• CoinDesk data show crypto futures liquidations rose fourfold to $1.57 billion, with $522 million in bitcoin and $361 million in ether positions.
• Open interest fell 3% to $136.3 billion while futures volume rose 74%, which CoinDesk reads as traders closing positions.
• Binance says it set aside more than $6.34 billion to restore balances one-for-one and that partners froze about $3 billion of stolen assets. Both are the company's own statements, relayed by CoinDesk, and not independently verified.
• CoinDesk reports withdrawals are paused pending security checks, while deposits remain open.
• Credit to North Korea-linked hackers is an analytics-firm assessment reported by CoinDesk, not a regulatory or court finding.

The market reaction to the reported Binance exploit was a leverage flush, and the open question is whether it stays one. CoinDesk data show crypto futures liquidations rose fourfold to $1.57 billion on 30 October 2026. Binance says it has set aside more than $6.34 billion to make customers whole. CoinDesk estimates the loss at about $6.3 billion; the backstop is Binance's own statement. Neither has been independently verified.

What the liquidation data show

The derivatives damage was concentrated in the two largest assets. CoinDesk data put bitcoin liquidations at $522 million and ether at $361 million, together more than half of the $1.57 billion total. Futures volume rose 74% to $346.1 billion while open interest fell 3% to $136.3 billion, which CoinDesk reads as traders closing positions rather than adding risk. Bitcoin touched an overnight low of $76,400, its lowest since 18 September, according to the same report.

How Binance says it will absorb the loss

Binance's stated position is that customers will be restored one-for-one from company resources rather than user funds. In reporting Binance's statements, CoinDesk says about $5 billion of the $6.34 billion is already held in the affected assets and the remainder is being bought on public markets and over the counter. Binance also says partners froze roughly $3 billion of stolen assets. All of these are company claims relayed by a news outlet; we found no audit or regulator filing confirming them.

Who is blamed remains an analyst judgement

Blame for the attack rests on private analytics firms, not on a regulator or court. CoinDesk reports that firms including TRM Labs linked the exploit to North Korea-linked hackers. That is an assessment, not an adjudicated finding, and it should be read as such. CoinDesk's reporting also indicates Binance has disclosed limited technical detail on how the intrusion happened, so the underlying control gap is not yet public.

What to watch: withdrawals and counterparty exposure

The binding constraint is now operational rather than financial. CoinDesk reports Binance has paused withdrawals pending security checks while deposits remain open. Until withdrawals resume and the company's reserve claims are verified, the open question is whether the leverage flush stays contained. Risk teams should map counterparty exposure to Binance and to assets frozen in transit, and treat every loss and recovery figure here as unconfirmed until a primary disclosure appears.