The largest exchange theft on record has a supply tail, and it sits in three coins no issuer can freeze.
**What happened.** From 20:04 UTC on Oct 29, Binance's withdrawal system signed roughly $6.3B out of 17 hot wallets across nine chains. Binance links it to a compromised DevOps engineer's laptop, says no private key leaked, has frozen ~$3B, suspended deposits and withdrawals, and says it will cover all losses from SAFU and company funds. The unfrozen ~$3.1–3.3B is mainly ETH, BTC and XRP, and none of it had moved to an exchange or mixer as of Bitquery's last check (03:54 UTC Oct 30).
---
**$ETH: Short on a failed retest**
- $2,247.5, -2.7% (24h range $2,172.85–$2,378.69). On-chain trackers put the attacker at ~458K–490K ETH, more than twice the 200,630 it took, because it swapped stolen stablecoins into ETH.
- OI fell from 2.38M to 2.32M ETH (-2.7%). Funding is 0.0017%, the 28th percentile of the last 90 periods: shorts haven't crowded in yet.
- Top traders are 1.75 long. 4h RSI is 35.9, sitting on the lower Bollinger band ($2,247).
- **Trigger:** rejection at $2,285–2,325 (1h mid / 4h mid), confirmed by a 1h close back below $2,285. Don't short into the $2,173 low.
- **Stop $2,395** (above the 50-hour high). TP1 $2,180 · TP2 $2,100.
**$BTC: Watch**
- $78,486.8, -1.8% (range $76,444–$81,953.7). OI is flat (96.5K → 96.0K BTC, -0.5%). Funding is 0.0039% (47th pct).
- Top traders are 1.75 long. 1h RSI is 42.6 and 4h RSI is 39.2. The 18,270 stolen BTC (~$1.4B) haven't moved.
- No leverage edge either way. The risk is the first on-chain movement of those coins.
- **Short only if** a 4h candle closes below $76,444. **Stop $78,400.** TP1 $75,000 · TP2 $73,500.
**$XRP: Short, the crowd is long**
- $1.2650, -2.1% (range $1.1991–$1.3179). The attacker holds 233.5M unfrozen XRP (~$290M).
- Top traders' long ratio is rising: 2.08 → 2.12 → 2.17. Taker buy/sell is 1.19–1.25 and funding is 0.0075% (67th pct). Even so, OI fell 10.7% (307.0M → 274.1M XRP): longs are buying into a falling tape.
- **Trigger:** a 4h close below $1.2469 (lower band), or a rejection at $1.30–1.32.
- **Stop $1.3250** (from a $1.247 entry it's about 6%, so size the position from that). TP1 $1.20 · TP2 $1.15.
Estimated liquidation zones for late longs on XRP: roughly $1.24 (50x), $1.20 (20x) and $1.14 (10x) from current price. These are estimates, not exchange data.
**Risk:** A single headline can flip all three: the hacker dumping, recovered funds, or withdrawals reopening. Set the stop first and size from it. Spreads may widen while deposits and withdrawals stay paused.
*Not financial advice. Data: Binance USDT-M futures API, pulled Oct 30 ~14:50 (UTC+8).*
Sources: Binance announcement https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7 · CNBC https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html · Bitquery https://bitquery.io/investigations/binance-hack · ChainCatcher https://www.chaincatcher.com/en/article/2300217