A day after we noted bitcoin investors buying insurance against a price drop, that bias strengthened after a hacker walked away with more than $6 billion in crypto assets from Binance, the largest crypto exchange. In the eight hours since the hack, Paradigm, the institutional liquidity network, traded around $590 million in notional bitcoin options blocks, about half of the block volume on Deribit over the same period, and the flow was lopsidedly bearish, with most of it in puts. Paradigm’s Nicolas Quatravaux says the buying sat close to the current price, at strikes of $74,000 to $78,000, which suggests conviction hedging against a deeper near-term pullback rather than lottery-ticket bets on a crash. Bitcoin is trading near $77,300, down more than 3%, and Standard Chartered warned that weakness may persist until details of the hack emerge and exchanges and protocols unfreeze the coins involved. Stay alert.
Founded in 2018, Hex Trust is the regulated digital asset partner for institutions that want to do more than just hold. More than 600 funds, banks, family offices, foundations, payment firms and OTC desks rely on us to safeguard, move and grow their assets, all with one licensed provider.
Our custody gives clients the protection of cold storage without the wait. Assets stay offline and fully secured, and transactions still go out instantly.
Around custody, we’ve built the services institutions actually use: OTC trading, staking, fiat on and off ramps, payments, and Aura, our wealth platform for private clients.
Hex Trust is licensed in Hong Kong, Singapore and Dubai, so partners can grow across Asia and the Middle East with one compliant counterparty instead of piecing together several.
Here’s how an Ethereum upgrade helped drain part of Binance’s $6 billion loss
An attacker used EIP-7702, an Ethereum feature that went live in May 2025 with the Pectra upgrade and lets ordinary wallets run smart-contract code, to drain about $2.5 billion in ether and tokens from a Binance wallet in less than four minutes on Thursday, part of the roughly $6.3 billion Binance says was stolen across several blockchains. A single transaction carried 50 authorizations signed by a Binance wallet that Etherscan labels “Binance 14,” each pointing it at a sweeper contract only the attacker could operate, and the network accepted the one whose transaction counter matched. The attacker moved about 167,464 ETH and 63 tokens, including roughly $1.6 billion in USDT, swept later deposits as Binance’s systems kept routing them in, and pulled 823 million USDC from a separate Binance wallet, TRM Labs said. The malicious delegation stayed active for nearly four hours before the wallet revoked it. How the attacker obtained valid signatures is still under investigation: Co-CEO Richard Teng said preliminary findings pointed to a compromised DevOps engineer’s laptop, with no evidence that private keys leaked, and Binance later said investigators had found additional points of breach. Binance has pledged to cover all losses with its SAFU emergency fund and company funds.
Binance hacker splits $1.4 billion of bitcoin into 19 wallets that no one can freeze
The attacker who drained Binance late on Thursday split 18,270 stolen bitcoin, worth about $1.4 billion, into 19 wallets within minutes and then left them alone. The coins moved from Binance’s hot wallet to one address in 11 transactions, then through a peel chain that carved off 1,000 BTC at a time: 17 wallets now hold exactly 1,000 BTC each, one holds 832.5 BTC and one holds 437.7 BTC, and as of 04:23 UTC Friday none had sent a coin onward, according to a CoinDesk trace of the blockchain. That is more than two and a half times the 7,000 BTC Binance lost in its 2019 hack. Stablecoin issuers can blacklist addresses within hours, but bitcoin has no issuer to do that, so the coins can only be stopped once they reach an exchange, an over-the-counter desk or a swap service. TRM Labs attributed the theft to North Korea’s TraderTraitor unit with high confidence, noting that after the $1.5 billion Bybit theft in February 2025 the same unit spent about 10 days turning stolen ether into bitcoin. Binance puts the total damage at $6.3 billion, and deposits and withdrawals remained suspended.
Several blockchain sleuths and analysis firms say a North Korean hacking unit appears responsible for the theft of more than $6 billion in crypto from Binance, though the attribution is not definitive. Investigator ZachXBT said the attacker was likely Lazarus. TRM Labs said TraderTraitor, a subunit of Lazarus, was likely behind the hack and that it had high confidence in that assessment, and Chainalysis CEO Jony Levin said his firm assessed the hack was likely done by TraderTraitor, citing links to a previous hack. Blockaid’s Ido Ben-Natan said the tactics and sophistication are consistent with DPRK operations, which he noted have been tied to several major crypto hacks this year. An individual familiar with crypto investigations told CoinDesk that very few actors could pull something like this off but cautioned that the attack had not been definitively attributed, adding that Lazarus and other DPRK groups are usually faster and more efficient at moving and selling stolen funds than the Binance hackers were. Binance said in a late Thursday update that it had traced the attack vector to a compromised DevOps engineer’s laptop.
CoinDesk Disclosure: The information contained in this newsletter, and any information linked through the items contained herein, is not intended to provide sufficient information to form the basis for an investment decision. You should seek additional information regarding the merits and risks of investing in any cryptocurrency or digital assets.
L1.co Disclosure: This material is for informational purposes only, and the content contained herein should not be considered investment advice or a solicitation, offer, or recommendation to sell or buy any asset, strategy, or product. Investing in digital assets involves a high degree of risk, including the loss of principal.
Crypto Daybook Americas: A newsletter from CoinDesk
