Bitcoin finance, weekly · 24 to 30 October · Published by Hemi Labs
The week in five lines Binance lost $6.36B to North Korea-linked hackers on 29 October, the largest crypto theft on record. Binance set aside $6.34B of its own funds to cover every user, issuers froze about $3B, and the damage stayed contained. Trezor flagged a suspected implant in a Safe 5 from CryptoBilis, the reseller behind Ledger's tampered units. Polymarket's front end was hijacked through a third-party script, draining at least $2.6M. US spot ETFs took in $441M in four days, with inflows every day, hack day included. By the numbers Week to 30 October; ETF flows through 29 October
Binance Loses $6.36 Billion and Covers Every User In about 20 minutes on 29 October, attackers drained Binance hot wallets across ten chains. TRM Labs attributes the theft, with high confidence, to North Korea's TraderTraitor unit.
Where the stolen funds sat, by chain
Approximate USD values. Ethereum includes 200,630 ETH, $1.88B USDT, and $823M USDC. Source: TRM Labs How it happened: Binance says a compromised DevOps engineer's laptop let the attacker submit withdrawals, with "no evidence" of a private key leak. CoinDesk How users are covered: Binance reserved $6.34B of company funds; $5B is already held in matching tokens and the rest is being bought OTC and on market. CoinDesk Who froze what: about $3B in all, led by Tether at roughly $1.77B and Circle at $825M, plus Ripple, World Liberty, and Arbitrum's Security Council. TRM Labs DeFi braced: Aave froze its Ethereum V3 markets after attacker wallets borrowed ETH against USDT; its contracts were unaffected. Decrypt Contagion stayed contained: Bybit reported no impact, Wintermute put its exposure below 20% of net equity, and GSR below 5%. CoinDesk What's next: the FBI and Secret Service are tracing the $3.3B still unrecovered. Withdrawals are expected back within about 48 hours, with a proof of reserves report Monday. PANews OUR READ Every user deposit is reported covered, and the damage stayed inside one exchange. Market makers reported limited exposure, issuers froze billions within hours, and ETF buyers kept buying. What remains is a narrower lesson: hot-wallet signing paths are still the weak point, and Bitcoin finance needs custody where no single laptop can move the money.
ETF Buyers Held. Leverage Did Not. Spot ETFs took in $441 million in four days, $17 million of it on hack day. Futures traders were less calm: $1.57 billion in liquidations as BTC touched $76,400, its lowest since 18 September. US spot BTC ETF net flows by day
Friday's flows not yet reported. Source: Farside The Fed held at 3.75% to 4% on 28 October in a 10-2 vote; both dissenters wanted a hike. Next meeting: 8 to 9 December. Bitcoin Foundation Liquidations quadrupled to $1.57B on 30 October, $522M of it in BTC. CoinDesk Bitcoin moved from Aave and Morpho to Spark BTC posted with lenders, net of borrowing
Aave's cbBTC fell 4,963 while Spark's rose 1,194. DefiLlama, Morpho API. Institutions Strategy books $20.9B in Q3 operating income on bitcoin gains, holds 848,517 BTC, and moves STRC to daily dividends on 1 November. Strategy Coinbase Q3 revenue fell 35% to $1.22B, but adjusted EBITDA of $333M beat forecasts. CoinDesk Kalshi raised $1B at a $40B valuation. CoinDesk
BTC Loan Rates Hit 13% on Hack Night The rate to borrow USDC against cbBTC on Base, the largest BTC-backed loan market on Morpho, jumped from 5.5% to 13% within hours of the breach as the market hit 95% utilization. It has since eased to 8.7%. Borrow rate, cbBTC to USDC on Morpho, Base
Variable borrow APY, UTC. Grey: before the breach. Orange: after. Morpho API. Maple joins the count. DefiLlama now tracks 24,087 BTC of Maple loan collateral on Bitcoin, lifting Bitcoin DeFi to about 75,000 BTC and 7.1% of all DeFi. Babylon held steady at 40,755 BTC staked, while Lombard's LBTC backing eased 4.8% to 7,063 BTC. Other BTC loan rates rose too. WBTC to USDT on Morpho now costs 6.8%, up from 3.0% a week ago.
Attackers Hit Wallets, Websites, and a Tracker Beyond Binance, attackers went after the wallet in users' hands, the website in their browser, and the firm that tracks stolen crypto. Trezor received a report on 28 October of an extra circuit board with a cellular modem inside a Safe 5 sold by CryptoBilis. It calls the report credible but unverified, and no losses are reported. Buyers from CryptoBilis since March should move funds to a new seed. Trezor Polymarket's front end ran a compromised DebugBear script on 29 October that drained at least $2.6M. Trading halted for about an hour, its smart contracts were unaffected, and users will be made whole. Business Today Chainalysis was reportedly breached. A customer email seen by International Cyber Digest says an attacker using "offensive agentic techniques" accessed customer names, emails, and role labels, unrelated to Binance. Chainalysis has not commented publicly. Pillitteri The week's incidents As of 30 October
FROM MIDWEEK WITH MAX On the hardware wallet attacks, Max suggested multisig across different hardware brands, an extra passphrase word, and simpler devices: the fewer parts, the fewer points of failure. Full recap Status board As of 30 October
The Quarter of ZK: Testing Nears as Audits Stack Up From Tuesday's Midweek with Max: the ZK miner and marketplace get their last tweaks before public testing, with three audits running in parallel. A faster ZK miner. SP1 runs about twice as fast as upstream on current NVIDIA cards, and RISC Zero and SP1 now run on AMD, Intel, and lower-VRAM GPUs. Any recent GPU with 16GB works, or use CPU mode. Three audits in flight. veHEMI auto-relock is with a third-party firm, the ZK marketplace contracts go out this week, and Oxygen is being prepared, with open source due in a couple of weeks. PoP points convert to HEMI once the relock audit clears and the new rewards contract launches. Max estimates the first or second week of November. Ordinals support is now embedded in Hemi. The indexer is tested in TBC; next comes Oxygen and hVM precompiles. On the roadmap: ZK Ethereum settlement by year-end, and the hBitVM tunnel upgrade by year-end or early Q1 2027. Full recap Partner news: Squidlore, which hosts HEMI price feeds, launched a Chrome plugin that shows a token's contract addresses, onchain volume, market cap, and price change since a post. COMMUNITY · HEMI ARCADE 2: TURBO EDITION Eight Games Down, Eight to Go Sixteen entries were too many for one stream, so judging is split in two. The first eight were played on 29 October; the last eight go live Thursday, 5 November at 3:30 PM ET. Vote for your favorites in between. Winners follow the second stream. Earn on Hemi: BrownFi pools Merkl incentive APR as of 30 October
Jurisdictional restrictions may apply. Rates may fluctuate based on market conditions.
Ahead: Withdrawals, Reserves, and the Arcade Finale
Figures as of 30 October 2026, 16:00 UTC, from DefiLlama, Morpho, Farside, Merkl, and TRM Labs. Hemi Pulse is published by Hemi Labs for information only. It is not investment, legal, or tax advice. Digital assets involve risk. |
Hemi Pulse - October 30, 2026
Written by:
