Binance disclosed the theft of approximately $6.3bn on 30 October, the largest in the asset class's history by a factor of four. Six days later Democrats took both chambers of Congress, and bitcoin trades higher than it did before either event. The fund data describe a different week from the price data, and the gap between them is where this briefing sits.
TL;DR
Binance reported approximately $6.3bn stolen across ten blockchains, most of it within roughly 20 minutes. TRM Labs puts the figure at $6.36bn and attributes it with high confidence to North Korea's TraderTraitor.
Approximately $3bn has been frozen, including over $2.3bn by Tether and Circle. Frozen is not the same as recovered, and roughly $3.3bn remains unaccounted for.
Binance says it has set aside more than $6.34bn of company resources, of which $5bn was already held in the affected token assets, equivalent to approximately 80% of the loss.
US [spot Bitcoin ETFs](https://farside.co.uk/btc/) shed approximately $1.1574bn across the sessions of 30 October, 2 November and 3 November, before taking $74.6m on 4 November.
That 4 November figure is one fund buying more than another sold: FBTC took $236.7m while IBIT redeemed $201.2m, the only outflow of the session.
Redemptions were established before either event. The funds lost $635.6m on 22 October, ending the three-session inflow streak this briefing reported a day earlier.
Bitcoin fell to an intraday $75,618 on 4 November and recovered above $80,000. Approximately $950m of all-crypto liquidations over a rolling 24 hours included roughly $560m of shorts.
Schroders launched a tokenised feeder fund for its emerging-market bond strategy on Solana, extending tokenisation beyond money-market and Treasury products.
The $6.3bn Binance Breach
The theft began late on Thursday 29 October and was disclosed the following day. Binance reported approximately $6.3bn taken; TRM Labs tracked approximately $6.36bn moved out of Binance wallets across ten blockchains, with most transfers completed inside roughly 20 minutes. That makes it the largest crypto theft on record by a wide margin, exceeding the $1.5bn Bybit theft of February 2025 more than fourfold, and more than six times the $1bn held in Binance's Secure Asset Fund for Users.
Three quantities need separating, because they are routinely conflated and they describe different things. The assets stolen are approximately $6.3bn on Binance's figure and $6.36bn on TRM's. The stolen assets frozen are approximately $3bn, including over $2.3bn by the stablecoin issuers Tether and Circle; freezing establishes legal control and the possibility of recovery rather than recovery itself, and roughly $3.3bn remains unaccounted for. The corporate resources reserved are more than $6.34bn, of which Binance said $5bn was already held in the affected token assets — approximately 80% of the loss — with purchases under way to cover the balance. Resources reserved are not funds distributed. A separate report on 31 October put coverage of stolen user assets at 90%, which is a later observation than the 80% figure and should not be blended with it.
The method is not conclusively established. Binance initially indicated the breach may have begun with a compromised engineer's laptop, then said its investigation had moved beyond that hypothesis and cited additional points of breach, while stating it had found no evidence at that stage that any wallet's private key had leaked. TRM's description — the attacker directing Binance's own wallets to send funds to wallets under the attacker's control — mirrors the Bybit incident. Mark Karpeles, formerly of Mt Gox, told Reuters that attackers had probably accessed keys for at least two wallets. Both TRM and Chainalysis attribute the attack to TraderTraitor, the North Korean unit the FBI blamed for Bybit. Binance has not itself attributed responsibility.
Deposits and withdrawals were suspended on the Thursday and resumed within approximately 45 hours. Bitcoin fell to a six-week low of $76,368 and ether to a two-month low of $2,178 on the disclosure, with Coinbase shares down 4.8% despite stating it was unaffected.
The question the pledge does not answer is a balance-sheet one. A commitment to cover losses from company funds is meaningful, but what matters for counterparty assessment is the funding mix behind it: how much of the $6.34bn is held in the affected tokens rather than purchased into them, what the purchases cost against a moving market, how much of the frozen $3bn is ultimately returned and over what timescale, and whether any of this is independently verifiable. Binance is not a public reporting entity, and proof-of-reserves attestations are point-in-time exercises of varying scope. The exchange restored withdrawals quickly, which is the strongest available evidence of liquidity, but it is evidence of liquidity on that date rather than of solvency against a $6.3bn hole.
ETF Flows: Redemptions That Preceded Both Events
The fund data run against the price narrative, and they begin before either shock.
This briefing's 22 October edition led on a three-session inflow of approximately $1.08bn and cautioned that three sessions were not a trend, that the money offset earlier redemptions rather than establishing accumulation, and that sustained phases have historically run on months of daily inflows. That caution was vindicated within a day. The funds shed $635.6m on 22 October, ending the streak and reversing most of what the three sessions had delivered.
The three sessions from 30 October total approximately $1.1574bn of redemptions; including 4 November the four-session figure is approximately $1.0828bn. Net assets stood at $99.2bn on 3 November and $102.26bn on 4 November, around 6.35% of bitcoin's market capitalisation, against approximately $109bn on 21 October. Cumulative net inflows since launch have fallen from approximately $57.96bn to $56.54bn, so roughly $1.4bn of lifetime inflows has been given back since the last briefing.
It is tempting to read the 30 October outflow of $643.2m as a response to the Binance disclosure that same day, and the timing invites it. The evidence does not support the inference. Daily fund flows record transactions, not motives, and US [spot bitcoin ETFs](https://farside.co.uk/btc/) do not custody assets on Binance, so no direct counterparty channel exists. The $635.6m redemption of 22 October, eight days before the breach and twelve before the election, establishes that large outflows were already occurring. What the data show is risk reduction across a period containing both events, not an identified cause.
The 4 November reversal needs the same care. Fidelity's FBTC took $236.7m, ARK 21Shares ARKB $19.9m, Bitwise BITB $15.21m and Invesco BTCO $3.98m, while BlackRock's IBIT redeemed $201.24m as the session's only outflow. A net inflow of $74.6m is the arithmetic of one issuer selling heavily into another issuer's buying. This is the single-fund concentration the series has tracked all autumn, operating in both directions within one session. Ether funds took $53m on the same day, having shed $139.8m on 2 November.
Bitcoin reached an intraday low of $75,618 on 4 November before recovering above $80,000, and the rebound carried a forced component. CoinGlass figures reported on 4 November show approximately $950m of all-crypto liquidations over a rolling 24 hours, including roughly $560m of short positions, with $514m of short liquidations inside a 12-hour window. A separate bitcoin-only tracker records $408m of estimated liquidations for the day including $310m of shorts; that is a different asset universe and methodology rather than a contradiction. Short covering was a component of the recovery. It does not account for all of it, and liquidation data cannot establish how much.
Washington After the Midterms
Democrats took both chambers. The structural position this creates is narrower than the headlines suggest, because the legislative question was settled in September rather than this week.
The Digital Asset Market Clarity Act passed the House 294–134 last July — a substantial bipartisan margin — and then failed a Senate cloture vote 49 to 50, short of the 60 required. It needed Democratic votes it did not secure. Lee Reiners of Duke University describes the bill as finished, and passage in a lame-duck session as difficult. Tagus Capital argues that valuations had already absorbed legislative gridlock when the bill stalled, which is consistent with the muted market response to a result that analysts describe as largely expected.
What survives is instructive. The GENIUS Act framework for stablecoins is already statute and takes effect on 18 January 2027 irrespective of the election. The SEC and CFTC retain authority to write digital-asset rules within existing statute — the SEC's Regulation Crypto Assets proposal, its October custody proposal for registered advisers and funds, and the CFTC's advance notice open to 14 December. The exposure is not prohibition. It is that a framework assembled through agency rulemaking is more readily revised than one enacted in statute, which is precisely the structural point this briefing made on 22 October when control of both chambers was still contested.
Reporting on 4 November indicates House Democrats have begun discussing a market-structure proposal drawing partly on Maxine Waters' earlier investor-protection amendments, covering stronger SEC oversight, custody safeguards, proof-of-reserves requirements and restrictions on conflicts of interest involving public officials. These are described as discussions for the next Congress rather than introduced legislative text, and nothing establishes that the Binance breach prompted them. The breach does, however, give custody safeguards and proof-of-reserves obvious political salience, and that is a connection worth watching rather than asserting.
Analyst expectations cluster around tighter consumer protections and constraints on stablecoin yield, greater resistance to deregulatory market-structure bills, and more exposure for altcoins and decentralised finance than for bitcoin, whose commodity classification has not been seriously contested under any proposed regime. Manatt's Mike Katz points to tokenised equities and yield-bearing instruments as candidates for tighter treatment or delay.
Institutional Adoption Continues
Against that, the week's clearest institutional development ran in the other direction. On 4 November Schroders launched a tokenised feeder fund providing an on-chain share class for the Schroder International Selection Fund Emerging Market Bond strategy, deployed on Solana through Centrifuge. It is the manager's first deployment on that network, and it extends tokenisation beyond the money-market and Treasury products where the activity has been concentrated.
The structure needs stating precisely, because the distinction carries the analytical weight. Investors are not holding emerging-market bonds on Solana. The product is a feeder fund whose share-class ownership records are tokenised, so the token represents access and an ownership record in the feeder, which in turn invests in an existing fund. The underlying strategy is actively managed, holding at least two thirds of assets in fixed- and floating-rate securities issued by emerging-market governments, agencies, supranationals and companies, with multi-currency exposure and derivative use. Schroders managed approximately $1.1tn as at June 2026. The stated minimum investment on Centrifuge's platform is $100,000.
Several things are not established and should not be assumed. The legal claim attaching to the token, the subscription and redemption mechanics, and the transfer agent, custodian, administrator and auditor arrangements have not been described in the material available. Transfer between approved investors and eventual use as collateral are presented as possibilities subject to legal and product restrictions, not as confirmed features. Tokenising a feeder's share register changes how ownership is recorded and potentially how it moves; it does not by itself create secondary liquidity in emerging-market debt, and claims to that effect would require the operational detail that has not yet been published.
Macro
The Federal Open Market Committee held the target range at 3.75–4.00% on 28 October by a vote of 10 to 2, with Lisa Cook and Beth Hammack both preferring an immediate quarter-point increase. A hold carrying two dissents in the hawkish direction is an unusual configuration and leaves the December meeting genuinely open.
The dollar reached a one-month low in the sessions after the election, falling 0.44% on 4 November, which is ordinarily supportive for the asset class. Equities rallied, with the Dow up 3.03%, the S&P 500 1.58% and the Nasdaq 1.44%, while gold gained close to 3% and Brent crude fell sharply on expectations that a Democratic Congress constrains the conduct of the Iran war. Falling yields, a weaker dollar and rising equities is a supportive configuration for high-beta risk, and bitcoin traded consistently with that rather than independently of it.
Key Risks
Coverage is a pledge, not a distribution. Binance has reserved more than $6.34bn against an approximately $6.3bn loss, with $5bn already held in the affected tokens. The balance depends on purchases into a moving market, and the $3bn frozen is not yet recovered.
Attribution does not imply recovery. TRM and Chainalysis both point to TraderTraitor. Funds attributed to North Korean units have historically proved difficult to recover in full.
Fund concentration cuts both ways. IBIT redeemed $201.24m on the day the outflow streak ended, against FBTC's $236.7m. A net figure of $74.6m conceals two issuers moving in opposite directions at scale.
Provider figures disagree.Farside's summary table showed approximately $275.8m for 4 November, apparently omitting IBIT's redemption; the detailed fund-level table reconciles to $74.6m. The two should not be mixed.
The rebound carried forced covering. Roughly $560m of the $950m of rolling 24-hour liquidations were shorts, so part of the recovery reflects position closure rather than new demand.
December remains open. The 10–2 hold with two hawkish dissents leaves a hike on the table, against an asset class trading with elevated correlation to the technology complex.
Agency rulemaking is reversible. The SEC and CFTC can proceed within existing authority, and what they build can be revised more readily than statute under a different administration or Congress.
Intelligence Monitoring Points
Binance withdrawal volumes and any independently verified reserve attestation, as the direct read on custodial-risk decay. The pace at which frozen assets are returned rather than merely immobilised. Whether bitcoin fund flows sustain positive prints beyond a single session, and whether IBIT stops leading redemptions. The December FOMC and whether the dissent pattern shifts. The scope of any House Democratic market-structure text once introduced, particularly on proof-of-reserves and custody. Operational disclosure on the Schroders feeder — legal claim, redemption mechanics and service providers — before any liquidity conclusions are drawn. The CFTC comment deadline of 14 December.
The Bottom Line
The asset class absorbed its largest operational-security failure and a hostile political turn inside six days, and bitcoin is higher than before either. That is a genuine demonstration of resilience in price. It is not a demonstration of institutional demand.
The fund data say something narrower and more useful. Redemptions were running before the breach and before the vote — $635.6m on 22 October, the day after this briefing reported a three-session inflow and warned it established nothing. Approximately $1.16bn left across the three sessions from 30 October. The one positive print since is the net of one issuer buying $236.7m while another sold $201.2m. Nothing in that sequence identifies a cause, and the coincidence of the largest outflow with the Binance disclosure is not evidence of a counterparty channel that does not exist for these products.
What the week actually establishes is three separate things running at once. Operational risk in centralised custody is larger than the industry's insurance arrangements, by a factor of six at the one exchange that could most afford it. The legislative route to market-structure clarity closed in September and the election confirmed rather than caused it, leaving an agency-built framework that is easier to unbuild. And institutional infrastructure continued to extend regardless, into emerging-market debt, at a $100,000 minimum, through a structure whose operational detail has not yet been published.
None of those resolves this quarter. The flow data remain the clearest observable signal, and they have now been negative for longer than they were positive.
Data and Source Note
Bitcoin ETF flows are taken from detailed fund-level tables, which reconcile arithmetically. A discrepancy exists for 4 November: a summary table showed approximately $275.8m while the fund-level data give $74.6m, the difference corresponding to IBIT's $201.24m redemption, which the summary appears to omit. The fund-level series is used throughout and the two should not be combined. The three-session total of approximately $1.1574bn covers 30 October, 2 November and 3 November; including 4 November gives approximately $1.0828bn. Net assets and cumulative inflow figures carry the dates stated and are subject to provider revision. Liquidation figures are CoinGlass data as reported on 4 November, covering all crypto assets on a rolling 24-hour basis, not a UTC calendar day; a separate bitcoin-only tracker using different methodology recorded $408m including $310m of shorts. Binance figures distinguish assets stolen, stolen assets frozen and corporate resources reserved; the 80% and 90% coverage figures are from different dates and sources and are not combined. The attack method is as described by Binance and TRM Labs and is not conclusively established. Attribution to TraderTraitor is TRM's and Chainalysis's assessment; Binance has not attributed responsibility. The House Democratic market-structure proposal is reported discussion, not introduced legislation. Schroders feeder-fund details are as published; legal claim, redemption mechanics and service-provider arrangements were not disclosed in the material available.
This research is provided for informational purposes only and does not constitute investment advice, an investment recommendation or an offer to buy or sell any financial instrument or commodity. Data and estimates may be revised. Readers should undertake their own independent assessment of market conditions and risks.
