Thematic Pillar Hub · 1 Published Briefings
orderbook-liquidity institutional intelligence, quantitative benchmarks, primary regulatory filings, and market structure analysis from FXOpen Ledger. Dissecting on-chain liquidity depth and slippage as the $6.3 billion attacker routed funds across 10 blockchains, Aave pools, and THORChain swaps—commingling with prior $388 million Bitget exploit proceeds.
Curated by Alistair Kerr, CFA (CFA, Former G10 Prime Brokerage & OTC Liquidity Desk Head) · Fact-checked by FXOpen Ledger Institutional Review Board
Dissecting on-chain liquidity depth and slippage as the $6.3 billion attacker routed funds across 10 blockchains, Aave pools, and THORChain swaps—commingling with prior $388 million Bitget exploit proceeds.
Approximately $6.3 billion was drained across 10–11 blockchains in a 20-minute window, making it the largest crypto heist in history. Stablecoin issuers (Tether, Circle, Ripple, World Liberty Financial) and protocol security councils rapidly froze roughly $2.5 billion to $3.0 billion on-chain.
Preliminary investigations indicate the attackers compromised a DevOps engineer's laptop to access an internal service container connected to wallet-signing infrastructure, and used a single EIP-7702 smart-account delegation on Ethereum to sweep funds.
TRM Labs, Chainalysis, and Elliptic attributed the breach with high confidence to North Korea's TraderTraitor unit. On-chain investigator ZachXBT demonstrated that stolen funds routed through THORChain commingled in the exact same address cluster as the $388 million September 2026 Bitget exploit.
Co-CEOs Richard Teng and Yi He confirmed that 100% of losses are covered by the SAFU fund and corporate reserves, with withdrawals expected to resume within 48 hours. For FXOpen Ledger, the core analytical focus is Automated market maker (AMM) depth depletion, cross-chain router congestion, and CEX-to-DEX orderbook spread widening.
