Skip to content
FXMacro Wire
Directory

Thematic Pillar Hub · 1 Published Briefings

fx-and-macro

fx-and-macro institutional intelligence, quantitative benchmarks, primary regulatory filings, and market structure analysis from FXMacro Wire. An institutional FX analysis of the coordinated $3 billion on-chain asset freeze executed by Tether, Circle, Ripple, and Arbitrum following the $6.3 billion Binance security breach.

Curated by Henrik Lindqvist, CFA (CFA, MSc in International Monetary Economics (LSE)) · Fact-checked by FXMacro Wire Institutional Review Board

Key Institutional Takeaways — fx-and-macro

  • Binance suffered an estimated $6.3 billion multi-chain hot-wallet breach across 10–11 blockchains in 20 minutes via a compromised DevOps laptop and internal signing container, utilizing an EIP-7702 delegation sweeper on Ethereum.
  • Tether (~$971M–$1.5B), Circle (~$823M), Ripple, World Liberty Financial, and Arbitrum coordinated to freeze roughly $2.5B–$3.0B of the stolen assets on-chain.
  • TRM Labs and Chainalysis attributed the attack with high confidence to North Korea's TraderTraitor; ZachXBT linked the THORChain laundering cluster directly to the September 2026 $388M Bitget exploit.
  • Co-CEOs Richard Teng and Yi He, alongside founder CZ, pledged 100% loss coverage via SAFU and corporate reserves, with withdrawals slated to resume within 48 hours (Tether ~$971M-$1.5B | Circle ~$823M | Total Frozen ~$2.5B-$3.0B).

All fx-and-macro Research Briefings (1)

Institutional Directories & Regulatory Registers

Knowledge Graph Entity Index →Regulated Institutions & Counterparties →Supervisory Authorities & Licences →

Frequently Asked Questions — fx-and-macro

How much was stolen in the October 2026 Binance security breach and how much was frozen?

Approximately $6.3 billion was drained across 10–11 blockchains in a 20-minute window, making it the largest crypto heist in history. Stablecoin issuers (Tether, Circle, Ripple, World Liberty Financial) and protocol security councils rapidly froze roughly $2.5 billion to $3.0 billion on-chain.

How did the attackers breach Binance hot wallets without brute-forcing private keys?

Preliminary investigations indicate the attackers compromised a DevOps engineer's laptop to access an internal service container connected to wallet-signing infrastructure, and used a single EIP-7702 smart-account delegation on Ethereum to sweep funds.

Who is attributed with the attack and how is it linked to the Bitget exploit?

TRM Labs, Chainalysis, and Elliptic attributed the breach with high confidence to North Korea's TraderTraitor unit. On-chain investigator ZachXBT demonstrated that stolen funds routed through THORChain commingled in the exact same address cluster as the $388 million September 2026 Bitget exploit.

Are user funds covered and what is the specific impact for FXMacro Wire readers?

Co-CEOs Richard Teng and Yi He confirmed that 100% of losses are covered by the SAFU fund and corporate reserves, with withdrawals expected to resume within 48 hours. For FXMacro Wire, the core analytical focus is Offshore USD stablecoin liquidity premia (USDT/USD, USDC/USD, RLUSD) and secondary DEX conversion slippage across Aave and THORChain.

Explore Related Thematic Research Hubs on FXMacro Wire

Central Bank Policy & G10 Rates (31) →G10 FX Liquidity & Sovereign Reserves (31) →Cross-Currency Basis & Swap Flows (30) →EM & Commodity FX Macro (30) →market-insights (14) →Macro & FX (8) →G10 FX & Rates (4) →monetary-policy (3) →FX (2) →Cross-Border FX & Settlement (1) →Global Liquidity Infrastructure (1) →financial-conditions (1) →FX Microstructure & Cross-Border Settlement (1) →G10 FX Flows, Central Banks & Cross-Currency Basis (1) →G10 FX & Macro Liquidity (1) →Central Banking & Monetary Policy (1) →