Yesterday the market's story was a hawkish Fed hold, hot PCE inflation, and Bitcoin giving back $81,000. Overnight it became something else entirely. Binance, the largest crypto exchange, fell victim to a $6.3 billion exploit, CoinDesk reported on Friday morning — an attack analytics firms TRM Labs and Elliptic attributed to North Korea-linked hackers. Bitcoin slumped to an overnight low of $76,400, its lowest price since September 18, before recovering some of the decline. Ether momentarily hit $2,170 before rebounding to around $2,220. Around $3 billion of the stolen assets has been frozen, Binance said, and withdrawals remain paused. The price move was fast. The leverage wipeout was faster. General information only — not financial advice.
The sequence, as CoinDesk reported it, is stark in its simplicity: an exploit drained an estimated $6.3 billion from Binance, the attacker moved and sold holdings, prices fell, and leveraged positions built for a quieter market were closed by force. Binance said around $3 billion of the proceeds has been frozen and that withdrawals remain paused while it conducts security checks. TRM Labs and Elliptic attributed the attack to North Korea-linked hackers, according to CoinDesk's summary. That attribution is theirs, reported by CoinDesk — it is not independently verified here, and the full details of how the exploit worked have not yet been published in the reporting we checked.
The market damage was concentrated where leverage lives. Liquidations in crypto futures jumped fourfold to $1.57 billion. Bitcoin and ether made up more than half of all liquidations, at $522 million and $361 million respectively. Trading volume rose 74% to $346.1 billion while open interest fell 3% to $136.3 billion — the signature of traders closing positions and money leaving futures, rather than new money arriving to buy the dip. Bitcoin fell 3.1% over 24 hours while its open interest fell only 1.4%, which CoinDesk reads as a small amount of money coming in during the drop; ether fell 4% while its open interest fell 5.8%, a small amount of money leaving. The difference matters: bitcoin's dip drew some buyers, ether's did not, at least in futures.
It is worth being precise about causation. A $6.3 billion exploit is enormous — one of the largest exchange thefts ever reported — but the $1.57 billion of liquidations is a separate mechanism. Leveraged long positions are closed automatically when prices fall past their liquidation levels, and those forced sales push prices lower, which closes the next set of positions. That cascade is why a sharp overnight move produces a liquidation figure several times larger than the move itself would suggest, and why the rebound that followed — bitcoin back toward $78,000 in some reports, ether back above $2,200 — also forced closures, this time of bets on further declines. The hack was the trigger. The leverage was the amplifier. Neither number, on its own, tells the whole story.
Options traders turned defensive as it unfolded. Five of the six highest-volume bitcoin options were puts, all struck below the current price, with the $74,000 put expiring November 13 leading volume. In ether the put bias was stronger still: the $2,000 put expiring November 13 had more than twice the volume of any other ether option, and only one of the top six was a call. The 25-delta skew — how much more puts cost than calls — rose across all time frames in both bitcoin and ether, meaning protection is in demand. The 30-day implied volatility indices spiked in Asia as the hack spurred demand for puts, then partly retraced. Traders are paying up for downside insurance. They are not, on this evidence, positioning for a straight recovery.
The tokens that led the rebound were, in several cases, the tokens the attacker had been holding and selling. Ethena (ENA) gained 8.4% and Pepe rose 7.3%, CoinDesk reported, after Uniswap and Aave had fallen around 11% on Thursday as the attacker swapped holdings for ether, according to Lookonchain. Uniswap added 4.6% and Chainlink climbed 3.7%. Aave rose around 4.5% after freezing its lending markets across 16 networks, following the exploiter borrowing around $44.6 million of ether against stolen USDT. LayerZero (ZRO) jumped 12%, the biggest gain in the CoinDesk 100, while Curve fell 7.2% and Tron dropped 4.9%.
The clearest outlier was Hyperliquid's HYPE, up 15% with open interest jumping 28% — money coming in as the rest of the market fell, volume surging almost eightfold, market buy orders dominating. Money also left Solana and NEAR futures: SOL's open interest fell 13.3% against a 3.3% price drop, and NEAR's fell 11.8% on a little-changed price, its second straight day of exits. Funding flipped from positive to negative in both, meaning shorts are now paying longs. BNB fell 6.2%, the biggest drop among the major coins, even as its open interest held flat in dollar terms and volume more than tripled. None of this is a broad risk-on rotation. It is a market repricing specific exposures — to the exchange, to the stolen tokens, to the leverage that was built on top of both — while the fear gauge drops to 36 and the Altcoin Season index slips to 45.
The hack did not land in a calm market. Tech stocks added downward pressure, CoinDesk noted, with Nasdaq-100 futures falling 2.3% after Amazon raised its capital spending forecast and Intel slid around 25% on weak guidance. The Fed had held rates on Wednesday and Thursday's PCE print came in hot, at 3.6% headline and 3.1% core — the story we covered in yesterday morning's story, when bitcoin was already giving back $81,000, and in yesterday afternoon's update as it fell below $79,000. One counterweight predates the theft: U.S. spot bitcoin ETFs took in $17 million on Thursday, a fourth straight day of inflows according to Farside Investors data cited by CoinDesk, before the theft began. That inflow streak is now a fact about Thursday, not a fact about Friday. Whether it survives the weekend is a different question.
First, the frozen funds: around $3 billion frozen leaves around $3 billion not yet frozen, and the split between those two numbers will move as exchanges and protocols respond. Second, withdrawals: Binance has them paused, and the timing and conditions of their return are the most direct signal of how contained the exchange considers the breach. Third, the details: how the exploit worked, and what changes Binance and the wider industry make in response, will decide whether this stays a one-exchange event or becomes a sector-wide security repricing. Fourth, the options market: the $74,000 bitcoin put and the $2,000 ether put expiring November 13 are where traders have put their money on further downside — if put demand fades and those strikes lose volume, the defensive posture is easing; if it grows, it is not. And fifth, whether the $76,400 low holds. It is bitcoin's lowest since September 18. A market that reclaims $80,000 quickly looks different from one that spends the weekend testing $76,000 again, and the difference will show up first in liquidations and open interest, not in headlines.
A $6.3 billion exploit estimate is Binance's and the reporting's figure, not a final audited loss; around $3 billion frozen is not the same as $3 billion recovered; and a rebound in the tokens the attacker sold is not evidence the market has absorbed the event. The attribution to North Korea-linked hackers is TRM Labs' and Elliptic's, as reported by CoinDesk. Prices and flows in this story are Friday-morning snapshots from the source cited; they move, and the afternoon session can confirm or erase the morning. We publish the levels, the liquidations, and the open questions so you can judge which it does.
Sources, all checked this morning: the exploit size, frozen funds, paused withdrawals, attribution, prices, lows, liquidations, volume, open interest, funding, options flow, token moves, Aave's market freeze, and sentiment readings via CoinDesk, “BTC price falls to $76,400; Binance hack triggers $1.57 billion in liquidations: Crypto Markets Today,” October 30, 2026, 7:09 a.m. EDT (coindesk.com); ETF inflow figure via Farside Investors data as cited by CoinDesk in the same report; the prior day's context from our own coverage linked above. Our paper-trading diary, which tracks Nova's simulated bot through this market with its own numbers, publishes separately each evening — it is not part of this market report.
Nova's Data Lab tracks live prices and scanner signals across the market — free to browse, no account needed.
Open the Data Lab →