Attack on Binance? Crypto meltdowns are starting to rhyme

This is a segment from the Empire newsletter. To read full editions, subscribe.

---

Today’s subject is an unsolved mystery of crypto market microstructure. We only have so many facts, and we’ll likely never know all the details.

To get up to speed with the fundamentals of what happened over the weekend, I recommend the Empire livestream from Sunday with Doug Colkitt, as well as Doug’s helpful X thread on Auto-Deleveraging.

For those wanting the quick and dirty headline summary, here goes. 

For some silly reason, Binance was using spot prices to value three tokens accepted as collateral for margin positions — liquid staking derivatives wBETH and BNSOL, alongside Ethena’s synthetic dollar USDE.

Not exactly a problem when Binance’s order books for those tokens were thick with bids on either side. But they’d quickly dried up around the time that bitcoin and other coins started dumping on word that Trump’s trade war with China would persist, leading prices to slip well below par, and in the case of the two staking derivatives, almost to zero.

Bad news for anyone using the affected coins as collateral for margin trading on Binance. Suddenly their collateral wasn’t considered valuable enough to cover their position — even though prices remained much more stable elsewhere — and they were liquidated. 

At the same time, leveraged traders on perps DEXs like Hyperliquid, many incentivized to take margin by points campaigns for airdrops, were also hit as a result of second-order price effects. 

So, if you’re after an analogy, it’s easiest to consider Binance as the epicenter of an earthquake. Had Binance valued USDE, wBETH and BNSOL using an index or some other pricing system, rather than its own illiquid spot markets, maybe there would have been no earthquake at all. The Ethena protocol was still redeeming USDE tokens for $1 value throughout the entire ordeal, for instance.

Now comes the mystery: As Colin Wu pointed out earlier this week, Binance had, only days before the liquidation quake, publicly announced that it would be reconfiguring its price oracles away from its own spot markets for wBETH and BNSOL “to minimise the risk of depegging.”

Hypothetically, that opens the door to the whole situation amounting to a coordinated attack on Binance (or one of its market makers). 

Whether Binance knew it or not, the announcement made it clear that there was a structural weakness in the way its oracles were valuing certain tokens used as collateral. Any malicious whale with a decent-enough position in the implicated spot markets could (again, hypothetically) dump enough coins to depeg those assets, triggering liquidations that shouldn’t be triggered at all.

Which, I suppose, could be the case. But for such a plan to work, it would take knowing that the order books were so thin that prices would actually collapse under a certain amount of acceptable selling pressure applied by the malicious whale. 

As it so happens, there is data that suggests that this might’ve been possible. 

The tip off came from an X poster by the name of Benson Sun, who has been unpacking the implications in a series of articles. Sun wrote that between 21:18 and 21:20 UTC, Binance underwent an “abnormal, synchronized withdrawal of liquidity,” through which “order books were nearly drained, leaving the market in a brief but total vacuum.”

Indeed, bid and ask volumes on Binance’s BTC/USDT market evaporated by more than 95% between 21:13 and 21:22, per Blockworks Research data and as shown on the chart below. The orderbooks were drained almost completely in under 10 minutes and would take the better part of an hour to recover to reasonable levels.

Binance, meanwhile, compensated liquidated users affected by localized depegs that occurred between 21:36 UTC and 22:16 UTC. 

Which makes sense: The depegs had started around 21:40 UTC, with the worst of it coming about 10 minutes later. Trump’s announcement of potential additional tariffs on China came 20 minutes after that, at 20:00 UTC, on Truth Social. 

Curiously, two Hyperliquid accounts got ahead of the news by shorting bitcoin and ether minutes before that post, leading to $160 million profits.

Were those traders the same whales who might’ve intentionally crashed prices on Binance after they simultaneously pulled their chips off the table, imploding markets that they themselves turned illiquid? Was that a strategy to profit even more from their shorts, fueled by the tears of liquidations across the exchange ecosystem?

We’ll never know without Binance publicly releasing details of how their largest traders operated around the time of the crashes (which would never happen). 

But remember the part about pattern recognition: In a separate post, another analyst catalogued four other instances of attacks on oracles prone to manipulation since late 2020, including bZx, Harvest Finance, Compound and Mango Markets.

So the $19 billion question of whether a single culprit caused the chaos might be a misnomer. It was a situation that could’ve easily been caused by just one person. 

Whether or not they intended to trigger the situation is the real kicker. And it doesn’t take a tinfoil hat to suggest that exchange operators (CEX or otherwise) would do well to consider this a coordinated attack in any case. 

Fingers crossed, at least.

---

Get the news in your inbox. Explore Blockworks newsletters:

• The Breakdown: Decoding crypto and the markets. Daily.
• 0xResearch: Alpha in your inbox. Think like an analyst.
• Empire: Crypto news and analysis to start your day.
• Forward Guidance: The intersection of crypto, macro and policy.
• The Drop: Apps, games, memes and more.
• Lightspeed: All things Solana.
• Supply Shock: Bitcoin, bitcoin, bitcoin.