At 01:24 UTC our watchlist gave a split screen rather than a single verdict. Bitcoin printed 78,362.18 USD, up 0.16% on the previous close and sitting at 97% of its daily range — hard against the day’s high. Gold futures came in at 3,916.60, up 0.45% and at 85% of range. Nvidia traded at 204.64, down 4.22% and parked mid-range at 46%. The German DAX stood at 25,818.21, down 0.85% and at 16% of its range, close to the day’s low.
Read as one sentence, the four lines say rotation, not flight. The bid sits in gold and in bitcoin; the offer sits in equities. Microsoft (-1.55%) and Apple (-1.23%) fall into the same column as Nvidia, while Tesla (-0.87%) and the KraneShares China internet tracker KWEB (-0.22%, 18% of range) lean the same way without collapsing. Our regime reading puts trend at “falling” with level 3.63, and the busiest signal channel on 1 November was “central banks” with a single event. That is the weather in which the news landed: not a panic, a re-sorting.
The border that opened
The border in this story is a withdrawal button, and the moment it unlatched is the news. Binance, the largest cryptocurrency exchange, reopened on Sunday after suspending all transactions in the wake of an incident that affected $6.3bn worth of digital assets.
That is the shape of a bank run that behaved itself: a queue at the door, not a fire in the lobby. Binance characterised the outflow on X as an “initial spike” that later declined and said withdrawals “are stabilising as expected” [1]. Withdrawals for Bitcoin and Ethereum have resumed, and further services return in phases once security checks clear.
What was actually taken
The breach began on 29 October. The source describes it as the largest hack in history, well above the approximately $1.5bn Bybit hack in 2025.
The US Federal Bureau of Investigation attributed the attack to North Korea’s TraderTraitor group, urged the industry to block the associated addresses, and partners froze an estimated $2.7bn to $3bn. [1] Binance’s own early checks suggest the entry point may have been a compromised laptop belonging to an engineer, which then allowed hackers to route unauthorised transactions. The hack hit Binance’s global centralised exchange, Binance.com; the US-facing platform has stated it was not affected.
The promise behind the payout
Here is where the story stops being a heist film and becomes an accounting exercise. Binance says it has already covered around 95% of the assets stolen, drawn from its own reserves, with more than $6.34bn set aside for the purpose. [1] Binance has repeatedly committed to covering all losses linked to the attack.
A promise to make users whole is not the same object as a balance restored, and the missing slice is precisely the interesting one: the residual is not cash sitting in a drawer, it is inventory that has to be purchased without moving the price against the buyer. Anyone who wants to understand counterparty risk should watch how a 95% recovery is finished rather than how loudly it is announced.
The reopened withdrawal process is deliberately sequential. Binance began restoring transfers on 1 November, three days after the hack, network by network rather than all at once, with Bitcoin first. That design lets security checks run per asset before each goes live, and it means temporary delays from volume are a feature rather than a fault. Deposits, notably, stayed available throughout.
The channel through which it hits markets
Two mechanisms transmit this event into prices. The first is confidence: an exchange is a promise about custody, and a breach re-prices that promise for every user who has to decide whether to leave coins on a platform or move them to a private key. The $3.6bn that customers pulled out is the measurable half of that decision.
The second is collateral. On 29 October, bitcoin fell more than 3% and briefly touched a six-week low near $76,000, while Ethereum and BNB also declined. Liquidations topped $628 million within an hour, mostly from long positions, according to CoinGlass data. Leverage is where a custody shock becomes a price shock: forced selling does not need a change of view, only a margin call.
Scale matters for perspective. Binance said in 2024 that it held more than $160bn in assets in its custody, and the crypto withdrawn in this episode represents only a fraction of that. The company was founded in China and has hundreds of millions of registered users globally. The $3.6bn withdrawal is enormous in headline terms and modest against the balance sheet.
Who wins, who loses, who decides
Losers are straightforward: leveraged traders who were liquidated in the first hour, and holders of the less liquid tokens still being sourced, who may face a longer wait than the Bitcoin holders. Users who moved early in the queue got their assets; those behind them get a schedule.
Winners include the exchanges and custodians that were not breached, whose clean record becomes the selling point. Chain-analytics firms and the freezing partners who clawed back $2.7bn to $3bn gain standing. In our reading, gold at 85% of its daily range is doing the classic trust trade.
The decision-makers sit outside the market. The FBI names the actor and asks the industry to block addresses; North Korea, if the attribution holds, is beyond any enforcement reach that matters; Binance sets the phase order.
Our own rule-based simulation is not taking a position on any of it. Equity stands at 3,985.42 USD, up 0.06% versus the same time yesterday, with 2,033.42 in cash, and the latest logged decision was WATCH KWEB at 0.00. That is a description of a holding pattern, not a recommendation.
What we watch next
Three things, each with an honest caveat.
First, the remaining 5%: whether the less liquid tokens are actually bought, and on what timeline. A recovery that stalls at 95% would be the most informative number in the whole episode, and the source gives no published schedule for it. Second, the phase list: which networks reopen after Bitcoin and Ethereum, and whether delays stay logistical rather than structural. Third, the market’s own memory: if bitcoin holds near the top of its range while an exchange is still handing back assets, the market is telling us it has priced the event as contained; if the $628 million liquidation figure repeats, it has not.
Attribution to a state group is an intelligence judgement, not a court finding, and the withdrawal total is a snapshot of a queue that was still moving when it was measured.
Sources
Mentioned organisations (context, not sources)
- Nvidia — Organisation (homepage)
- Microsoft — Organisation (homepage)
- Apple — Organisation (homepage)
- Tesla — Organisation (homepage)
- KraneShares — Organisation (homepage)
- Binance — Organisation (homepage)
- Federal Bureau of Investigation — Organisation (homepage)
- Bybit — Organisation (homepage)
- CoinGlass — Organisation (homepage)
