Binance Is 38.7% of Spot Volume and 0% of the Index Price. The Hack Proved It by Accident.

On 29 October 2026, starting at 4:05 p.m. New York time, attackers took roughly $6.3bn out of Binance's hot wallets across ten blockchains. The core of the theft took about twenty minutes. It is the largest crypto heist on record, more than four times the $1.5bn Bybit hack of 2025, and the exchange it hit handles 38.7% of all centralised spot trading volume.

Binance halted trading and withdrawals. For roughly forty hours, the biggest venue in crypto was dark.

So here is the question worth asking, and it is not the one most coverage asked. Binance is where a large share of crypto price discovery happens. Index funds price their holdings from exchanges. What did the index print do while the largest exchange in the world was closed?

Almost nothing. And the reason is a detail buried in a methodology document that approximately nobody reads: Binance is not one of the exchanges the index prices from. It never was.

That turns out to be two separate stories. One is a deliberate design choice that worked exactly as intended. The other is a gap in the rules that this event happened to miss, and that a slightly different event would have walked straight through.

TL;DR

• Binance is not a pricing source for the Nasdaq Crypto Index. Its six Core Exchanges are Coinbase, Kraken, Bitstamp, Gemini, itBit and LMAX Digital. Binance carries 38.7% of centralised spot volume and 0% of the index price calculation.
• BNB is not in the index baskets either. It is the third largest cryptoasset at $92.8bn, ahead of XRP, and it is absent from a fund that describes itself as the ten largest crypto assets. It fell 8.7% in an hour on the news. Index holders owned none of it.
• Neither methodology has a rule for an exchange that halts. They have rules for a stale order book and for a venue with no trades in 30 days. A deliberate trading halt is covered by neither, and falls through to the staleness check by luck rather than design.
• The dangerous case is the one still open. An exchange that keeps printing trades while withdrawals are frozen cannot be removed automatically. The anomaly penalty is floored at the square root of 1/K, so with six Core Exchanges a venue printing decoupled prices keeps 40.82% of its weight.
• The damage arrived through flows, not prices. US spot bitcoin ETFs lost $643m in one day, then $399m more on 2 November. IBIT alone shed $405m, its worst day since June. Customers pulled $4.72bn out of Binance after it reopened.
• The question to ask an index provider is not what it holds. It is which venues it prices from, and what the published rules do when one of them stops.

What happened, in the order it happened

The timeline matters because the index question turns on how long the venue was unavailable and in what way.

Attackers moved first on the XRP Ledger at 4:05 p.m. ET on 29 October, and the final Ethereum transaction landed at 7:56 p.m. The haul broke down as roughly $3.8bn in ether, 18,270 bitcoin worth about $1.5bn, $628m on TRON, $296m in XRP and $96m on Solana. One single transaction moved more than $2.5bn. Evidence suggests the attackers had prepared for at least 36 hours before they moved.

CEO Richard Teng pointed to EIP-7702 being used against the hot wallet infrastructure. Binance had initially blamed a compromised engineer's laptop. TRM Labs attributed the attack to North Korea, specifically to TraderTraitor, part of the Lazarus Group, and the FBI published the relevant ether, bitcoin and solana addresses.

The stablecoin issuers moved faster than anyone. Tether froze wallets at 5:01 p.m. ET, 56 minutes after the first transaction. Circle followed three minutes later. Of the $6.3bn, roughly $3bn ended up frozen, about $1.5bn sits in forms that cannot be frozen, and roughly $1.8bn remains with the attackers.

Binance halted trading and withdrawals on 29 October, said on 30 October that it would cover all customer losses and set aside $6bn against them, said on 31 October that 90% was replenished, and resumed withdrawals on 1 November, starting with ether, USDT and USDC. The money came from the Secure Asset Fund, the Futures Insurance Fund, its bitcoin reserve and corporate treasury.

Bitcoin fell below $77,000 on the day. BNB dropped 8.7% in a single hour. That is the whole market event, and on its face it should have been an index event too.

The index price never saw it

Here is the part that changes how you read the whole episode.

The Nasdaq Crypto Index, which the Hashdex Nasdaq Crypto Index US ETF tracks, does not calculate prices from the whole market. It calculates them from a closed list of venues called Core Exchanges. There are six of them: Coinbase, Kraken, Bitstamp, Gemini, itBit and LMAX Digital.

Binance is not on the list. Neither is Bybit, OKX, or any of the offshore venues that carry most of the world's volume.

To get on that list, an exchange has to show effective AML and KYC controls, licensing by an independent public governing body, working trade surveillance, robust infrastructure, and a commitment to cooperate with regulators and law enforcement. Those are not volume criteria. They are governance criteria, and they produce a venue list that looks nothing like a volume ranking.

The consequence is stark when you put the two numbers next to each other. In the second quarter of 2026, the top ten centralised exchanges traded $1.95tn of spot volume, and Binance was 38.7% of it, around $755bn. Its contribution to the index price was zero. The largest price-discovery venue in the asset class is structurally invisible to the benchmark that the ETFs settle against.

Bitwise, whose BITW is the oldest and largest crypto index fund, gets to a similar place by a different route. It prices from Lukka Prime, uses the CME CF reference rate for one of its indices, and screens venues on jurisdiction, fee structure and a 1% minimum share of trailing 30-day volume. It also excludes venues that run trade mining, which is to say venues that pay people in their own token to trade.

So when Binance went dark, the index arithmetic did not notice. There was no stale price to clean up, no venue to drop, no weight to redistribute. The hack was, from the index's point of view, news about a company it does not do business with.

That is a real design win, and it is worth saying so plainly. The post-FTX insistence on regulated pricing venues, which cost index providers a lot of apparent volume and attracted a lot of criticism for being unrepresentative, did the job it was built to do on the first serious test.

The basket did not hold the token either

The second exposure channel is simpler and more surprising.

BNB is the third largest cryptoasset by market value at $92.8bn, ahead of XRP at $79.38bn and well ahead of Solana at $55.71bn. It is the native token of the exchange that just lost $6.3bn, and it fell 8.7% in an hour on the news.

It is in none of the broad crypto index funds.

BITW holds ten assets: bitcoin at 77.38%, ether at 13.85%, then XRP, Solana, Hyperliquid, Cardano, Chainlink, Stellar, Litecoin and Sui. The fund's own description is the ten largest crypto assets. It reaches down to Sui at 0.16% and Litecoin at 0.21%, and skips the number three asset entirely. NCIQ, with 19 holdings, does not show BNB either.

Why not is the interesting bit, and the honest answer is that the methodology does not say. Bitwise's published criteria exclude stablecoins, memecoins, privacy coins in one index, assets with known security vulnerabilities, and assets the committee judges to carry undue risk of violating US federal securities laws. Exchange tokens are not named anywhere as a category. Custody is a hard screen: an asset has to be held by a third-party custodian regulated as a federally chartered bank or a state trust company.

So the most likely explanations are a securities-law judgment call and a custody constraint, and both of those are committee decisions rather than published rules. You cannot read the methodology and derive BNB's exclusion from it. Someone decided.

That is worth sitting with. The single thing that kept index investors from holding the hacked exchange's token through the hack was a discretionary judgment, not a rule. It was the right judgment. It is also not something you could have verified in advance, and not something you can rely on repeating.

Note that the exclusion is not a market-cap artefact either. BNB has been listed on Coinbase, Kraken and Gemini since the regulatory thaw, so it clears the two-Core-Exchange test that Nasdaq applies. On size alone it belongs in every one of these baskets. We walked through how cap weighting normally determines these baskets in our comparison of crypto indices.

Now the uncomfortable part

Everything above says the index came through fine. The rules are where it gets less comfortable, because what protected the print was not a rule about exchange failure. There is no rule about exchange failure.

Read the Nasdaq methodology for what happens when a Core Exchange breaks, and you find exactly three mechanisms.

Staleness. If the order book retrieved from a Core Exchange is not fresh to within 30 seconds, that exchange is omitted from the calculation and the weights are redistributed across the rest. If no valid book is available at all, the last valid price carries forward.

Thirty-day inactivity. If a Core Exchange shows no transactions during the pricing window for all of the previous 30 days, its volume factor is set to zero and it is removed from the calculation.

Anomaly penalties. Each exchange gets scored on price, volatility and normalised volume against the peer median. Venues inside one standard deviation are included at full weight. Venues outside it get down-weighted.

Now check that list against what Binance actually did. It halted trading for about forty hours. Not 30 seconds of lag, and nowhere near 30 days of silence.

A forty-hour halt is caught by the staleness rule, because an order book stops updating when trading stops. But it is caught incidentally. The staleness rule exists to handle a dropped API connection, and it happens to also handle a deliberate suspension. Nothing in either methodology says what to do when an exchange announces it has been robbed and is closing. CF Benchmarks' guide is the same: it has fallbacks for a missing price source and a procedure for a failed calculation, and no exchange-level rule for a halt, a withdrawal freeze or an insolvency.

What both documents have instead is a clause allowing intra-quarter changes to protect index integrity during exceptional events, with committee approval. Which is to say: a human decides, after the fact, with no published trigger and no published deadline.

The case the rules actually miss

A venue that goes completely dark is the easy failure. The hard one is the venue that keeps trading.

Picture the same event with one difference. Binance suspends withdrawals but leaves the matching engine running. This is not hypothetical. It is the Mt. Gox pattern of 2014 and the FTX pattern of 2022, and it is the single most common shape of exchange failure in this industry's history.

Now the order book is fresh. Trades are printing every second. Volume looks normal or elevated. The staleness rule does not fire, because nothing is stale. The 30-day rule does not fire, because there are plenty of trades. What happens instead is that the price on that venue stops being arbitrageable, because you cannot move an asset out to capture the spread. Prices on a frozen venue drift away from everywhere else, sometimes to a large premium and sometimes to a steep discount, and they stay there.

The only automatic defence against that is the anomaly penalty. And the anomaly penalty has a floor.

The methodology states that each adjustment factor is mathematically bounded below by the square root of 1/K, where K is the number of contributing Core Exchanges. Its own worked example uses four exchanges with all three metrics penalised and arrives at one eighth of base weight. That checks out arithmetically, which confirms the reading.

Apply it to the real list of six. A venue flagged as anomalous on price alone retains 40.82% of its base weight. Flagged on price and volatility, 16.67%. Flagged on all three, 6.80%.

Which case would a frozen-but-trading Binance fall into? Its price would be anomalous. Its volume might well look normal, since panic trading tends to raise volume rather than lower it, and its realised volatility might sit inside one standard deviation of a market that is itself moving hard. Realistically that is one penalised metric, possibly two.

So the automatic rules would leave a broken venue carrying somewhere between 17% and 41% of its normal weight in the index price, indefinitely, until a committee met and chose to remove it. The penalty system cannot take any venue to zero. It is designed to down-weight noise, not to excise a venue that has stopped being a market.

The reason this did not matter in October is that Binance was never a Core Exchange in the first place. Both lines of defence point the same way, and only one of them was built on purpose.

Where the damage did land

None of this means index investors were untouched. It means the transmission channel was not the one everyone watches.

US spot bitcoin ETFs lost $643m in a single day after the hack, ending a four-day run of inflows. On 2 November they lost another $399m, a second consecutive day of outflows, with BlackRock's IBIT alone shedding $405m, its largest daily outflow since June. Bitcoin dipped to $76,300 on 3 November, having clawed back toward $78,600 the day before.

Meanwhile customers withdrew a net $4.72bn from Binance after it reopened, up from $3.64bn on the first day alone. Nearest-dated bitcoin implied volatility rose to about 51% from 43.5%. Futures volume jumped 51% to $168.1bn while open interest fell 1.63%, which is the signature of position closing rather than new bets. CoinMarketCap's fear and greed reading sat at 34, in fear, which is the kind of move the index is built to register. We took that gauge apart in our breakdown of the fear and greed index.

So the index price held and the index investors sold. The arithmetic was never the fragile part. Confidence was.

The question to ask your index provider

Most due diligence on an index product asks what it holds and what it charges. Both are published, both are easy, and neither would have told you anything useful about this event.

The questions that would have are these, and they are answerable from public documents in about twenty minutes:

Which venues does the index price from? Not which assets it holds. Which exchanges contribute to the number. For the Nasdaq Crypto Index that is six named venues, and the biggest exchange in the world is not among them.

How many are there? This matters more than it looks, because the anomaly floor is the square root of 1/K. With two contributing venues, a bad one keeps 70.71% of its weight. With eight, 35.36%. Fewer venues means a broken venue hurts more, and a short list is not automatically a safe list.

What fires automatically when a venue stops behaving, and what needs a committee? If the answer to the second half is "most things", you are holding a product whose crisis behaviour is discretionary. That is not disqualifying. Discretion handled this event well. It is just not the same as a rule, and it should not be described as one.

Is the price source the same as the custody venue? Pricing from regulated venues and custodying with regulated custodians are separate screens that happen to overlap heavily. Where they overlap, a single failure hits both.

We publish the pricing venues, constituent counts and rebalance rules for each major index on the Cryptoindex indices page, with the construction logic in our methodology. If you want to see what a basket does when one pricing venue is removed or one constituent is excluded, you can rebuild and replay it in Cryptoindex Pro. The standing caveat on any backtest applies: no trading costs, every fill at the printed price, and assembled with hindsight about how the story ended.

The broader point is the one this event made cheaply, which is the best way to learn anything. The largest exchange failure in crypto history passed through the index layer almost without trace. Partly that was good design being vindicated. Partly it was a gap in the rules that this particular event did not happen to find. Knowing which is which is the whole job.

FAQ

Did the Binance hack affect crypto index funds? Not through the index price. Binance is not one of the six Core Exchanges the Nasdaq Crypto Index prices from, and BNB is not held by the broad index funds, so the two direct channels were both closed. Index funds were affected through flows instead: US spot bitcoin ETFs lost $643m in one day after the hack and $399m more on 2 November.

Which exchanges do crypto indexes price from? The Nasdaq Crypto Index uses six Core Exchanges: Coinbase, Kraken, Bitstamp, Gemini, itBit and LMAX Digital. Bitwise prices from Lukka Prime and uses the CME CF reference rate for one index. Eligibility turns on AML and KYC controls, licensing, trade surveillance and regulatory cooperation, not on trading volume.

Is Binance used to calculate crypto index prices? No, not for the major US-listed index products. Binance handled 38.7% of centralised spot volume in the second quarter of 2026 and contributes nothing to the Nasdaq Crypto Index calculation, because it does not meet the Core Exchange governance criteria.

Why is BNB not in crypto index funds? The published methodologies do not say. BNB is the third largest cryptoasset at $92.8bn and clears the listing tests, so its absence is not a size or liquidity outcome. The most likely causes are the custody screen, which requires a regulated bank or trust-company custodian, and the committee's judgment on US securities-law risk. Both are discretionary rather than rule-based.

What happens to a crypto index if an exchange halts trading? If the order book goes stale by more than 30 seconds, that exchange is omitted and weights are redistributed. There is no rule written specifically for a halt. A venue that keeps trading while withdrawals are frozen is the harder case: it can only be down-weighted by the anomaly penalty, which is floored at the square root of 1/K, so with six contributing exchanges it retains at least 40.82% of its weight until a committee removes it.

How much was stolen in the Binance hack? Roughly $6.3bn across ten blockchains on 29 October 2026, including about $3.8bn in ether and 18,270 bitcoin worth around $1.5bn. About $3bn was frozen, mostly by Tether and Circle within an hour. It is the largest crypto theft on record, more than four times the $1.5bn Bybit hack of 2025.

Did bitcoin crash after the Binance hack? Bitcoin fell about 5% to below $80,000 on the day, traded below $77,000, recovered toward $78,600 on 2 November and dipped to $76,300 on 3 November. The move was smaller than the size of the theft would suggest, and the persistent pressure has come from ETF outflows rather than from the hack itself.

Sources

Primary documents, read on 3 November 2026:

• Nasdaq Crypto Index methodology, including the Settlement Price Methodology steps that define the anomaly penalties, the order-book staleness rule and the 30-day inactivity rule. indexes.nasdaq.com
• Nasdaq Crypto Index overview, which names the six Core Exchanges and six Core Custodians and lists the Core Exchange criteria. indexes.nasdaqomx.com
• CME CF Emerging Crypto Index methodology, for the pricing-source fallback and calculation-failure provisions. docs.cfbenchmarks.com
• Bitwise Crypto Asset Index methodology, for asset eligibility, custody requirements and the exclusion list. bitwiseinvestments.com
• Hack timeline, amounts, attribution and freeze figures: 2026 Binance hack, with market reaction from CoinDesk, 2 November and CoinDesk, 3 November.
• Exchange volume shares, Q2 2026: AMBCrypto.
• Market values as of 2 November 2026: Forbes Advisor. Fund holdings as reported for BITW and NCIQ.

One figure in this piece is ours rather than anyone's reporting. The anomaly floor of 40.82% at six contributing exchanges is calculated from the published formula, and checked against the methodology's own worked example of four exchanges with all three metrics penalised, which the document states gives one eighth of base weight. The square root of 1/4 cubed is exactly 0.125, so the reading is confirmed.