Cryptocurrency liquidations exceeded $1.54 billion Friday morning after Binance confirmed that hackers stole $6.3 billion, a breach that is shaping up to be the industry's largest on record. Market data showed that wiped-out long positions accounted for $1.29 billion, just over 80% of the total, as the exploit triggered a sharp sell-off across digital assets.
Bitcoin and Ethereum lead losses
Bitcoin fell to a multiweek low of $76,320. Liquidations involving the top cryptocurrency approached $500 million, a fivefold increase from less than $99 million 12 hours earlier. Long positions made up $405 million, or 81%, of bitcoin's total, while shorts accounted for $93 million.
Ethereum saw a similar squeeze, with long liquidations alone topping $300 million against less than $55 million in shorts. Most digital assets followed the broader decline.
HYPE stands out
HYPE was a rare exception. After surging 20% toward a new high, its $19.65 million in short liquidations outpaced the $12 million in longs.
Bitcoin later rebounded to $78,400 at 2:03 a.m. EST, but the sell-off erased gains sparked by the release of U.S. third-quarter GDP data. The retreat left bitcoin down 2% over 24 hours and 5% below its monthly opening price of $83,500 heading into the final day of October.
Investigation and recovery efforts
Onchain analyst ZachXBT linked the exploit to Tradertraitor, an intelligence-backed threat actor tied to North Korea, echoing warnings from several industry security observers.
Binance said its investigation traced the intrusion to a compromised laptop belonging to a DevOps engineer. The breach allowed the attacker to access a service container and execute unauthorized withdrawals. Binance noted that partners froze roughly $3 billion of the stolen funds and said it will use its Secure Asset Fund for Users (SAFU) and corporate reserves to cover all remaining customer losses.
Deposits and withdrawals remain halted. Binance said: "Binance has temporarily suspended deposits and withdrawals while security checks are completed, revoked the affected address authorization [and] engaged law enforcement and blockchain intelligence partners to trace and recover funds."
