- Largest crypto hack on record, with a mixed recovery picture. Binance estimates ~$6.3 billion in impact, traced to a compromised DevOps engineer’s laptop rather than a private-key leak, and attributed to North Korea’s TraderTraitor unit. Issuers froze roughly $2.7-2.8 billion in stablecoins within hours, but ~$2.9 billion remains movable in non-freezable BTC and ETH, so recovery now depends on tracing, law enforcement, and voluntary returns. Binance will cover all losses from SAFU and company funds, and Bitwise client assets are unaffected.
- Market reaction was sharp but orderly. Bitcoin fell as much as 5.0% and Ethereum 6.1%, with first-hour moves in the 99.6th percentile of the past four years, yet both have since recovered a quarter to a third of the decline and realised investor losses remain modest, pointing to resilience rather than capitulation. Historically, exchange hacks have been transient and followed by strong Bitcoin performance, but Bitwise’s Sentiment Index shows no oversold conditions or seller exhaustion yet, so downside risks stay elevated near term.
- Bitcoin is defending a key structural support zone. The Short-Term Holder Cost Basis (~$76k), True Market Mean (~$78k) and 200-day moving average (~$73k) together form a $73k–$78k range that Bitwise views as the transition zone into a broader bull-market regime; Bitcoin trading into this region and holding firm despite the hack, geopolitical pressure and compressed volatility is a constructive signpost.
Binance Hack – A Postmortem
Yesterday’s incident is now the largest known crypto theft on record, with Binance estimating ~$6.3 billion in total impact across multiple hot wallets and chains. Across Bitcoin, Ethereum, USDC and USDT, Binance recorded its largest 24-hour outflow on record.
Notably, the hack ranks as the largest on record by a wide margin, with the $1.5bn Bybit hack in 2025 representing the closest historical comparison.
Initial findings point to a compromised DevOps engineer’s laptop that allowed an attacker to access a service container and submit unauthorised withdrawal transactions. No evidence of a private-key leak has been found.
Binance founder CZ was among the first to acknowledge the severity. In a post quoting early freeze reports he wrote: “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether ($971m) and Circle ($823m). I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”
Tether and Circle (together with other issuers) moved quickly, freezing roughly $2.7 billion in stablecoins in total (Tether >$1.57 billion USDT; Circle ~$823 million USDC). Parallel freezes occurred on other networks. The attackers, however, raced the freezes.
One wallet in the cluster deposited ~60 million USDT into Aave V3 Ethereum Core and borrowed 19,762 WETH ($45 million) in a matter of minutes before the first freezes landed, converting freezable stablecoins into non-freezable ETH.
They also sold or swapped other tokens on DEXes. Aave later froze affected markets as a precaution.
On-chain analytics firms, including TRM Labs and Chainalysis, have attributed the attack to North Korea’s TraderTraitor unit (linked to the broader Lazarus Group and prior incidents such as Bybit).
The attackers split ~18,270 BTC into 19 wallets (mostly 1,000 BTC each) that have so far remained idle, while large ETH balances sit in wallets that have not yet moved further.
Arkham has designated the actor an official entity, verified ~70 associated addresses, and published tracking showing ~$5.7 billion taken, ~$2.80 billion frozen, and ~$2.9 billion still movable (primarily ETH, BTC and other non-freezable assets).
Binance’s most recent update states that deposits continue normally, withdrawals remain paused while a security revamp of the withdrawal service is completed (expected resumption within 48 hours), and that the full attack path through the compromised computer is still being traced.
A comprehensive root-cause report will follow. Binance has reiterated that it will cover all losses from the SAFU fund and company funds and that user funds are safe.
The episode underscores both the industry’s improved rapid-response coordination (issuer freezes, on-chain tracking) and the residual risk of hot-wallet operational compromise - even at the largest platforms. The bulk of the remaining value sits in assets that cannot be blacklisted, so recovery efforts will now hinge on continued tracing, potential law-enforcement action, and any voluntary returns or liquidations. Full technical details remain pending although some technical details are already known.
Key implications for investors
Our CEO Hunter Horsley commented on the ongoing Binance situation, confirming that client assets held across Bitwise solutions - including curated vaults, private funds and ETPs & ETFs - remain safe.
He noted that spot and lending markets are likely to stay choppy in the near term, while emphasising that the broader crypto industry will survive the incident and emerge stronger, with Binance receiving support from peers. Horsley also highlighted cyber defence as an essential priority for all firms this year and beyond.
From an investor perspective, crypto exchange hacks have historically been associated with significantly negative performance in the short-term but have generally proven to be transient.
Historical occurrences of exchange hacks were generally followed by a significant post-event performance of Bitcoin in the past as they have usually induced a high degree of negative sentiment and seller exhaustion.
Sample: 2010-07-17 - 2026-10-28, 33 centralized exchange hack events, event day = 100
That said, we think that downside risks remain elevated as the situation continues to evolve. Moreover, our inhouse Cryptoasset Sentiment Index[1] implies that we haven’t seen oversold conditions and seller exhaustion just yet – neither on a daily basis nor on an intraday basis.
That said, the recent hack triggered a broad drawdown across the digital asset complex, with Bitcoin falling as much as 5.0% from its pre-hack level and Ethereum 6.1%. The sharpest move came immediately after the drain began, with Bitcoin declining 2.4% and Ethereum 3.3% in the first hour. For both assets, these moves ranked in the 99.6th percentile of hourly price moves over the past four years.
Selling pressure eased considerably after the initial shock. The 24-hour trading range peaked at around 6.5% for Bitcoin and 8.0% for Ethereum, placing both towards the upper end of their four-year distributions, but still below levels seen during recent periods of elevated volatility. Both assets have experienced larger 24-hour ranges within the past three months.
Since bottoming overnight, the market has stabilised reasonably well. Bitcoin has recovered roughly a third of its initial decline and Ethereum more than a quarter, leaving them around 3.4% and 4.4% below their respective pre-hack levels.
Despite the sharp price decline and severity of the hack, when assessing the losses realised by investors over the past 24 hours, the response has remained relatively contained. The magnitude of losses locked in has been modest by comparison, suggesting that investors have remained comparatively steadfast rather than capitulating aggressively.
As repeatedly highlighted across our weekly Crypto Market Compass and Bitcoin Macro Investor, we believe Bitcoin entered this drawdown with a cluster of important structural levels beneath spot:
- The Short-Term Holder Cost Basis near $76k represents the average acquisition price of newer market participants and has historically acted as an important delineator between local risk-on and risk-off conditions.
- The True Market Mean near $78k estimates the average acquisition price of active investors by excluding supply considered lost or deeply dormant.
- The 200-day moving average near $73k is a widely followed technical reference point and has historically served as an important bull/bear threshold for traditional market participants.
Together, these levels form a broader support zone between roughly $73k and $78k, which we view as the primary transition range into a broader bull-market regime. The fact that Bitcoin has now traded into this region and remained comparatively resilient is therefore a constructive signpost.
Despite historically compressed volatility, persistent geopolitical pressure and the largest digital asset hack on record, Bitcoin continues to retest and defend this key support zone.
Bottom Line
- Largest crypto hack on record, with a mixed recovery picture. Binance estimates ~$6.3 billion in impact, traced to a compromised DevOps engineer’s laptop rather than a private-key leak, and attributed to North Korea’s TraderTraitor unit. Issuers froze roughly $2.7-2.8 billion in stablecoins within hours, but ~$2.9 billion remains movable in non-freezable BTC and ETH, so recovery now depends on tracing, law enforcement, and voluntary returns. Binance will cover all losses from SAFU and company funds, and Bitwise client assets are unaffected.
- Market reaction was sharp but orderly. Bitcoin fell as much as 5.0% and Ethereum 6.1%, with first-hour moves in the 99.6th percentile of the past four years, yet both have since recovered a quarter to a third of the decline and realised investor losses remain modest, pointing to resilience rather than capitulation. Historically, exchange hacks have been transient and followed by strong Bitcoin performance, but Bitwise’s Sentiment Index shows no oversold conditions or seller exhaustion yet, so downside risks stay elevated near term.
- Bitcoin is defending a key structural support zone. The Short-Term Holder Cost Basis (~$76k), True Market Mean (~$78k) and 200-day moving average (~$73k) together form a $73k–$78k range that Bitwise views as the transition zone into a broader bull-market regime; Bitcoin trading into this region and holding firm despite the hack, geopolitical pressure and compressed volatility is a constructive signpost
[1]
The Cryptoasset Sentiment Index is a composite indicator consisting of 15 different sub-indicators covering sentiment, on-chain, derivatives, flows developments as well as sentiment in traditional financial markets. A 90-day rolling z-score is used to standardise and aggregate these sub-indicators.
Important Information
This publication constitutes a marketing communication and is provided for informational purposes only. It is intended solely for professional investors and is not suitable for retail distribution and reliance. It does not constitute investment advice, a personal recommendation, or an offer or solicitation to buy or sell any financial instrument.
This document (which may take the form of a presentation, press release, social media post, blog article, broadcast communication or similar instrument – collectively referred to as a “Document”) is issued by Bitwise Europe GmbH (“BEU” or the “Issuer”) and has been prepared in accordance with applicable laws and regulations, including those relating to financial promotions.
Bitwise Europe GmbH, incorporated under the laws of Germany, is the issuer of the Exchange Traded Products (“ETPs”) referenced in this Document under a base prospectus and the applicable final terms, as supplemented from time to time, approved by the German Federal Financial Supervisory Authority (BaFin). The approval of the prospectus by BaFin relates solely to the completeness, coherence and comprehensibility of the prospectus in accordance with the Prospectus Regulation and does not constitute an endorsement, recommendation or assessment of the merits of the products.
Past performance is not a reliable indicator of future results.
Capital at risk. Cryptoassets are highly volatile and involve a high degree of risk. The value of investments in cryptoassets and crypto-linked ETPs may fluctuate significantly, and investors may lose part or all of their invested capital. No capital protection or guaranteed compensation mechanism applies in respect of market losses.
Any investment decision should be made on the basis of the relevant base prospectus, the applicable final terms and the key information document, in particular the section entitled “Risk Warning” The base prospectus, final terms and additional risk information are available at: www.bitwiseinvestments.eu
Access to certain documents may require self-certification regarding your jurisdiction and investor status and may be subject to additional disclaimers and important information.
This document may contain forward-looking statements including statements regarding Bitwise Europe’s belief or current expectations with regards to the performance of certain asset classes. Forward-looking statements are subject to certain risks, uncertainties and assumptions, and there can be no assurance that such statements will be accurate and actual results could differ materially. Therefore, you must not place undue reliance on forward-looking statements.
For more details and the full disclaimer visit:
https://bitwiseinvestments.eu/disclaimer/
