Oct 30, 2026

An attacker drained about $6.3 billion from Binance hot wallets on Oct 29, Binance's own estimate; TRM Labs puts it at $6.36 billion across ten blockchains, about four times the $1.5 billion Bybit theft of February 2025. Binance says about $3 billion is frozen onchain, that it will cover all losses from its SAFU fund and company funds, and that initial checks point to a compromised DevOps engineer's laptop, with no evidence of a private key leak. Deposits and withdrawals are suspended. Tether and Circle froze roughly $1.57 billion USDT and $800 million USDC (Reuters). Binance.US says it was not affected.

TRM attributes the attack with high confidence to North Korea's TraderTraitor unit; Binance and law enforcement have not confirmed it, so the desk logs the attribution as partially verified.

Why it matters: the theft began about 4:05 pm ET, after the US close, so Thursday's ETF prints predate it and Friday's print is the first institutional read. Bitcoin slid more than 3% and traded below $80,000 (CNBC).

Counter-evidence: contagion looks contained for now. Binance is absorbing the loss rather than users, and 21Shares said on X that its ETPs and ETFs, which include an XRP fund, were unaffected and are held with regulated custodians.

The first theft of the night was on the XRP Ledger: between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP, about $296 million, to a single attacker address, leaving each at its minimum balance (TRM Labs). TRM says the XRP has not moved since, and a ledger read at 11:30 UTC Friday showed the wallet had never sent a transaction (99Bitcoins). Two circulating claims fail against that record: "zero XRP was stolen" is contradicted, and so is "the attacker swapped the XRP out immediately."

Why it matters: XRP is a native asset, so no issuer can freeze it. The stash is about 0.37% of circulating supply (desk calc on 63.35B). While it sits, it is inventory, not executed selling; a transfer to an exchange or OTC desk would be the first sign of realized supply.

Counter-evidence on price: XRP fell to $1.24 by 9:15 am ET Friday (CoinGecko via Crypto Times), but Bitcoin, Ether and Solana fell with it, and Crypto Times reads the move as broad market stress, not selling of the stolen coins. Binance's laptop finding and TRM's account of validly signed transfers on ten chains do not support posts claiming an XRPL amendment was the entry point.

Ripple froze the wallet holding stolen RLUSD at 22:01 UTC, with 40.5 million of the 88.5 million RLUSD taken still inside, after the attacker sold 48 million through decentralized exchanges from 21:42 UTC (TRM Labs). Ripple also froze RLUSD in the compromised Binance hot wallet so new deposits could not be swept. Ripple's SVP of stablecoins Jack McDonald confirmed the company was freezing affected RLUSD (CoinGape).

The widely shared "Ripple froze $200 million" figure comes from Binance co-founder Yi He, who did not name the asset (Reuters). TRM can confirm only 40.5 million RLUSD onchain. The desk logs the $200 million figure as unverified, not contradicted: the hot-wallet freeze could account for some of it, and Ripple has published no total.

Why it matters: RLUSD's freeze control worked 19 minutes after the sales began, but more than half the stolen RLUSD was sold first. The lesson cuts both ways: issuer freezes can claw back stablecoins; they do nothing for native XRP. Ripple's operational response and XRP token demand remain separate variables.

US spot XRP ETFs took in $8.43M on Thursday, Oct 29: Franklin's XRPZ $5.57M and Bitwise's fund $2.86M, with Canary, 21Shares and Grayscale flat (SoSoValue; CoinGlass matches). The two trackers match exactly, which is convergence on one primary print, not two estimates. That lifts the week of Oct 26 to +$4.82M after four prints (desk calc: -$3.61M, zero, zero, +$8.43M). SoSoValue shows net assets of $1.47B, down from $1.51B, and cumulative inflow of $1.81B; CoinGlass shows cumulative inflow of $1.73B, a methodology gap the desk does not blend.

Why it matters for the gauge: XRP Flows sits at WEAKENING. NEGATIVE now needs a Friday outflow larger than $4.82M; NEUTRAL needs about $34.96M Friday to reach the $39.78M reference (desk calc). Both remain possible because Friday is the first session after the hack.

Counter-evidence: the inflow came before the theft, and net assets fell even as money came in, so price, not redemptions, drove the asset decline. The print posts after Friday's close and is read in Saturday's week-ending summary.

The Bank of Japan held its policy rate at 1.25% in an 8-1 vote, with Hajime Takata dissenting for 1.5%, and said underlying inflation is "generally consistent" with its 2% target for the first time since adopting it in 2013 (CNBC). It raised its 2027 core inflation forecast to 2.6% and stressed readiness to keep raising rates (Reuters). Commerzbank sees a December hike as almost fully priced (FXStreet).

The yen rose as much as 0.4% to 157.12 per dollar (Bloomberg), then gave it back to about 157.70 as Governor Ueda called financial conditions accommodative and flagged FX, AI and the Middle East as risks (Alo Japan). The 10-year JGB yield fell to 2.78% (Trading Economics).

Why it matters for Yen Carry: the worsening arrow resolves on a USD/JPY close below 156, about 1.70 yen away, or fires ELEVATED on a close above 160. A December BOJ hike alongside a December Fed hike, priced near 75% to 80%, moves both legs of the rate gap up, so the policy split alone does not narrow carry.

Counter-evidence: SMBC's FX strategist called Takata's dissent unlikely to be a major market catalyst (Reuters), and the pair ended Asia near flat on the day.

CENTCOM commander Adm. Brad Cooper briefed Trump in person Thursday on options for resuming major combat against Iran, with Hegseth and Gen. Caine present, the WSJ reported; the Pentagon and CENTCOM declined to comment (Anadolu Agency). The Journal also reports Gulf states were told to prepare for a short, intense campaign after the Nov 3 midterms (Report.az, citing WSJ).

The diplomatic track ran the same day: Qatari mediators returned to Tehran Friday in talks coordinated with Washington, an official told Reuters (Al Jazeera), and envoy Tom Barrack told CNN the sides were "very close" to a deal to ease tensions (Around Prague, citing CNN). Against that, Iran's parliament speaker Ghalibaf said progress rests on acceptance of Iran's seven conditions (ANI), and a senior Iranian official called Qatar's draft unacceptable (Reuters via Rallies).

Why partially verified: the briefing rests on the WSJ's sourcing plus a Jerusalem Post source; there is no official readout, and no strike date or talks date exists. Why it matters: this binary sits under Oil Shock and Hormuz, both at the top of their scales, and neither gauge moves on intentions, only on settlements and transits.

The 10-year Treasury par yield closed 4.98% Thursday, down 7 bp, back under 5%, while the 30-year closed 5.32%, down 5 bp, and the 2-year 4.61% (U.S. Treasury par curve). Yields fell further Friday morning, with the 10-year near 4.93% and the 30-year near 5.29% (CNBC). The 20-year at 5.35% sits above the 30-year.

The rally came despite September PCE at 3.6% and a hawkish Fed hold. CME FedWatch still prices a December hike near 75% to 80% (FXStreet; BlockBeats via KuCoin). Coverage tied the bid to a tech selloff after Alphabet's results and safe-haven demand that bypassed the dollar (FXStreet).

Why it matters for Bond Stress: ORANGE holds. RED needs a 30-year close above 5.50, now 18 bp away; YELLOW needs a close below 5.00 in a week with no long-end buyback, and buybacks run to Nov 4. MOVE, a tracked input, closed 93.54, down 1.01 (Yahoo Finance).

UKMTO says a small boat attached two explosive devices to an outbound tanker's hull about 25 nm northeast of Khasab late Thursday, starting an engine-room fire that briefly disabled it; the crew is safe and the vessel continued its voyage (Reuters via Arab News; ANI). Three maritime security sources named it the Panama-flagged Louise 1 and called it the first successful limpet-mine use in the strait since the war began (Reuters via Aaj News). UKMTO separately logged an outbound tanker struck by an unidentified projectile Thursday (Safety4Sea). No attacker has been named.

Iran's IRGC Navy claimed Friday that a supertanker carrying more than 2 million barrels hit a mine on an "unauthorized route" and is burning (Izvestia, citing IRIB). No UKMTO notice or operator statement confirms it, so the desk logs it as unverified.

Why it matters: Hormuz holds at DISRUPTION. The improve test needs five sessions at or above the ten-day transit average with no new vessel strike; Thursday's attacks keep that count at zero.

The Houthis said Thursday they attacked Ras Tanura, the Rabigh refinery and an Aramco facility in Abqaiq, plus airports in Riyadh and Dammam (Reuters via Jerusalem Post). Saudi authorities have not confirmed any strike; the coalition said it intercepted a cruise missile aimed at the west of the kingdom (CNBC). Abqaiq is the plant whose 2019 attack forced a temporary shut-in of over 5.5 million b/d (Argus Media).

December Brent settled $114.88, down 44 cents, the day before its expiry, with WTI at $102.00 (CNBC). The January contract closed $110.80 and traded near $113.4 Friday (Nation Thailand; Trading Economics). January becomes front month after Friday, so the gauge reads a contract about $4.08 lower from Monday, a roll effect, not a price signal.

Why it matters: Oil Shock stays at SHOCK. The improve test needs a front-month settle below $90.00: $24.88 away on December's settle, $20.80 on January's (desk calc). Brent is on course for a 14% monthly gain (CNBC).

Currenc Group reinstated the sale of its 60% of Tranglo to New Margin for $400 million, moved the longstop to Mar 31, 2027, and agreed in principle to pursue 100% for $666.7 million (GlobeNewswire). Under that proposal Ripple Markets APAC would receive about $266.7 million for its 40% stake, paid directly to it, and a Singapore judgment Ripple's unit holds against Currenc's subsidiary, $23.95 million in principal, would be settled from the first $200 million tranche (StockTitan).

What it is not: Ripple's unit is not a party to the reinstatement letter, and New Margin has no obligation to buy its shares until a tripartite agreement is signed, targeted for Dec 31, 2026 (Investing.com). No standstill has been agreed, so Ripple's unit can still enforce its charging order. Conditions include Tranglo's licence renewal, regulatory approvals and New Margin's funding.

Why it matters: a sale would monetize Ripple's 2021 stake in an Asian remittance partner that adopted its On-Demand Liquidity product (Ledger Insights). It is a Ripple corporate event, not an XRP demand signal.