Summary Binance lost ~$6.36 Billion in the largest crypto heist on record, yet Bitcoin’s reaction so far has been a relatively modest dip. The breach sat in Binance’s withdrawal system, so this is a security failure at one company, with the Bitcoin blockchain untouched. The price reaction came while Binance withdrawals were paused, so I see two tests ahead: the first ETF sessions after the hack, and Binance’s reopening and reserve update on November. The attacker used Aave to escape the stablecoin freezes, and the night showed how many parties can still step in when “decentralized” finance gets hit. My model shows the market prices only ~10% odds of Bitcoin reaching gold parity, and I would use any weakness from the hack to add. The crypto world is currently in high alert mode, as an attacker just moved ~$6.36 Billion out of Binance wallets across ten blockchains, in about 20 minutes. This “heist” is roughly four times the Bybit hack of February 2025 in size, and it is also currently the largest crypto theft on record. Bitcoin ( BTC-USD )'s answer so far has been modest, with a dip of ~5% at the time of writing. Many may think the worst is already past us, but I think that reading may be premature. The price reaction took place with Binance withdrawals paused, which means a large pool of BTCs has not yet left the exchange and could potentially, once these withdrawals are reinstated, be sold. I think there are two key tests coming in the next few days: the first full US sessions of spot ETF flows after the hack, and the reopening of Binance withdrawals together with its monthly reserve update on November 1st. Readers who followed my August article on Bitcoin know that I argued Bitcoin had already formed a bottom, and I rated it a STRONG BUY. I think the Binance hack can act as a significant test of that bottom. So far it is holding, but in this article I discuss some thresholds that Bitcoin needs to clear for my bottom thesis not to be invalidated. I believe if Bitcoin holds these tests, ~$78,000 is a good level to add. A Breach In Binance's Signing System Is Serious, But Doesn’t Impact the BTC Blockchain With the story still developing, I am reporting onchain figures at the time of writing, taken from TRM Labs' analysis and Binance's own statements, from CoinDesk's live coverage : The attacker took ~$6.36 Billion, valued at the price of each asset when it left, from Binance wallets on ten blockchains, starting with Ripple USD ( XRP-USD ) at 20:05 UTC. 18,270 BTC were part of the heist, worth ~$1.47 Billion at the time. TRM attributes the attack with high confidence to TraderTraitor, a hacking unit connected with the North Korean state. Stablecoin issuers and Arbitrum's Security Council froze ~$2.7 Billion, while ~$2.4 Billion in ETH and BTC currently remains beyond anyone's reach. Binance first pointed to a compromised engineer's laptop, but has since found additional breach points, and pledges to cover all losses from its “SAFU” fund and company funds. In my view, the key detail, based on what we know so far at least, is how the attacker got in. Binance says no wallet private key was leaked, and Bitquery’s trace shows that every transfer out of Binance carried a valid signature from the company. This means the attacker got into the internal system Binance uses to approve withdrawals and made it approve its own transaction. For readers that are less familiar with the blockchain and Bitcoin, I want to highlight how that makes this event a security failure at one company, with Bitcoin itself as a technology untouched. It also “helps” that the company affected was Binance, and not Coinbase Global, Inc. ( COIN ), because the latter is the custodian behind most Bitcoin ETFs, such as the iShares Bitcoin Trust ETF ( IBIT ). There is no doubt in my mind that a hack of this size on Coinbase would have triggered a far worse reaction in Bitcoin. Bitcoin’s Price Reaction So Far Has Been Relatively Muted For Good Reasons Bitcoin traded at ~$80,500 when the coins left Binance at 20:20 UTC. It then touched a 24 hour low of ~$76,400 (which is a decline of ~5%) and then recovered slightly, to ~$78,000. This drop was still enough to trigger ~$1.54 Billion of liquidations (mostly with leveraged traders), of which ~$1.30 Billion were longs. TradingView Compared to the largest crypto “heist” in history, a ~5% dip looks mild. On an historical basis, it actually is, as the chart below shows, comparing historical exchange hacks with the price reaction of Bitcoin in the subsequent 6 hours. Author's work Relative to its share of Bitcoin’s market cap, the price reaction was smaller than after four of the five prior events in the chart. Only the Mt. Gox collapse, where the missing coins equaled ~6.8% of all BTC in circulation, moved the price less per unit of shock. I think it is reasonable to call this price behavior a first test passed. However, I see three reasons to tread carefully: Binance paused withdrawals the same evening, so holders of BTC on the largest exchange could not move coins elsewhere or into self custody. The day was crowded with other news: Intel Corporation ( INTC ) fell ~25% after hours, the Invesco QQQ Trust ( QQQ ) lost more than 2%, and the Fed had held rates at 3.75% to 4% one day earlier with two officials voting for a hike. US spot ETF holders, who in my view now are the main actors in setting the marginal price, have not traded a single session since the hack. These are the reasons why I believe we have yet to see Bitcoin passing at least two tests before assessing the real damage. The Attacker Won The Race Against The Stablecoin Freezes By Minutes Stablecoin, which are effectively centralized and backed by their respective issuers, can be frozen at any time and for any given address. The attacker obviously knew this and planned around it. Shortly after pulling off the heist, hackers moved the money to Aave ( AAVE-USD ), one of the largest DeFi lending protocols, and used stablecoins to borrow Ethereum ( ETH-USD ), which is a decentralized blockchain and cannot be frozen by any one actor. The exact amounts are still unclear at the time of writing, but one attacker wallet was identified as being supplied with 60 Million Tether USD ( USDT-USD ) and borrowing 19,762 WETH , worth ~$44.6 Million, between 20:58 and 21:01 UTC. The table below summarizes events as they unfolded on chain and have been so far reported. Time UTC (New York) Event 20:05 (4:05 PM) Theft begins on the XRP Ledger 20:20 (4:20 PM) 18,270 BTC leave a Binance hot wallet 20:24 (4:24 PM) Main Ethereum drain: 167,464 ETH plus ~1.6 Billion USDT 20:34 (4:34 PM) First UniswapX fill: 20,940 ETH to an attacker relay wallet 20:58 to 21:01 (4:58 to 5:01 PM) 60 Million USDT supplied to Aave, 19,762 WETH borrowed 21:01 (5:01 PM) Tether's first freeze, 971 Million USDT in the main receiving wallet 21:04 (5:04 PM) Circle freezes 823 Million USDC 21:42 (5:42 PM) Aave guardians start freezing markets, through 23:04 As the table shows, the last borrow on Aave arrived in the same minute as Tether's first freeze. Tether did later freeze the wallet that borrowed on Aave, but Bitquery's data lists it among six wallets that were already empty when the freeze arrived. In total, ~$729 Million of stolen USDT got out before the freezes: ~$495 Million was swapped into ETH and ~$234 Million into TRON. This speed had a price. The attacker paid ~13% to 15% over market for Ethereum to get out of freezable assets in minutes. What The Hack Says About DeFi Risk, Stablecoins And Why Bitcoin Holders Should Care Less Personally, I see this episode as a stress test of DeFi and stablecoins, more than of Bitcoin. Permissionless lending on DeFi protocols worked as an exit for hackers. They borrowed ETH against USDT to quickly turn it into a decentralized asset that could not be seized, giving up collateral the hacker knew was about to get frozen anyway. The interventions did not stop at Tether, though. Aave froze its markets across 16 networks, so nobody could make new deposits or take new loans, and honest users have now been locked out along with the attacker. Kamino, a lending app on Solana USD ( SOL-USD ), also paused borrowing in its SOL and BTC market as a precaution. Additionally: Tether froze ~1.77 Billion USDT across Ethereum, Tron and other chains. Circle Internet Group, Inc. ( CRCL ) froze 823 Million USDC, working with law enforcement. Ripple and World Liberty Financial froze their own stablecoins. Arbitrum’s Security Council moved 8,426 ETH and 74.6 Million ARB out of the attacker’s wallet. As a crypto enthusiast, I think my main “a-ha moment” of this hack lies in how many parties were able to step in that night, even though “decentralized” finance is usually sold as having no one in charge. To be clear, I think all these interventions were the right call, as they kept ~$2.7 Billion out of the attacker's hands. However, they also show how similar to “traditional finance” DeFi still is, at least when it comes to security. For what concerns Bitcoin, the failures of the hack seemed to have sat in custody, stablecoins and DeFi lending, with none of them involving the Bitcoin protocol. The attacker kept its 18,270 BTC precisely because no one can freeze them, a property that protects every holder in the same way and sits at the center of my bullish thesis for Bitcoin. In a political and regulatory context that is currently quite hot when it comes to crypto, I think this hack is unlikely to help push legislation that favors DeFi and stablecoins, even at a time where the US government needs them more than ever. Test #1: Do ETF Holders Sell The First Sessions After The Hack? The October 29th US session closed before the heist began, and it actually brought a small net inflow of ~$17.2 Million , with ~$12.8 Million into IBIT. That followed ~$424 Million of inflows over the previous three sessions and ~$773.5 Million of outflows on October 22nd and 23rd, the most recent significant selloff when it comes to BTC ETFs. That October selloff is my benchmark for the test that is about to come. Its average was ~$387 Million of outflows per session, so I would consider Bitcoin as “passing” this test in case of a net inflow or any outflow smaller than that amount. An outflow above ~$387 Million in a single session would indicate, in my view, that ETF holders are treating the hack as a reason to cut exposure, which is a fail and could reopen the question whether or not the bottom for Bitcoin is in. Farside Investors I think ETF outflows matter for a Bitcoin “bottom” because ETF holders are the steadiest buyers of Bitcoin, and the next few trading sessions are the first time they can react to this news. With Friday (today) being the last session before the week-end, I will observe closely how Bitcoin behaves in the upcoming hours. Test #2: On November 1st Binance Reopens Withdrawals And Updates Its Reserves Binance's latest update says it remains on track to resume withdrawals in ~45 hours, which points to early Sunday, November 1st. Deposits keep working , but I think the reopening of withdrawals is when the real test comes in. The same day is also when we can expect Binance's monthly reserve snapshot . CoinDesk found that the drained wallets were part of the October 1st “proof of reserves”, and estimates Binance's ETH backing near 94% until the stolen coins are replaced. For Bitcoin, the arithmetic is simple: the “SAFU” fund from Binance holds ~$1 Billion in BTC, while the 18,270 stolen BTC are worth ~$1.4 Billion at current prices, so restoring full BTC backing likely needs company funds on top of SAFU. That, of course, assumes the company is unable to retrieve anything from the hack. In terms of indicators to check, the 200 day moving average for Bitcoin currently sits near $73,000 and the short term holder cost basis was ~$74,900 as of October 16th. These are my two “bars” for Bitcoin to pass after November 1st. If Bitcoin goes below them, I think it would indicate some sort of panic from the hack. I think this panic, to be clear, would be completely unjustified as the hack has changed nothing for the Bitcoin blockchain. The table below recaps both of my tests in one place. The thresholds are my own and reflect what I just described. Test Pass Fail ETF flows, October 30th Net inflow, or outflow under ~$387 Million Outflow above ~$387 Million Binance reopening Withdrawals resume on schedule Reopening delayed Binance BTC reserves BTC reserve ratio at or above 100% BTC reserve ratio below 100% Price through the reopening Holds above the ~$76,400 low Daily close below ~$73,000 Bitcoin's Valuation: The Market Prices Only ~10% Odds Of Gold Parity My followers will know my long term valuation model for Bitcoin has two anchors. The bull case is Bitcoin reaching gold's market cap, at ~$1,000,000 per coin, and the bear case is an "online casino" outcome at $60,000, where Bitcoin is worth only what traders pay for its volatility. I weight the two by the probability of the bull case and halve the result, as in my latest piece. Bull case probability Value per BTC Upside vs ~$78,000 25% ~$147,500 ~89% 35% ~$194,500 ~149% 50% ~$265,000 ~240% I think the more useful exercise is to run the model backwards. Doubling today's ~$78,000, subtracting the $60,000 bear anchor and dividing by the $940,000 gap between the two cases gives an implied bull probability of ~10%. In other words, the market assigns roughly one chance in ten that Bitcoin reaches gold parity in the future. One of the largest thefts in financial history has not moved that figure much, at least so far. On a shorter horizon, I see three outcomes tied to the two tests. These are my own estimates: Case Trigger BTC price vs ~$78,000 Bear Either test fails, attacker BTC reaches exchanges ~$60,000 ~23% lower Base Both tests pass, range trade ~$73,000 to 84,000 ~6% lower to ~8% higher Bull Both pass, ETF inflows return, $82,000 to 84,000 resistance taken ~$90,000 ~15% higher With a long term investment horizon for my Bitcoin stack, I reiterate my STRONG BUY today, on the idea that the world can make good use of a technically superior reserve asset that is still priced as a fraction of its closest competitor . I will use any weakness coming from this hack to buy more. Risks To My Thesis The first risk to my thesis is that I may be reading too much into what is effectively still a small move. A ~5% decline sits within Bitcoin's normal daily range, and the same evening also saw Intel's correction on weak guidance, a QQQ selloff and a hawkish Fed vote. If the hack reaction was partly hidden by macro noise, the "resilience" story may simply be a coincidence of timing. Then there is the supply still in the attacker's hands. TRM counts more than 420,000 ETH and 18,270 BTC beyond any issuer's reach. The BTC sits in 19 wallets that had not moved at last check, and after Bybit, the same hacker group spent about ten days converting stolen ETH into BTC. Any sale through OTC desks over the coming weeks would add supply and could act as a headwind for Bitcoin’s price. Institutional investors are currently reportedly pulling funds from centralized exchanges, and Geoffrey Kendrick of Standard Chartered expects more downside until the frozen assets are released and more detail emerges. I can understand his take: if withdrawals reopen and coins leave exchanges for cold storage, that is healthy, but if they leave to be sold, it would be bearish for Bitcoin, at least short term. Regulation is also a risk, albeit a slower one. A North Korea backed theft of this size (the second in under two years) could push lawmakers toward tighter rules for exchanges and DeFi front ends, and the fact that nobody can freeze BTC is exactly what some regulators currently dislike. In my opinion, regulatory pressure has more to do with exchanges, stablecoin issuers and DeFi players than BTC holders, but it could affect sentiment for months regardless. Conclusion: Two Tests Will Determine Bitcoin's Price Movement In The Next Days I think the market may have judged the Binance hack a bit too early, in both directions. The ~5% dip was measured while the largest exchange froze withdrawals, so it neither proves resilience nor rules out a sustained correction. The ETF session tonight and the reopening of withdrawals for Binance on November 1st will be the real test. My decision rule is simple. If both tests pass, I would add at ~$78,000. If either fails, I would wait for the ~$73,000 area, and in a full bear case for the $60,000 anchor of my model. Personally, I hold Bitcoin through IBIT in a retirement account as well as in self custody, and this hack is one more reason I prefer either of those to an exchange balance. With a long-term view, I reiterate my STRONG BUY rating on Bitcoin, with ~$194,500 as my base case value and ~$265,000 in the bull case.
