In news that will surprise absolutely no one with a passing familiarity with the internet, the founder of crypto exchange Binance has warned that scammers are now in "overdrive" - presumably working the kind of overtime that would make a Silicon Valley developer wince - as customers yanked billions from the platform following a record $6.3bn hack. The theft, which occurred on Thursday and has already been crowned the biggest heist in history, was probably carried out by North Korea, according to experts. Because of course it was.
Binance froze withdrawals while it investigated the breach, then announced on Sunday that it had begun a phased reopening. By Sunday afternoon, the platform had processed $4.6bn in withdrawals against $1bn in deposits - a net outflow of about $3.6bn, or 2.1% of its $171bn in total assets under management. The company confirmed those figures in its latest proof of reserves snapshot, with a full report expected today. Nothing says "trust us" quite like a proof-of-reserves report filed during a stampede for the exits.
Changpeng Zhao, the platform's founder and universally known as CZ, took to X to warn that scammers are now targeting the very people trying to pull their money out, writing: "Scammers on over drive now. Be careful." His post was a response to another post flagging that fake screenshots and false information were circulating, and urging users to rely only on official channels. One such circulating screenshot promises $150 in free compensation for the withdrawal suspensions. Binance has confirmed the screenshots are digitally altered and the information is false. A free $150 for your troubles after a $6.3bn theft - the only thing more suspicious than the offer is that anyone believed it.
The hack has spooked the wider market, with investors also pulling funds from US Bitcoin ETFs, according to Nick Forster, chief executive of crypto platform Derive.xyz. He noted that US spot Bitcoin ETFs recorded $643 million in net outflows on Friday - their first trading session following the hack. BlackRock's IBIT saw $233.7 million in outflows, while Fidelity's FBTC lost $201 million, ARKB $129.5 million, GBTC $53.3 million and BITB $25.7 million. No fund recorded net inflows. Not one. A clean sweep of pessimism.
The mood shift showed up in options trading too. On Derive.xyz, put options accounted for 68% of Bitcoin options premiums traded in the first 12 hours after the hack, compared with 43% in the preceding five days. Daily Bitcoin options volume sat at approximately $55 million since the hack, up from $34 million the day prior. Traders, it turns out, have been moving quickly to protect themselves against further losses - a novel concept in crypto, where downside protection is usually whatever you tell yourself at 3am.
Forster added that the odds of Bitcoin hitting $100,000 by year's end now stand at just 3.5%. "Last Wednesday, Derive options were pricing a 6% probability of Bitcoin exceeding $100K by Christmas. That has now fallen to just 3.5%, or roughly a one-in-30 chance," he said. "Before the hack, our options market was pricing a 75% probability of Bitcoin finishing above $80,000 at Friday's expiry. Instead, Bitcoin settled at $77,786." So close, and yet so very far from the moon.
Meanwhile, Binance has confirmed that customers can now withdraw cash in US dollars as it restores its systems. Euro, yen and some other fiat currency withdrawals had already been restored, and the exchange said on X that it will continue to share further updates today. Progress, of a sort.
European stock markets opened lower this morning, with the UK's blue-chip FTSE 100 down 0.3%. Its worst performers were Endeavour Mining and BP, both down about 1.7%, while the Stoxx Europe 600, which tracks the continent's biggest companies, was down 0.3%. Oil prices retreated after reports that US president Donald Trump wants to give diplomacy with Iran more time before possibly restarting strikes following the midterm election result. Brent crude, the international benchmark, fell 2.6% to about $110 a barrel. Trump reportedly told Israeli prime minister Benjamin Netanyahu that he wants negotiations with Iran to play out before potentially restarting strikes after Tuesday's midterms, according to Axios, citing unnamed sources - the most reliable kind.
Financial regulators around the world, meanwhile, are meeting with crypto exchanges to discuss cybersecurity measures. South Korea's financial regulator held an emergency meeting on Monday to inspect local exchanges' cybersecurity, according to Reuters, ordering measures that can be implemented immediately, including constant transaction monitoring and operating response systems to detect and report irregular access attempts. Other measures include raising the ratio of cold wallets - which secure cryptocurrency private keys offline - and increasing reserve deposits. In Hong Kong, the Securities and Futures Commission is expected to step up guidance to the crypto industry soon via new circulars. Eric Yip, executive director for intermediaries, said at Hong Kong's FinTech week forum that new guidance will arrive in the last two months of the year, Reuters reported.
And in case you missed it: rival trading platform Chainalysis said on Friday that it had also been the target of a cyber attack, though it found no evidence of unauthorised access to "investigation content, authentication credentials, or session tokens." The company said its team is working with leading cybersecurity experts to investigate the activity and harden its systems, has proactively notified all customers, and stressed that the incident is not related to the recent crypto theft at Binance. Two security incidents in one news cycle - the crypto industry really is spoiling us.