On October 29th 2026, more than $6b left Binance hot wallets in roughly two hours, in what is the largest crypto hack on record. Within 90 seconds of the first sign of contagion, KPK's exit agents pulled USDC out of three at-risk Morpho markets, ahead of every other curator in those markets, with no human signature.

The response was not a one-off. Once an alert fired, each of the twelve automated de-risking transactions were mined within 4 to 84 seconds, across KPK curated Vaults and Funds.

• Vaults: KPK made the first exit on affected markets, 9 minutes before any other curator on Morpho. The exit came 72 seconds after contagion reached those markets, as USDT traded at a discount, and 39 minutes after the first Binance outflow. Of the 19 other vaults analysed, five followed within 35 minutes of KPK, while eleven had not acted by midday the next day. Within hours, every one of the affected markets had run out of withdrawable USDC.

• Funds: KPK was the only identified asset manager to fully close its carry trade positions that night. KPK Funds are new multi-strategy vaults, which run across protocols on KPK's own infrastructure. The Gold Carry strategy was fully repaid 31 seconds after its alert, and the BTC Carry one 12 seconds after Aave v4 froze its market. KPK was the only one of 135 similar positions to close that same night.

What happened and why KPK exited

Binance hot wallets were drained across eight chains. The onchain trace puts the total at about $6b, roughly 3.8x the Bybit exploit of February 2025. The FBI has since attributed the theft to North Korea's TraderTraitor activity, and is urging exchanges, DeFi services and blockchain analytics firms to block addresses used to launder the funds.

The impact on DeFi was second-order. The attacker held about $1.8b in stablecoins at their main wallet (975m USDT and 823m USDC, both later frozen) plus about 409k ETH (about $931m), all usable as collateral on lending markets. They supplied 60m USDT on Aave v3 and borrowed about 19.8k WETH against it. Aave froze its v3 Core and v4 Bluechip reserves, Compound paused its cUSDCv3 market, and Morpho vaults saw heavy redemption pressure. USDT traded below its peg, and tokenized real-world assets were hit too: Midas paused redemptions on several of its tokens, mGLOBAL saw a redemption run, and XAUt traded above its oracle price. KPK monitors Binance, but none of the protocols KPK allocates to had direct exposure to it. The contagion could have spread much further, so KPK's agents acted on the first knock-on signals. See the full timeline in the appendix.

KPK-managed vaults took no losses. What separated curators was how quickly each could get out of the second-order exposure.

How KPK's exit agents performed

Every KPK exit runs through three automated steps:

1. an onchain event (e.g. a reserve freeze, a vault pause, a redemption drain)

2. an alert from KPK's monitoring (e.g. Hypernative or external APIs)

3. an agent that executes the exit or pause on KPK's own infrastructure

The first batch mattered most. The USDT discount opened an arbitrage loop through Midas redemptions, and KPK's agents treated its first alert as a sign of contagion. They exited the at-risk markets at 20:48 UTC, five minutes before Midas paused redemptions to close the loop.

On Morpho, those exits were mined 72 to 84 seconds after the alert. They took about $1.5m, 99% of the available USDC liquidity, out of the siUSD and PT-siUSD markets of KPK's USDC Yield vault on Morpho, and $215k, 99% of the position, out of the mF-ONE market of KPK's Yield RWA vault. Midas paused mF-ONE redemptions three hours later, at 23:54 UTC. All three markets ran out of withdrawable USDC within 2 to 4 hours, and lenders still in them had to wait for liquidity to return.

On Gearbox, KPK curates the frxUSD Earn Pool, which lends to borrowers posting Midas's mF-ONE and mGLOBAL as collateral through three credit managers. Pausing a credit manager stops new accounts, new borrowing and any change to existing positions. The pool then lends nothing more against collateral under stress, while approved emergency liquidators can still close unhealthy accounts. KPK's agents paused the mF-ONE credit manager 60 seconds after the same Midas alert, and the two mGLOBAL credit managers 36 and 48 seconds after a 2.08m mGLOBAL redemption drain at 21:40 UTC.

KPK's fastest exit came later that evening. At 21:42:11 UTC, Aave froze its v4 markets, including the WBTC and USDC reserves KPK's BTC Carry Fund borrowed on, so the attacker could not use stolen funds there as they had on Aave v3. A freeze usually means something is wrong, and a pause, which does block withdrawals, can come next, so the Fund is built to get out while it still can. KPK's alert fired 8 seconds after the freeze, and in the next block, 4 seconds later, the KPK exit agent unwound the whole position in one transaction: it withdrew the USDC from both KPK USDC vaults on Morpho, repaid all 277k USDC of debt and returned 4.925 WBTC to the Fund's Portfolio Safe. Twelve seconds from protocol freeze to exit.

Not every position needs to react that fast. Where a brief spike could trigger a needless exit, KPK's agents wait for the signal to hold, and then act just as quickly. The Gold Carry strategy waited until XAUt's gap to its oracle price had held for more than 15 minutes; its exit came 31 seconds after that alert. USD Alpha, the third KPK Fund, withdrew its stablecoins from Aave when liquidity there fell below $5m. Its longer filter is why its USDC exit came 10 hours after liquidity first fell below $5m, but 16 seconds after its alert.

How KPK compares with peers

Vaults

None of the 19 other vaults analysed on the seven at-risk Morpho Blue markets (siUSD, PT-siUSD, USD3, PT-USD3, mF-ONE, wFalconX and AA_FalconXUSDC) acted before KPK's first exit.

These markets were treated as at risk because their collateral could face redemption pressure, and drained liquidity would leave lenders unable to withdraw. The next curator followed 9 minutes after KPK's first exit, and five of the 19 (26%) within 35 minutes. Three took between 3 and 15 hours, and all others had not acted by midday on 30 October. Only one of the 19 fully exited its positions, in a single transaction 15 minutes after KPK's first exit.

Funds

KPK Funds are new multi-strategy vaults, which run across protocols on KPK's own infrastructure. Two of them, the BTC Carry and Gold Carry, borrow USDC against WBTC or XAUt on blue-chip lending markets (e.g. Aave v3/v4) and lend it into KPK-curated Morpho vaults. Each Fund is heavily automated: agents watch its positions around the clock, adjust and exit on their own when a set risk event hits, such as a protocol freeze, a sustained price gap or thinning liquidity. That is still rare among carry strategies, as the night showed. For BTC Carry, the full list of automated actions is public in its docs.

• Comparable carries: KPK was the only identified vault curator or asset manager to fully unwind a carry that night. The two closest matches to KPK's BTC Carry, both BTC carries on Aave v3, were unchanged at midday on 30 October: asset manager A's, the same size, and asset manager B's, about 70 times larger. Two asset managers, one of them B, reduced their carry debt on Morpho and Spark by 8 to 13% between 22:25 and 03:45 UTC and kept the rest of their positions open.

• Aave v3: The KPK Gold Carry was out at 21:01 UTC, 46 minutes before Aave froze XAUt and set its LTV in e-mode to zero (21:47 UTC), just ahead of the wider v3 Core freeze. Among the other 26 XAUt carries, the first unwind of 5% or more came at 05:54 UTC on 30 October, almost nine hours after KPK's exit.

• Aave v4 Bluechip: The freeze did not block repaying or withdrawing. The KPK BTC Carry, the 12-second exit above, was the only one of 135 carry trades on that market that exited that night. The next two followed at 08:14 and 09:34 UTC.

Why speed decided the outcome

KPK got out while the exit was still open: before liquidity thinned, before the collateral came under pressure, and before any wider contagion could reach depositors' funds. KPK's first exits needed no human decision: monitoring wired to an agent with the authority to act, took the positions out before anyone had to review the alert.

For deposits in KPK-managed vaults, clear-cut risk signals trigger code that reacts in seconds, and the rest go to KPK's risk curation team. The same agents covered the Morpho vaults, the Gearbox credit managers and the three KPK Funds.

What comes next

In the first hours of the largest crypto hack on record, KPK's agents made the first exits from three at-risk Morpho markets and fully unwound both carry Funds, all without a manual signature.

Seconds are already the norm for KPK's exits, and KPK reviews every event like this one to bring that down further. KPK Funds already run with this protection. More information and a proper introduction to the Funds are forthcoming.

Appendix: Exit and pause TXs