[Xangle Comment] Binance Security Incident and ICE’s Move into Perpetual Futures

 

1. Binance Suspends Withdrawals and Investigates Large-Scale Asset Outflows

Key Developments

• Estimated impact of $6.3 billion; approximately $3 billion frozen: In an official notice on October 30, Binance estimated the impact of the security incident at approximately $6.3 billion and said it had frozen roughly $3 billion in related funds with blockchain partners.
• Possible compromise of a DevOps engineer’s laptop: The initial investigation suggested that a compromised laptop may have enabled access to service containers and the submission of unauthorized withdrawal transactions. Binance found no evidence of wallet private-key leakage and revoked authorizations for affected addresses.
• SAFU and company funds to cover all losses: Binance plans to cover the losses in full and update its Proof of Reserves (PoR) after remediation. It is working with law enforcement and blockchain analytics firms to trace and recover funds.
• Deposits operating normally; withdrawal resumption targeted within 48 hours: In a further update at 1:17 p.m. KST on October 30, Co-CEO Yi He said deposits remained operational while the team improved withdrawal services and related address controls. Binance aims to begin resuming withdrawals within 48 hours of that announcement.

 

Xangle Comment

Binance estimated the impact of the security incident at approximately $6.3 billion and said around $3 billion in related funds had been frozen onchain. It also confirmed that the SAFU fund and company funds would cover all losses. Its initial investigation suggested that a compromised DevOps engineer’s laptop may have enabled access to service containers and the submission of unauthorized withdrawal transactions. Co-CEO Yi He subsequently said deposits were operating normally and that Binance aimed to begin resuming withdrawals within 48 hours of the update.

Binance also lost 7,000 BTC, worth approximately $40 million at the time, in a hot-wallet hack in May 2019. It pledged full compensation through SAFU, suspended deposits and withdrawals for roughly a week, and resumed services after security checks and system improvements. Bybit, which suffered a theft of approximately $1.46 billion in February 2025, replenished its reserves through borrowing and large inflows, restoring 1:1 backing for customer assets within about 72 hours.

Binance’s publicly disclosed SAFU Bitcoin wallet holds approximately 15,000 BTC, worth about $1.16 billion at the price checked. The estimated impact of this incident exceeds that fund’s value by more than five times, although funds equivalent to approximately 48% of the total impact have been frozen. The eventual loss will depend on the return of frozen funds and further recoveries. Binance plans to use both SAFU and company funds to cover it.

A series of hacks targeting major exchanges and onchain services has heightened security concerns. Advances in AI could place further pressure on cybersecurity across finance by lowering the cost of finding vulnerabilities and automating attacks. As traditional finance and crypto become more closely connected, more assets become potential targets. In an environment where incidents cannot be eliminated entirely, prevention must be accompanied by agreements on who can intervene after an incident, how funds can be recovered, and who bears the losses.

Traditional finance has established institutions and legal procedures for attempting fund recovery through identified accounts, payment freezes, seizures, and restitution. Onchain, the scope for intervention varies with the asset’s design. In this incident, Tether and Circle used issuer powers to restrict token transfers from specific addresses, while the Arbitrum Security Council also intervened to freeze related funds. Bitcoin has no central operator with equivalent powers. An exchange can restrict deposits, trading, or withdrawals involving related funds on its own platform, but cannot prevent Bitcoin from moving between addresses outside the exchange.

This presents a paradox for crypto. The freedom to hold and transfer assets without a central institution’s permission has been an important driver of its growth. Yet broader adoption by investors and financial institutions also creates demand for powers and responsibilities that help resolve losses. An asset that grew through freedom may find that protecting its trust and utility requires limits on decentralization.

How intervention powers and responsibilities are agreed upon after an incident is therefore likely to become more important. Issuers or operators could be granted freeze and recovery powers. Alternatively, transaction finality could be maintained while exchanges and custodians take greater responsibility for compensating losses. Network-level intervention, such as the hard fork following Ethereum’s DAO incident, also requires agreement among participants. Alongside advances in security technology, agreement on when to intervene, how far intervention should go, and who is responsible will play an important role in blockchain’s broader adoption and integration into regulated finance.

---

 

2. ICE and Trade[XYZ] Pursue U.S. Perpetual Futures Markets Built on Hyperliquid

Key Developments

• NYSE parent ICE makes a strategic investment in Trade[XYZ] and agrees to develop markets: On October 29, ICE and Trade[XYZ] announced an agreement to bring Hyperliquid-based perpetual futures to the United States. ICE plans to acquire a minority stake in Trade[XYZ] and exclusively operate the new regulated markets. The investment amount and ownership percentage were not disclosed.
• Plans for 24/7 trading across equities, indices, commodities, FX, and crypto: The companies plan to establish a separate trading and clearing structure, subject to approvals including those from the U.S. Commodity Futures Trading Commission (CFTC). The primary audience is retail customers seeking exposure to price movements across asset classes through derivatives without an expiry date.
• Customer access planned through futures commission merchants and the ICE–OKX joint venture: Customers completing identity verification and anti-money-laundering procedures would trade through participating futures commission merchants (FCMs) and other channels. The ICE–OKX joint venture is also planned as a distribution channel, with its brokerage licensing process proceeding separately.
• Existing HIP-3 markets to continue alongside the U.S. initiative; no U.S. launch date announced: Trade[XYZ] plans to continue operating and expanding its existing Hyperliquid markets while building a separate U.S. market. According to the company’s own figures, its existing markets exceeded $650 billion in cumulative trading volume over approximately their first year.

 

Xangle Comment | Hyeongseok Lim

ICE, the parent company of the New York Stock Exchange, is seeking to bring onchain perpetual futures into the U.S. regulatory framework. It is investing in Trade[XYZ], which operates markets on Hyperliquid, and has agreed to exclusively operate the U.S. regulated markets. A separate trading and clearing structure is being pursued for this purpose. A traditional financial operator with experience running futures exchanges and clearinghouses is now moving directly into the operation of onchain markets.

Trade[XYZ] has used Hyperliquid’s HIP-3 to offer perpetual futures tracking assets such as the S&P 500 index and gold. Under HIP-3, outside operators design products and launch markets, while Hyperliquid supports order execution, margin processing, and related functions. In this collaboration, Trade[XYZ] will design and implement products, Hyperliquid will provide the underlying technology, and ICE will operate the regulated markets. Subject to regulatory approval, U.S. retail investors would be able to trade through FCMs and other intermediaries.

This is not ICE’s first move into onchain markets. It invested in global crypto exchange OKX in March, and their joint venture, OKXICE, is preparing a tokenized equity trading market under the SEC’s innovation exemption framework. The plan is to allow approved investors to buy and sell equities using decentralized trading technology. By pursuing tokenized equity spot trading with OKX and perpetual futures with Trade[XYZ], ICE is positioning itself early in the U.S. onchain trading market.

ICE is accelerating its move into onchain markets through investments and partnerships in both tokenized equities and perpetual futures. Meanwhile, progress toward comprehensive U.S. market rules remains difficult, with political disagreements preventing the CLARITY Act from advancing to Senate consideration. Against this backdrop, ICE is pursuing its businesses through the SEC’s innovation exemption and individual licensing processes. As onchain trading expands into regulated U.S. markets, the ability to meet regulatory requirements and operate markets will become increasingly important alongside technical and product development capabilities. Traditional financial operators such as ICE are therefore likely to expand their onchain presence by drawing on their market operating experience and regulatory expertise.

 

References

• Trade[XYZ] — Official website and article image
• AP — Reporting on the Binance security incident
• Binance — Update on approximately $3 billion in frozen funds
• CZ — Statement on the suspected hack and protection of customer funds
• Blockaid — Estimated asset outflows and analysis of EIP-7702 and signing-authorization abuse
• Yi He — Arbitrum Security Council intervention to freeze approximately $30.5 million
• Yi He — Deposits operating normally and withdrawal resumption targeted within 48 hours
• Public SAFU Bitcoin wallet — Approximately 15,000 BTC balance
• Bybit — Incident timeline and affected assets / Announcement of restored customer asset backing within 72 hours
• IMF — Advances in AI and cyberattack risks across finance