Weekly Research Brief: Binance Hacked in Record Theft; Hyperliquid on Wall Street; Prediction Markets’ Brazil ‘Miss’

Welcome to Galaxy Research's Weekly Research Brief. Subscribe to get this newsletter delivered to your inbox every Friday morning.

This week, Alex Thorn and Thad Pinakiewicz reflects on the massive Binance hack; Will Owens breaks down the landmark partnership between TradeXYZ and NYSE parent ICE to build perps on Hyperliquid; and Zack Pokorny considers an apparent rare miss by prediction markets.

Find all our past reports and newsletters at galaxy.com/research. Send feedback to [email protected]. We’d love to hear from you.

Here We Go Again: Binance Loses $6.3b in Largest Robbery in History

Binance, the world’s largest crypto exchange, was drained of roughly $6.3b across 10 blockchains on Thursday night. TRM Labs and Chainalysis attribute the attack to TraderTraitor, North Korea’s Lazarus-linked unit. As of writing, the exchange has not yet re-enabled withdrawals.

Start with scale. The benchmark for the largest robbery ever has long been the roughly $1b Saddam Hussein’s regime took from the Central Bank of Iraq on the eve of the 2003 invasion, about $1.8b in today’s dollars. Bybit beat that in nominal terms but not after inflation. Binance beats it on any measure. Even after roughly $2.5–3bn in freezes, this is the biggest heist of all time. Binance’s BTC outflows yesterday were 11 standard deviations higher than their 30-day average.

Then the method. On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper contract that took orders only from the attacker. It was backed by 50 pre-signed authorizations, one for each upcoming transaction number (nonce), so whichever one came up next would work. The code was rehearsed on three test wallets hours beforehand. Within minutes of each other, nine more chains were emptied, each with different key types and signing schemes. That is someone with intimate knowledge of how Binance’s withdrawal systems work. This is Binance’s preliminary finding: a compromised DevOps engineer’s laptop gave access to a service container, with “no evidence of any wallet private key leak.”

Our take

We believe our previous thesis from Bitget is consistent here. Nobody attacks the private-key math. They attack whoever, or whatever, tells the math what to do.

The biggest mitigating factor of this exploit was stablecoin issuers. Tether froze about $1.77b in USDT, Circle about $825m in USDC, Ripple about $40m in RLUSD, and World Liberty about $28m in USD1. That’s a big part of why this appears to be a painful week rather than an existential one, and we believe Tether deserves credit for moving fast and at scale.

We also believe Circle deserves credit for the freeze. Circle has long said it freezes only when directed by law enforcement or a court, not in real time during an active hack. After April's $285m Drift exploit, CEO Jeremy Allaire went further, saying a private company deciding "what is the right path or not" would be a "moral quandary." During the Drift exploit, about $232m in stolen USDC moved through Circle's own cross-chain transfer protocol over roughly six hours without being frozen. But, on Thursday, Circle froze $823m about 40 minutes after the Ethereum sweep, "in coordination with law enforcement."

Does Binance have enough to cover the hole? The SAFU fund, about $1b in BTC, does not come close to covering it, so Binance says it will cover all losses from its own corporate funds. Last year’s 10/10 liquidation event cost Binance about $283m in depeg compensation plus its $400m “Together Initiative” ($300m in user vouchers and $100m in low-interest loans to institutions). That’s under $700m; this hack is roughly nine times that.

A better yardstick is the BNB burn. 2026’s three quarterly burns so far have retired about $3.2bn of BNB. Net of freezes, the hole is roughly one year of burns, or about 4% of the ~$144bn in assets Binance held before the attack. It is a staggering amount of money, but Binance does appear to have it, or at least the ability to earn its way out of a hole based on our own calculations of their revenue-funded BNB burns. While we can’t independently verify Binance’s whole financial condition, and we don’t know exactly what Binance plans to do, Binance Co-CEO Richard Teng said plainly: “Binance will cover all losses from the SAFU fund and company funds.”

What’s left: when will withdrawals reopen, where will the roughly $2.4b in ETH and BTC still in the attacker’s hands go next (THORChain, Tornado Cash, etc.), and how did an outsider come to know Binance’s systems this well? These are among the key specific questions we will be following in the coming days and weeks. But how the market reacts to the event broadly is also top of mind.

Bitcoin and other crypto assets are trading lower on the news. Alex Thorn’s piece from Monday (Why Now Is the Time to Add and Hold BTC) relies heavily on the 50-week moving average as a key level to maintain a bullish trend, with a break below that is not retaken within 1 month cited as invalidating the paper’s thesis. That 50w MA currently sits at $76,103, and at the time of writing BTCUSD is trading at $77,000. So far, the 50w MA has held, with BTC trading as low as $76,301 overnight on Coinbase. Whether the 50w can hold this weekend is a key test that could be consequential for the next several months of Bitcoin’s technical market structure. – Alex Thorn & Thad Pinakiewicz

NYSE Parent Signs Deal to Bring Compliant Hyperliquid Perps to U.S.

WHAT HAPPENED

Intercontinental Exchange (ICE), parent of the New York Stock Exchange, announced a definitive agreement with Trade[XYZ] to bring the latter’s Hyperliquid perpetual futures to the U.S., pending regulatory approval.

As part of this deal, ICE will be the exclusive operator of Trade[XYZ]’s regulated markets and is also making a strategic investment. Notably, Wall Street legend Stan Druckenmiller is investing as well, making his first-ever tweet. HYPE, the native token of Hyperliquid, pumped ~20% on the news, from $78 to $94 at time of writing.

Hyperliquid will supply the rails via HIP-3* (note the asterisk), which is not exactly the same thing as HIP-3, the year-old protocol upgrade that allows third-party builders to deploy perps. HIP-3* is the newer, gated version designed for regulated entities. Trade[XYZ] will design and deploy the markets, and ICE will run the exchange and clearing. This partnership will allow for the creation of a KYC-gated venue with its own clearinghouse. It will list perps on equities, crypto, indices, commodities, and foreign exchange, with access through futures commission merchants (remember ICE’s venture with OKX).

Trade[XYZ]’s HIP-3 markets have done more than $650b in volume and will stay as they are. What makes this new partnership possible is HIP-3*. Hyperliquid unveiled it recently, and it’s live on testnet. It lets deployers run permissioned perpetual markets through an onchain allowlist. On Oct. 26, Hyperliquid announced that Payward, Kraken’s parent, plans to be the first CFTC-regulated deployer.

This is a huge announcement, but it’s not entirely surprising. President Donald Trump mentioned Hyperliquid on Aug. 19, stating that CFTC Chair Michael Selig was working to bring the platform to the United States. Also, ICE CEO Jeffrey Sprecher said he’d met the Hyperliquid team multiple times at investment bank Bernstein’s conference in May.

TradFi participants love to cite the oil use case. When ICE’s energy markets close, Hyperliquid keeps trading, which has proven useful in times of geopolitical duress.

OUR TAKE

U.S. traders will get a separate, permissioned venue with its own clearing. The existing open HIP-3 markets will keep trading 24/7 for everyone else. The liquidity will not be shared, meaning the U.S. venue will start from zero. It will be interesting to see how different books react to a Sunday night geopolitical shock, and how tightly arbitrage keeps the two prices together.

The backstop for HyperCore (the trading engine of Hyperliquid) is onchain liquidation and, in the tail, auto-deleveraging, as evidenced by last year’s devastating Oct. 10. Nothing announced so far says whether ICE’s clearinghouse will sit on top of HyperCore’s risk engine or replace part of it.

It’s also an open question whether ICE already owns any HYPE. Last month, Hyperliquid Labs, the software development company behind the blockchain, sold 3.75m HYPE OTC to an undisclosed institution. Prominent Hyperliquid onchain analyst MLM found 3.125M of it staked with the Hyperliquid Strategies x Unit validator. He traced the other 625k (through a few hops) to a wallet linked to Trade[XYZ], where it was staked this week.

This isn’t fully confirmed, though. It’s also uncertain whether trades on the planned U.S. venue would go through HIP-3 and pay the same protocol fees.

It’s a little ironic that ICE spent the spring lobbying against this sort of thing. Shortly before Sprecher’s Bernstein remarks, ICE and fellow trading colossus CME pressed U.S. officials to scrutinize Hyperliquid’s role in offshore, oil-linked trading.

This announcement is probably the largest positive catalyst in Hyperliquid’s short history, and it will be exciting to see how competitors in the perps space such as Lighter and Kalshi respond. What once seemed like a Hyperliquid bull’s wildest dream is now reality. – Will Owens

What’s the Difference Between a 20% Chance and a 0% Chance?

WHAT HAPPENED

Prediction market skeptics are crowing (again) after Luiz Inácio Lula da Silva upset Flávio Bolsonaro in Brazil’s runoff election on Oct. 25. Heading into the election, prediction markets had Bolsonaro holding a 75% to 80% chance of winning the election to Lula’s 11% to 20% probability after Bolsonaro won the first round of Brazil’s presidential election on Oct. 4. Lula ended up winning the runoff and remains Brazil’s president, and Bolsonaro fled to the United States.

Traditional polls had shown a statistical dead heat. The polling firm Datafolha had the two candidates tied at 50% each, while AtlasIntel/Bloomberg had Bolsonaro ahead 51.1% to 48.9% and an average compiled by The Rio Times put Bolsonaro at 50.9% to Lula’s 49.1%. Lula ultimately won with 51.8% of valid votes to Bolsonaro’s 48.2%, so most polls leaned slightly toward Bolsonaro and understated Lula’s share by one to four points. Even so, the polls never suggested Bolsonaro was a heavy favorite. Prediction markets offered a far more opinionated stance on the outcome of the election compared to polls that, when compensating for margin of error, offered no tangible takeaway. This setup was similar to that of the 2024 U.S. presidential election, where polls showed an ultra-close race with Kamala Harris barely in the lead while Polymarket gave Trump roughly a 60% chance of winning, a figure that stood at 62% on Election Day.

The difference was the ultimate outcome. In 2024, the markets’ bet that polls were understating the Republican candidate’s chances paid off, while in Brazil the equivalent bet failed. This gap is where critics point to an inaccuracy and apparent lack of efficacy in prediction markets’ implied odds.

OUR TAKE

The picture is not as black and white as the skeptics make it out to be. The take that prediction markets failed in this setting breaks down when taking into consideration what these markets actually tell you: predictions on probabilities. What the detractors miss here is that implied odds are not an implied prophecy. A prediction market price is a statement about frequency, not a guarantee that something will or won’t happen (e.g. a probability >50% does not imply the event must always happen just because the market suggests it is more likely than not). A contract trading at 80% is saying that if you could replay this event many times, the outcome would occur about four times in five, and fail the fifth. A 20% chance is expected to happen one time in five, not never. Lula winning at roughly 11% to 20% was a longshot, not an impossibility, and one longshot landing tells you very little about whether the price was wrong.

Human brains struggle to cope with this idea when looking at probabilities. Psychologists have documented for decades that people judge probability with mental shortcuts, and that these shortcuts lead to systematic and predictable errors (see Amos Tversky and Daniel Kahneman in Science, 1974). The problem shows up in elections specifically. In a Journal of Politics study, Sean J. Westwood, Solomon Messing, and Yphtach Lelkes found through experiments that probabilistic forecasts increase certainty about an outcome and confuse many readers. When one candidate is ahead, win probabilities convey substantially more confidence than vote share estimates do. The authors tied this observation to 2016, when forecasts gave Hillary Clinton a 70% to 99% chance of winning and left voters thinking the race was far less competitive than it was. A 60/40 or 80/20 market reads to many people as a verdict, when it is still a description of uncertainty. This misconception turns Bolsonaro’s 75% to 80% probability into “the markets said Bolsonaro would win,” and a Lula victory into a breakdown in market efficacy, when an 80/20 market is still just a description of some uncertainty.

Historically, over many markets, prediction platforms’ prices hold up. Kalshi Research tested more than 2.2 million resolved markets, and found prices generally behave like genuine probabilities, with a contract at 70 cents resolving “Yes” about 70% of the time. The calibration plots below show this. Each dot groups markets by their price (horizontal axis) and shows how often those markets actually resolved “Yes” (vertical axis). The dashed diagonal is perfect calibration, where a 70% price means a 70% hit rate. The dots hug that line, and they sit closest to it in the panels measured one week and one day before resolution, which is the window most relevant to the Brazil runoff. Prices are also more accurate as resolution nears, with Brier scores (a standard error measure where lower is better) falling from roughly 0.08 to 0.09 at three months out to about 0.02 at close. This shows that even in the markets that were well calibrated, the favorite didn’t always win. For elections, the favored outcome came in about 90% of the time across most horizons, which means roughly one favorite in 10 lost. The authors also note that in a race with more than two viable candidates, a favorite priced at 60 cents should win only about 60% of the time, and that near-perfect hit rates would point to underpriced favorites rather than better forecasting.

Source: Kalshi Research (https://kalshi.com/research/kalshi-research-calibration.pdf)

Brazil’s stock market made a similar bet to that of prediction market odds. After Bolsonaro won the first round, the Ibovespa index jumped almost 8% on Oct. 5, from 192,138 to 206,912, and peaked at a close of 209,067 on Oct. 9. It chopped around this level until after the runoff, when it fell 13.9% in a single session, from 205,083 to 176,608, and kept sliding. As of Oct. 29, it was trading below 170,000 which is about 17% below its pre-runoff close and below where it stood before the first round of the election. The Brazilian Real also lost more than 8% after an election result the market seemingly did not expect. Equity investors didn’t have a secret read on Lula that the prediction markets missed. Everyone seemed to price Bolsonaro as the favorite.

Taking this into consideration, prediction markets worked as a viable hedge. A trader long Brazilian stocks could have bought Lula “Yes” contracts as insurance. A contract priced near 20 cents paid five times the stake, so the Lula position would have paid out many multiples as the Brazilian stock market entered a free fall. A 20% price was never a claim that Lula couldn’t win. It was the market rate for protection against this outcome.

The data suggests prediction markets were not wrong in the way their doubters are claiming. A price of 75% to 80% means the favorite loses one time in four or five, and Kalshi illustrated this is roughly the case in aggregate. Then again, if the election was stolen, as Bolsonaro has claimed, maybe the markets were wrong, at least about the ultimate outcome (even if they were right about his popularity) - Zack Pokorny

Other News

• 🎂 Happy birthday Zcash: seminal privacy coin turns 10

• ‼️ Polymarket halts trading after third-party compromise drains wallets...

• ⁉️ ... and Coinbase client data is breached at third-party vendor Amplitude

• ✅ Bitcoin Core software marked safe in Coinbase frontier model review

• 🔛 DTCC goes live with tokenization service on Canton and Besu...

• 📰👀 ... as mystery group runs full-page anti-tokenization ad in the WSJ

• 🔐 Google previews crypto custody MPC system for institutions

• 🇮🇱 Netanyahu suggests crypto could help Israel bypass potential sanctions

Chart of the Week: Institutions Are Here, But What Kind?

The mix of institutions that hold bitcoin is shifting. Check the 13F filings. Basis traders and macro funds have been selling. Wealth platforms and sovereign funds have been buying. Advisors, family offices, and individuals have been holding.

For more insights, read our recent report on BTC's trading setup and follow @glxyresearch on X.