Binance loses $6.3 billion, Hayes writes a compute-derivatives spec, and Vitalik leaves the X interface: October 25-November 1, 2026
A source-linked weekly brief on Changpeng Zhao, Vitalik Buterin, Arthur Hayes, Stani Kulechov, Brian Armstrong, Hayden Adams and Andre Cronje — and what the largest theft in crypto's history, a blueprint for compute derivatives, and an argument for leaving the feed mean for the week ahead.
From October 25, 2026 at 6:00 p.m. through November 1 at 6:00 p.m. in UTC-05:00, the largest theft in crypto's history unfolded in public.
The Federal Reserve held its policy rate at 3.75% to 4% on October 28, with two of the twelve voters dissenting. 12 That evening Alphabet reported third-quarter results and fell about 10% after hours. 3
Then, at about 5 p.m. Eastern on Thursday, October 29, Binance said it had lost roughly $6.3 billion from its hot wallets, the online wallets it uses for customer payouts. 4 That is more than four times the $1.5 billion taken from Bybit in 2025. 4
TRM Labs counted 18,270 bitcoin, about $1.47 billion at the time, and 200,630 ether. 5 On Ethereum the attacker also took 1.875 billion USDT and 823 million USDC, with 233.46 million XRP and 970,500 SOL from other chains. 5
Bitcoin fell 4.8% to below $77,000 on the news, ether 5.7%, BNB 8% and AAVE 11%. 4 By Friday morning $1.5 billion of futures positions had been liquidated, most of them longs. 6 Bitcoin ended the window near $77,700. 7
The recovery took three days. About $3 billion was frozen onchain, mostly USDT and USDC that their issuers can block. 8
Binance moved 7,499 bitcoin out of its Secure Asset Fund for Users on October 31. 9 By November 1 it had replaced about 95% of the affected assets with company money, up from 90% a day earlier. 5
Withdrawals reopened in phases from 06:00 UTC on November 1, bitcoin first, across fifteen networks. 5
Each of the seven leaders tracked here spent the week on something different. CZ argued that the company could absorb the loss. Stani Kulechov froze Aave for a day. Brian Armstrong offered help and fought a venture capitalist about bitcoin. Hayden Adams pointed at a stock trading onchain while Wall Street was shut. Vitalik Buterin published an essay about leaving a feed he does not control. Arthur Hayes published a blueprint for trading compute. Andre Cronje made idle bids pay.
Two tracked leaders published essays inside the window: Hayes on October 26 and Buterin on October 31. No tracked leader gave a conference keynote, because the next one, Devcon 8 in Mumbai, opens November 3. 10
| Leader | New statement in the window | What to check next |
|---|---|---|
| Changpeng Zhao (CZ), Binance co-founder and shareholder | Said user funds were safe and expected the exchange to cover every loss, then credited US law enforcement for the price holding. 11 | The next proof-of-reserves report, and the last 5% of replaced assets. |
| Vitalik Buterin, Ethereum co-founder | Published "Digital minimalism", arguing for leaving the X interface while staying on the platform. 12 | Whether the tooling he describes — local-first maps, CLI payments — gets used by anyone outside his own experiments. |
| Arthur Hayes, Flop Labs chief executive and Maelstrom chief investment officer | Published the contract specification for a compute index and its derivatives. 13 | Whether the devnet he promised "in days" opens, and whether any venue lists an FRCR contract. |
| Stani Kulechov, Aave founder and chief executive | Froze every DAO-operated Aave market as a precaution on October 29, then unfroze them the next day. 14 | Whether the freeze becomes a documented rule, and whether Horizon's weekend stock prices get used at size. |
| Brian Armstrong, Coinbase co-founder and chief executive | Offered Binance Coinbase's help, and answered a public bitcoin bear call with an offer to start an inverse index. 15 | Whether agent-originated payments show up in reported revenue. |
| Hayden Adams, Uniswap founder | Pointed out that tokenised Alphabet moved 10% onchain while traditional markets were closed. 16 | Whether tokenised-stock volume keeps leading during closed hours, and whether outside projects adopt Token Jar. |
| Andre Cronje, Flying Tulip founder | Said pending limit orders now earn yield while they wait to fill. 17 | Where that yield comes from, and whether the buyback count holds up. |
Changpeng Zhao: the exchange absorbs the loss
Zhao co-founded Binance in 2017 and no longer runs it. He remains a shareholder, and he says so in the same breath as his reassurance. 11
"User funds are safe!" he wrote on the evening of October 29. "It does look like a hack on Binance. … I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." 11
Binance's own account of the breach points at a laptop. Its preliminary investigation suggested a compromised DevOps engineer's laptop let an attacker into a service container and submit unauthorised withdrawals. 4 The company said it found no evidence that a wallet private key leaked. 4
A DevOps engineer builds and deploys the systems that move money. One compromised laptop reached the withdrawal service without touching the keys that sign for it.
The freeze showed which assets have an owner. Tether and Circle can blacklist addresses because they issue the tokens. 8 Bitcoin and ether carry no equivalent switch, and the FBI said the attackers had been converting most of the haul into ether. 18
On October 31 the FBI attributed the theft to TraderTraitor, a North Korean group inside Lazarus, and asked node operators, bridges and exchanges to block its addresses. 18 The notice listed over 600 Ethereum addresses, just under 20 bitcoin addresses and one Solana address. 18
Chainalysis told CoinDesk the attackers had already used thousands of addresses, and expected tens of thousands within weeks. 18
Zhao's next post gave the state of the exchange. Between 06:00 and 15:30 UTC on November 1, Binance processed $4.649 billion of withdrawals against $1.01 billion of deposits, a net outflow near $3.64 billion. 19 Binance put that at 2.1% of the $171 billion it held at its October 28 proof-of-reserves snapshot. 19
"12 hours after withdrawals resumed: 2.1% net outflow," Zhao wrote. "98% choose to stay! Trust isn't earned by what you say in good times. It's earned by what you do in hard times." 20
He also gave credit away, to the agencies that froze funds within hours. "Many crypto bros may not realize, a lot of the 'why bitcoin didn't drop more?' credit goes to them," he wrote. 21 He thanked the Secret Service the same day for acting "within minutes." 22
The panic had a second life online. "Screenshots and videos are easy to fake," he wrote, calling one widely shared chat log fabricated. 23
Vitalik Buterin: leaving the interface
Buterin's essay of October 31 runs through three experiments, and the first is about how he uses X. 12
"I did not leave X the platform, but I did leave X the interface," he writes. Most of his posting now goes through Firefly, a client that combines X, Bluesky, Farcaster and Lens. 12
Firefly has no algorithmic feed, and he argues that is the point. His description of the loop is concrete: see a post, click it out of morbid curiosity, and the ranking system records the click as an interest. 12
"I find myself less interested in the various battles that the intellectual titans on the platform seem to be sucking every day of their lives into," he writes. 12
The second experiment was a hundred days with the phone permanently on airplane mode, using wifi only. 12 His two reasons were privacy and mental health. A connected phone tracks location continuously, and he argues anonymous SIM cards do not fix it, because the handset's hardware identifier links the whole history. 12
The nuisance he remembers was practical. In Singapore he could not receive an SMS code, so he could not log into Grab and took the subway instead of a car. 12
The third experiment drops the browser. He updates his ENS record through a command-line tool an AI wrote for him, and sends privacy-protocol payments through kohaku-cli. 12
His objection to web apps is about repeated trust. Opening a site means re-downloading the application from a server thousands of times, and each download trusts that server again. 12
The replacement he proposes is the Unix philosophy with a language model in front of it: small tools that exchange text, addressed in English instead of Bash. 12
His X posts in the same window took one narrower case. On October 26 he endorsed Kimi 3.1 leaving top-end offensive cyber capabilities out of its training data: "Discriminating against use cases is MUCH less bad than discriminating against users." 24
On October 31 he posted that he had arrived in Mumbai for a week of Ethereum work. 25
Arthur Hayes: the compute index and its derivatives
Hayes runs Flop Labs and invests through Maelstrom. His October 26 essay, "The Trifecta", is written as a contract specification rather than an argument. 13
He frames it as the third standard he has proposed. He cites the perpetual swap, which he and his BitMEX team built in 2016, and the synthetic dollar, which he outlined in 2023 and Ethena built into USDe. 13 The new one is a spot market for compute priced in FLOP, the token of his own network.
The mechanism starts with the block. Flop Network produces a block every second, and each block carries receipts proving a miner completed an inference task. 13 Each receipt records latency in seconds, work done in floating-point operations, and the fee paid in FLOP. The fee divided by the work and the latency gives a price in FLOP per unit of compute per second. 13
His claim is that a freely tradable spot price becomes the reference. Anyone holding FLOP can submit an inference request, and anyone with a GPU, CPU or TPU can mine FLOP by answering one. 13
The tradable unit is the Flop Compute Unit. One FCU specifies a latency of one second, one PetaFLOP of work, a named AI model and a delivery time up to thirty days out. 13 Each model gets up to thirty FCUs, one per delivery day, so a reservation of one ExaFLOP is a thousand of them. 13
Both sides of that book have to post collateral. A buyer funds the bid in full, and a miner offering compute posts a FLOP bond larger than the fee it would earn. 13 A miner that misses the 24-hour delivery window forfeits the bond, and backup miners bid to fill the order at a higher fee than spot. 13
He limits the design to inference. Training capacity cannot be split into identical units, he writes, while inference can. 13
The index is the FRCR, the Flop Reference Compute Rate, defined as an hourly volume-weighted FLOP per GigaFLOP print. 13 On top of it he specifies quanto quarterly futures settling in March, June, September and December at $1 per point, and a perpetual swap funded against an eight-hour average of the premium to the index. 13
Quanto means the contract settles in dollars while the underlying trades in FLOP, so pricing it requires adjusting for the covariance between the index and the FLOP price. 13
He spends a section on how a market maker would hedge a position. Long exposure is a strip of 30-day FCUs rolled forward. 13 Short exposure is the same strip supplied rather than bought, rolled before each expiry so the maker never has to deliver. 13
The network itself is not open yet. On October 26 he said the devnet would open "in the coming days" to miners, validators and agents. 26 On October 29 he restated it and added that devnet participation carries no token allocation. 27
He was out of the market while writing it. On October 24 he had sold Maelstrom's directional book, and on October 28 he asked another trader, "I feel sidelined, what should I buy?" 28
On October 30 he picked up Elon Musk's remark that "we're going to see a lot of stranded compute in partially complete data centers" and tied it to the plan. "More cheap compute supplied on the spot market," he wrote. 29
Stani Kulechov: freeze, unfreeze, and prices that never close
Late on October 29, Aave froze every DAO-operated market on V3 and V4 as a precaution, after reports of an incident at Binance-affiliated wallets. 14 Withdrawals and repayments stayed open, and the protocol said its contracts were unaffected. 14
Kulechov restated it in his own words the same evening. "All assets are safe, and all positions remain overcollateralized," he wrote. 30
Markets reopened about fifteen hours later. 31 His response to the unfreeze was: "Great news and expected." 32
Freezing a lending market stops new deposits and borrows while leaving exits open. That limits exposure to a collapsing collateral price and also stops anyone from opening a position against it.
Chainlink's announcement came the day before the freeze. The service keeps prices for stocks, commodities and other real-world assets updating through weekends and holidays. 33
Chainlink 24/7 switches between trading-session prices and an off-hours reference built from perpetual futures quotes, so an application gets one continuous series per asset. 33 Aave is the launch partner, using the feeds for Horizon, its platform for qualified investors to borrow against tokenised assets. 33
"One of the most important pieces of infrastructure for bringing capital markets onchain is here: 24/7 price feeds, starting with stocks," Kulechov wrote. 34
The role he claimed for Aave was narrower: "Aave is the liquidity engine for tokenized stocks," he wrote on October 28. 35
Two integrations landed the same day. Aave became the credit layer under Ethena Pay's Earn+ vault, curated by Steakhouse. 36 Early Aave App users can now deposit from Optimism. 37
He also made an argument about the European Central Bank's next president. With Christine Lagarde's term ending, he argued the successor should treat stablecoins and tokenised assets as foundations rather than as alternatives to a digital euro. 38
Brian Armstrong: the industry line, and a fight about bitcoin
Armstrong's answer to the breach was cooperation. On October 30 he said Coinbase was blocking sends to compromised wallets and had reached out to Binance to offer help. 15
"Moments like this call for the industry to work together," he wrote. "Openly sharing any useful information and helping to protect customers should come first, regardless of which platform they use." 15
He also answered a public call to sell bitcoin. On October 27 the investor Jason Calacanis posted that "a brutal year for Bitcoin is just getting started" and that bitcoin "will never break its all-time high again." 39
Armstrong answered the next day: "Don't make us start an inverse-Calacanis index Jason!" 40 A day earlier he had made the scarcity case: "you can't invent anything that will increase Bitcoin supply. There will only ever be 21M." 41
His product posts stayed on tokenisation and agents. "All asset classes are moving onchain," he wrote on October 27, counting stablecoins as tokenised fiat. 42
His example for agent payments was a single article. A reader should not need a monthly subscription for one article, he argued, because an agent can fetch that article and pay the publisher for it. 43
Coinbase pushed the same rail further on October 27, when agents gained the ability to buy domain names through x402. 44
Coinbase also put a date on its first global trading competition: November 4, with up to $2 million in rewards. 45
Hayden Adams: price discovery with Wall Street shut
Adams found his example on the night of October 28. "GOOGL just dropped 10% onchain across the board," he wrote at 11:33 p.m. Eastern. "Tradfi is closed for trading. No stonks allowed. Uniswap and tokenized stocks are where price discovery is happening." 16
The trigger was Alphabet's earnings, released after the close. Adjusted earnings per share came in at $2.67 against $3.02 expected, 3 growth in search advertising slowed, and the company held 2026 capital spending flat while guiding to a significant increase in 2027. 46
A tokenised share can reprice while the exchange that lists the underlying is closed, so the repricing happens on Uniswap's order flow.
Uniswap also opened a piece of internal plumbing. Token Jar was built to collect fees in whatever tokens a deployment earns and convert them into one asset, which for Uniswap is burned UNI. 47
Adams said the tool is now available to any project, converting to whatever the project wants: a stablecoin in an exchange wallet, its own token in a multisig, or a burn. 48 "Integrating is a no brainer if your project collects revenue in multiple tokens," he wrote. 48
Tokenised-stock liquidity kept building on Robinhood Chain. Ondo bridged fifteen tokenised stocks and ETFs to the chain, and Uniswap's stable hook now creates pairs between Ondo's tokens and Robinhood's own. 49 Adams described the effect as more liquidity for stock tokens and a yield for liquidity providers who hold both versions. 50
He also had a message for issuers who object to their shares trading onchain. "ATTENTION public company ceos," he wrote on October 26, "global distribution that unlocks new buyers and use cases is good." 51
Andre Cronje: yield on an order that never fills
Cronje spent the week on one mechanic. Flying Tulip's trade screen now pays yield on a limit order while it waits. 17
The company's own description is blunt about the case where the trade never happens: "Even if your target price is never reached, your capital keeps working." 52 The same applies to spot, leveraged spot and total-return swaps. 52
Cronje's caption was two sentences shorter: "Earn yield on stink bids." 17 A stink bid is a buy order placed well below the market on the chance that a seller hits it.
He tied that idle capital to his buyback. Bids sitting at net asset value earn while they wait, and the yield buys FT at spot, which is then burned. 53
The numbers he gave were his own accounting. "Protocol buybacks + NAV buybacks burns over $3m worth at this point," he wrote on October 29. "That's $3m worth of tokens bought with revenue in 8 months. Highest for any protocol." 54 He pointed at $2 million of buy orders resting at net asset value. 55
Staked ftUSD pays 5.98% on Ethereum, 9.27% on Sonic and 11.66% on BNB Smart Chain. 56
"Yield consistency is just as important as high yield," he wrote. "But both is better." 57
The dates to hold
Binance said its new proof-of-reserves report, from a snapshot taken at 00:00 UTC on October 31, would be published on November 2. 19
Roughly 5% of the stolen assets had not been replaced as of November 1, the less liquid tokens outside the top ten. 5
On October 30 about $3.3 billion of the haul was still unrecovered, with Binance buying replacements on the open market and over the counter while working with the FBI and Secret Service. 58
The US midterm elections are on November 3, and Coinbase's trading competition opens the next day. 45
Devcon 8 runs in Mumbai from November 3 to 6. 10
Flop Labs has a devnet to open, then a testnet and the token distribution that follows it. Anyone joining the devnet earns nothing from it. 27
The next exchange failure will show whether Aave freezes on the rumour and unfreezes on the confirmation again, as it did in fifteen hours this week.
References
- 1FOMC statement, October 28, 2026
federalreserve.gov
- 2CNBC on the October 28 decision
cnbc.com
- 3CNBC on Alphabet's third quarter
cnbc.com
- 4CoinDesk on the Binance theft
coindesk.com
- 5CoinDesk on the withdrawal restart
coindesk.com
- 6CoinDesk on the market reaction
coindesk.com
- 7CoinDesk price page for bitcoin
coindesk.com
- 8CoinDesk on the centralisation paradox
coindesk.com
- 9
- 10Ethereum community events calendar
ethereum.org
- 11CZ's first response
x.com
- 12Vitalik Buterin, "Digital minimalism"
vitalik.ca
- 13Arthur Hayes, "The Trifecta"
cryptohayes.substack.com
- 14Aave on the freeze
x.com
- 15
- 16
- 17
- 18CoinDesk on the FBI notice
coindesk.com
- 19
- 20CZ on the outflow
x.com
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31Aave on the unfreeze
x.com
- 32
- 33CoinDesk on Chainlink 24/7
coindesk.com
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47Uniswap on Token Jar
x.com
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.