there are unlikely to be any notable casualties, not even Binance – it is the industry’s largest trading platform in terms of volume, and is extremely profitable.
Crypto research firm K33 estimates that Binance’s annual profit is over $4 billion, so it can afford the market purchases it needs to make.
(chart via @VetleLunde)
Also, it’s notable that there were no stablecoin depegs, Aave froze some reserves but is otherwise functioning, DeFi in general seems unaffected, and market makers are 𝕏not expecting much disruption.
Barring a nasty surprise, this will blow over fast, and industry-wide security will improve as a result.
Indeed, it needs to. According to DeFiLlama, this brings the number of crypto-related hacks so far this year to 322, more than double the number seen in 2025. If asset prices start to pick up in 2027, the number of attempts will only increase.
(chart via @DefiLlama)
And, no deflection intended, all businesses need to be scrambling to re-think their security logic, given the capabilities of AI agents and the increasing use of cyberwarfare.
I’ve written before about how convenience makes us vulnerable. Digital finance and commerce and communication gives us fast, cheap connectivity but it also offers tempting attack vectors.
However, blockchain transparency itself can become a meaningful defence. The flight from Binance’s wallets was spotted almost immediately. Onchain forensics sprung into action and the tokens were tracked. A perpetrator was identified almost within minutes, their 𝕏wallets mapped so they can be monitored in real time.
(chart via @arkham)
Crypto networks are astonishing in their power of information. Meanwhile, hacks happen regularly behind opaque front-ends and, for the ones we hear about, information tends to be selective.
Binance and partners reacted fast to stem the damage and get communication on the incident out to the public. The firm’s executives – including its two CEOs Yi He and 𝕏Richard Teng – have been keeping the market updated via regular posts 𝕏and videos on X throughout the morning. That also goes a long way towards restoring confidence.
This is likely to blow over soon, and the lessons learned will make the whole industry stronger and hopefully more able to fend off similar operations.
That doesn’t mean we can relax about potential vulnerabilities, though. But, while it’s a really, really bad blow, it has also given the industry the chance to show its strengths.
If you want more detail on how the hack happened and where the funds moved to, these threads give a lot of information:
After yesterday’s macro data, a rate hike in December looks even more likely – unless a sharp stock market drop changes the economic outlook (my screen is a sea of red today).
