Crypto's split week: a record $6.36 billion theft and a regulated Wall Street embrace
North Korea-linked hackers stole $6.36 billion from Binance in about 20 minutes, while the parent of the New York Stock Exchange signed a deal to bring Hyperliquid perpetuals to the United States. Theft and legitimacy are both scaling at once.
- North Korea-backed hackers have stolen approximately $12.8 billion in crypto across 100 incidents since 2017, with $7.4 billion of it taken in 2026. Self-reported m:…4922
- On October 29, 2026, approximately $6.36 billion left Binance wallets across ten blockchains in about 20 minutes. Self-reported m:…4922
- Stablecoin issuers and the Arbitrum Security Council froze nearly $2.7 billion after the Binance theft, while about $2.4 billion remains beyond any issuer's reach. Self-reported m:…4922
- Intercontinental Exchange signed a definitive agreement with Trade[XYZ] to bring Hyperliquid perpetual futures to the United States through a new gated protocol, HIP-3*. m:…5065
- Uniswap Labs released TJAR, an open-source onchain fee conversion system, and Robinhood is using it across its supported chains to receive trading fees in USDC and USDG. Self-reported m:…4896
The theft, at a scale that changes the story
TRM Labs reports that North Korea-backed hackers have stolen approximately $12.8 billion in crypto across 100 incidents since 2017, and that $7.4 billion of that total was taken in 2026 alone. North Korea accounts for 85% of all global crypto hack value in 2026 year-to-date, up from 63% in 2025 and 39% in 2024. Five hacks — Binance, Bybit, Ronin, Bitget and DMM Bitcoin — account for $9.1 billion of the $12.8 billion total. m:…4922
The Binance theft itself, on October 29, 2026, moved approximately $6.36 billion out of Binance wallets on ten blockchains in about 20 minutes. TRM Labs attributes the attack to TraderTraitor, a North Korea state-sponsored unit, and assesses it as a compromise of Binance's hot wallet signing infrastructure. The attacker used an EIP-7702 delegation on Ethereum to turn a Binance hot wallet into a sweeper it controlled, prepared 50 pre-signed authorizations in advance, and began preparation at least 36 hours before the theft. m:…1318
The aftermath shows both the reach and the limits of crypto's defenses. Stablecoin issuers and the Arbitrum Security Council froze approximately $2.7 billion in assets, yet the attacker still holds more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, beyond any issuer's reach. TRM Labs also reports that North Korea IT workers have used stolen or fabricated identity documents to land remote jobs at over 70 US companies, and that attackers use fake recruiters and coding tests to deliver malware — a reminder that the attack surface here is hiring and signing infrastructure, not just code. m:…1318 m:…4922
The regulated embrace, in the same week
Intercontinental Exchange, the parent of the New York Stock Exchange, signed a definitive agreement with Trade[XYZ] to bring Hyperliquid perpetual futures to the United States. The venue will use HIP-3*, a new gated version of the Hyperliquid protocol designed for regulated entities, with ICE serving as the exclusive operator of Trade[XYZ]'s regulated markets and the US venue maintaining separate liquidity from existing HIP-3 markets. Payward, the parent company of Kraken, plans to be the first CFTC-regulated deployer on the new protocol, and Stan Druckenmiller is making a strategic investment in the deal. m:…5065
The irony is documented in the same research note: ICE and CME previously lobbied US officials to scrutinize Hyperliquid's role in offshore trading. The HYPE token price increased approximately 20% following the announcement. Whatever view a reader takes of perpetuals, the institutional direction is now visible in the structure of the deal — gated access, a regulated operator, and separated liquidity — rather than in rhetoric about adoption. m:…5065
The plumbing gets professional, and the trust infrastructure wobbles
Uniswap Labs released TJAR, an onchain fee conversion system that operates as an open market where searchers exchange a fixed amount of a chosen token for assets in a jar, with the release owner able to direct the destination to a treasury, burn address or bridge. Robinhood is using TJAR across its supported chains to receive trading fees in USDC and USDG, and TJAR has been audited by OpenZeppelin and is open source and live. Fee conversion, once a back-office chore, is now a product with an audit and a named enterprise user. m:…4896
At the same time, Chainalysis reported that it was the target of a cybersecurity incident, while stating there is no evidence of unauthorized access to investigation content, authentication credentials or session tokens, and that the incident is not related to the Binance crypto theft. The company says it is working with cybersecurity experts to investigate and harden its systems and has proactively notified customers. For professionals, the week poses a plain question: the regulated venues and the fee plumbing are maturing, but the security model around keys and signing still produced the largest theft in the industry's history. m:…1639
What is still unresolved
- Whether any of the approximately $2.4 billion beyond issuers' reach can be recovered, and by what means.
- Whether the gated HIP-3* venue attracts liquidity away from offshore perpetuals markets or simply adds a parallel one.
- Whether signing-infrastructure defenses, including monitoring for EIP-7702 delegations as TRM Labs recommends, become standard at large venues.
- What the Chainalysis incident investigation finds about how the activity began.
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.