A fracture, or just a jolt?

Late on Thursday night, someone emptied a set of wallets at Binance, the world's largest cryptocurrency exchange. Most of the theft took about twenty minutes. By the time the exchange froze deposits and withdrawals, roughly $6.3 billion in digital assets had left its wallets across ten blockchains, more than four times the previous record. By Friday morning bitcoin had touched $76,368, its lowest price in six weeks, and a great many holders woke up about 4 percent poorer than they went to bed.

When something you own drops overnight, the natural question is "What happened?" The more useful question is "What kind of thing happened?" Economists have spent two centuries learning to sort financial shocks into kinds, because different kinds heal on different timetables. Some shocks are a jolt to liquidity: a sudden scramble for cash, or a sudden burst of fear, that passes once the cash arrives and the facts come in. Others are a fracture in solvency: a hole in someone's balance sheet that no amount of patience will fill. Prices recover from jolts. After fractures, they reprice.

My argument in this essay is that the Binance theft, as far as anyone can tell two days in, looks far more like a jolt than a fracture, and that the history of past exchange thefts gives reasonable grounds to expect the hack's share of the decline to fade. Honesty requires two qualifications, though. A jolt can turn into a fracture if the facts come in badly. And the hack is not the only force pushing on bitcoin. Beneath it runs a tide made of interest rates and a souring mood about technology stocks, and tides do not care how a hack is resolved.

What happened, in order

The facts are still arriving, but the outline is clear. According to the blockchain analysis firm TRM, an attacker moved about $6.36 billion out of Binance wallets. Binance says the breach may have begun with a compromised laptop belonging to one of its engineers. TRM and Chainalysis both concluded, with what TRM called high confidence, that the attack was the work of TraderTraitor, a North Korean unit linked to the Lazarus Group, the same unit the FBI blamed for the $1.5 billion theft at the exchange Bybit in February 2025. Binance itself has been more cautious and has not attributed responsibility.

Two other facts matter more for prices. About $3 billion of the stolen assets has been frozen, including more than $2.3 billion in stablecoins that Tether and Circle, their issuers, can lock in place. And Binance has pledged to cover every customer's losses, from its emergency fund and from company money, with withdrawals scheduled to resume within about 45 hours.

Why 4 percent and not 0.4

Here is a puzzle. Bitcoin is a market worth well over a trillion dollars. The theft, however spectacular, was a few billion, and none of it was bitcoin being destroyed or newly created. Why should the price of every bitcoin in the world fall by 4 percent because one company's wallets were robbed?

Part of the answer is fear, which we will come to. But a larger part is plumbing. Crypto markets are full of borrowed money. Traders who bet on rising prices with leverage post collateral, and when the price falls far enough, the exchange closes their positions by force, selling into a falling market. Each forced sale pushes the price lower, which triggers the next forced sale. On Friday about $1.57 billion of such bets were liquidated, most of them bets that prices would rise.

Economists have studied this mechanism carefully. John Geanakoplos calls it the leverage cycle: borrowed money inflates prices on the way up and turns ordinary declines into collapses on the way down. Markus Brunnermeier and Lasse Pedersen showed how falling prices and tightening margins feed each other in what they called a liquidity spiral. Andrei Shleifer and Robert Vishny explained why such sales overshoot: the natural buyers of a distressed asset are often other traders in the same position, so the sellers must find buyers further afield, at a discount. The size of Friday's drop therefore tells us less about how much was stolen than about how much leverage was sitting in the market when the news broke.

The oldest question in finance

Forced selling explains the speed of the fall. Whether the fall lasts depends on a different question, one that the British journalist Walter Bagehot posed in 1873 in Lombard Street, his study of London's banking panics. Bagehot distinguished between an institution that is illiquid, meaning it cannot raise cash fast enough, and one that is insolvent, meaning it owes more than it owns. The first needs time and a loan. The second needs a funeral. Much of the art of handling a financial crisis, he argued, lies in telling the two apart quickly.

A century later, Douglas Diamond and Philip Dybvig showed why the distinction is so treacherous. A perfectly solvent bank can fail if every depositor demands their money on the same day, because its assets cannot be sold that fast. Fear of a run can cause a run. That is why Binance's 45-hour pause on withdrawals is double-edged. It stops the attacker and buys time to secure the remaining wallets, but every hour of closed doors invites customers to wonder whether the doors are closed for another reason.

So let us do what Bagehot would have done, and look at the balance sheet.

The arithmetic is simple. If the frozen $3 billion is eventually returned and the $1 billion Secure Asset Fund for Users is spent, Binance must find roughly another $2.3 billion of its own. That is a great deal of money, but it is not obviously beyond the means of a firm that dominates global crypto trading, and CoinDesk reported that Binance has arranged funds to cover the full amount. The crux is that outsiders cannot check. Binance is privately held and publishes no audited accounts. Until withdrawals reopen and customers can actually take their money out, the market has to price a small probability of a fracture, and that probability is part of why the price fell.

The record of past thefts

We are not reasoning in a vacuum. Crypto exchanges have been robbed many times, and the episodes form a rough natural experiment. What separates the shocks that healed from the one that did not?

The pattern is not subtle. Mt. Gox was a fracture because the money was gone and, at the time, Mt. Gox nearly was the bitcoin market; its failure damaged the plumbing itself. Bitfinex, Binance in 2019 and Bybit were jolts, because each exchange found a way to make customers whole and kept operating. FTX is the instructive middle case. It was a fracture for the firm and for the lenders tied to it, which went bankrupt in turn. Yet for bitcoin's price it behaved more like a jolt: the market was back above its pre-collapse level within about ten weeks, because the asset itself was unaffected. The lesson is that a theft at an exchange hurts the price most when it impairs the market's ability to function, and least when the damage is contained to one balance sheet that can absorb it.

Bybit is the closest precedent to today. When it lost $1.5 billion to the same North Korean unit in 2025, it borrowed ether from trading firms, replenished its reserves within about three days, and kept withdrawals open throughout. The episode was widely read as a sign that the industry had matured. Binance's theft is four times larger, and its withdrawals are paused rather than open, so the test is harder. But it is the same kind of test.

Why jolts heal

Why should prices bounce back at all? Because a price is, in the end, a forecast of what people will want to pay in the future, and a theft at one exchange changes remarkably little about that forecast. No new bitcoin was created; the supply is still capped at 21 million. The bitcoin network was not breached, only an exchange's operational security. The people who wanted to own bitcoin on Wednesday mostly still want to own it.

What changed was the short-run balance of buyers and sellers. Forced sellers had to sell regardless of value, and frightened holders demanded a premium for bearing uncertainty. The economist Frank Knight drew a famous line in 1921 between risk, which can be measured, and uncertainty, which cannot. On Friday, the market faced uncertainty in Knight's sense: no one knew how large the hole was, who had dug it, or whether more was coming. The result shows up in the options market, where traders paid up for protection against further falls, especially below $74,000, according to CNBC. Geoffrey Kendrick of Standard Chartered expects more pressure until the frozen assets are released and more details emerge.

Both of these forces fade by their nature. Forced selling ends when the overextended positions are gone; Friday's liquidations, painful as they were, left the market with less leverage than it had on Thursday. And uncertainty shrinks with each fact that arrives: when withdrawals reopen, when the frozen sums are confirmed, when the funding is verified. As Sanford Grossman and Merton Miller argued, prices pushed below value by people who must sell create a reward for people who are able to buy, and those buyers eventually show up.

The coins still out there

A fair account has to give the pessimist's case its due, and the pessimist has two good arguments. The first concerns the stolen coins themselves. Some $3 billion remains in the attacker's hands, and North Korean hackers have historically converted and laundered their takings over weeks and months. Every time stolen coins are sold, someone has to buy them. That creates what traders call an overhang, a known supply waiting to come to market, much as repayments to Mt. Gox's creditors and government sales of seized bitcoin have weighed on prices in the past.

The second concerns trust. As Sean Foley of Macquarie University put it, assets at a centralized exchange are "only as safe as the exchange itself," and most insurance policies do not cover stolen crypto. If customers conclude that the largest exchange in the world could lose $6 billion in twenty minutes, some will leave. That need not hurt bitcoin's price, since many will simply move their coins to self-custody or to exchange-traded funds. But it is a reminder that the jolt-or-fracture question applies to confidence as well as to cash.

The tide underneath

Now to the qualification that matters most for anyone hoping to see their holdings back where they were. The hack landed on a market that was already falling. Bitcoin was down about 8 percent for October before the theft. On Wednesday the Federal Reserve held its benchmark rate at 3.75 to 4 percent, and the two members who dissented wanted a hike, not a cut. Over the course of the year the Fed's own projections swung from expecting rate cuts to expecting increases. The Bank of Japan, whose low rates have long fed global speculation, signaled that it too was ready to tighten. And on Friday, according to CNBC, technology stocks sold off on worries about returns from AI spending, with Intel down 25 percent and the Nasdaq-100 down more than 2 percent.

These forces matter because bitcoin has been trading like a high-risk technology stock. The economics are straightforward. A Treasury bill now pays around 4 percent with no risk at all; bitcoin pays no interest and no dividends, so its appeal rests entirely on future price gains. When safe returns rise, the bar for speculative assets rises with them. None of this has anything to do with Binance. It means that even if the hack's effect fades completely, the price may settle not at Thursday's level but at whatever level the tide has carried it to by then.

A jolt passes when the facts arrive. A tide passes when interest rates turn.

Could it come back higher?

It could, and there are reasons beyond hope to think so. Shocks that are survived can leave markets sturdier than before. The forced selling that deepened Friday's drop also cleared out the most fragile positions, so the next bad day will find less leverage to amplify it. Coins sold in a panic tend to pass from weak hands to strong ones, from traders who had to sell to holders who chose to buy. And if Binance reopens on schedule, pays every customer and publishes credible proof of its reserves, the episode could be read the way Bybit's was: as evidence that the industry's largest players can take a multibillion-dollar blow and keep standing.

But history offers no guarantees, and I want to be clear about what this essay is and is not. It is an argument about kinds of shocks, not a forecast of prices. The record says that jolts at solvent exchanges have tended to fade within weeks to months, that fractures have taken years, and that the tide has its own schedule. Which of those stories this one becomes will be decided over the next few weeks, by facts that are not yet in.

Four things to watch

• The doors. Withdrawals reopening on schedule, and staying open, is the single strongest signal that this is a jolt.
• The patch. Independent proof of reserves showing that Binance has covered the gap with its own money, not with promises.
• The overhang. Movements from the attacker's wallets. A slow drip of sales is a drag; a sudden dump is a fresh jolt.
• The tide. The Fed's December meeting and the next inflation reports, which will matter for bitcoin long after the hack is forgotten.