Deciphering the triple Rashomon behind the ACT flash crash, has the exchange’s risk control become a “nuclear button”?

Author: Frank, PANews

A routine contract rule adjustment by Binance accidentally exposed the most vulnerable pimple in the crypto market.

On April 1, low-market-cap tokens such as ACT collectively saw their values halved within half an hour, a flash crash that put the fatal flaws of exchange risk control mechanisms, market maker algorithm strategies, and the MEME coin ecosystem under the spotlight.

Although Binance responded urgently and blamed "large investors selling", the 75% evaporation of contract holdings, the precise synchronization of multi-currency price fluctuations, and the mysterious operation of market maker Wintermute selling on the chain after the crash all exposed deeper industry risks in this Rashomon incident - in the current weak liquidity, exchanges' attempts to repair systemic risks may become the last straw that breaks the camel's back.

Multiple tokens collectively halved in half an hour

At 15:32 on April 1, Binance released an announcement on adjusting the leverage and margin tiers of multiple U-margin perpetual contracts, involving several trading pairs such as 1000SATSUSDT, ACTUSDT, PNUTUSDT, NEOUSDT, and NEOUSDC. The content of this adjustment mainly adjusts the position limit and leverage margin ratio of contract transactions of these tokens. Taking ACT as an example, the maximum position limit before the adjustment was 4.5 million US dollars, and after the adjustment it was reduced to a maximum of 3.5 million US dollars. The adjustment time shown in the announcement is 18:30.

At 18:30 on the same day, ACT fell from $0.1899 to $0.0836 in 36 minutes, a drop of 55%, triggering heated discussions in the market.

Almost at the same time as ACT, TST, HIPPO, DEXE, PNUT and other low-market-cap tokens on Binance all experienced flash crashes to varying degrees, with declines generally ranging from 20% to 50%. Market data showed that 18:30 was the starting point for the steep decline in prices of multiple tokens, affecting a wider range than a single project, showing obvious synchronization.

Specifically, this adjustment is to reduce the maximum position size that can be held under the leverage multiple. For example, you used to be able to hold tokens worth $1 million with a certain leverage, but now the rules have changed and you may only be able to hold a maximum of $800,000. If the user does not actively close the position, the system will force the excess position to be closed at the market price when the rule takes effect. Therefore, the contract price will drop sharply in a short period of time, which will then trigger a stampede.

This has sparked a lot of discussion on social media. @terryroom2014 pointed out that "the open interest of Binance contracts dropped sharply at 18:30, and the exchange took the initiative to cut off large positions, causing the price to collapse"; @yinshanguancha believed that "market makers were forced to close their positions due to insufficient margin, and the rule adjustment was the trigger." Most users pointed the finger at Binance's rule adjustment, believing that the reduction of the position limit triggered the forced liquidation, which in turn triggered panic selling and market stampede effects.

Some users also speculated that this was due to the active dumping of ACT by market makers. @Web3Tinkle pointed out that the amount of ACT held on Binance dropped by 73 million US dollars in just 15 minutes, implying that the project party and market makers instantly sold out and harvested the market.

In response to this, He Yi, the co-founder of Binance, said during an interaction on the X platform that when asked whether the ACT plunge was caused by Binance's modification of the contract rules, He Yi responded that "the team is preparing to respond with details."

About 2 hours later, Binance released a preliminary investigation report on the incident, which stated that the decline in ACT was mainly due to the sale of about $1.05 million in spot tokens by three VIP users and one non-VIP user in a short period of time, which caused the price to fall and led to the decline of other tokens. In summary, Binance's response believed that the main reason for this short-term plunge was the selling of large investors, rather than Binance's adjustment of rules.

Are exchanges overdoing risk control or are market makers clearing their positions to protect themselves?

This market crash reminds people of the recent Hyperliquid lightning attack. On March 26, the decentralized exchange Hyperliquid encountered a trader who exploited a liquidity design loophole and dumped a huge amount of short orders to the platform by withdrawing margin, which almost caused a loss of more than 10 million US dollars to the Hyperliquid vault.

Perhaps warned by the Hyperliquid incident, Binance tried to control risks by lowering the contract parameters of low-market-cap tokens, but it did not expect that it would detonate the market's landmines prematurely.

In addition to the fact that Binance's rule adjustment seems to be the trigger, market maker Wintermute is also suspected to be the initiator behind it. On the one hand, the market maker group is the most affected by Binance's rule adjustment. @CnmdRain analyzed, "This adjustment has a particularly large impact on market makers (MM) because they usually rely on high leverage and large positions to maintain market liquidity and earn spread profits."

Previously, according to Yu Jin’s speculation, Wintermute may be the market maker of ACT (it received 9.482 million ACT tokens from the ACT community wallet in November 2024). After the ACT plummeted, Wintermute withdrew multiple ACT tokens from the Binance exchange and sold them on the chain.

In response, Wintermute founder Evgeny Gaevoy said that the company did not participate in the leading operation of the ACT and other Meme coin crashes, and only arbitraged the AMM fund pool after the sharp price fluctuations. He emphasized that Wintermute was not responsible for the market fluctuations and is currently paying attention to the subsequent development of the incident.

In response to this uproar, the ACT project team also said that it had launched an investigation and was working with relevant parties to deal with it, while also developing a response plan with trusted partners.

Can the evaporation of 75% of holdings be explained by "big investors selling off"?

So far, all parties involved in this flash crash seem to have responded immediately and cleared themselves of any responsibility. But many questions remain.

First, Binance’s preliminary investigation report does not seem convincing. Binance’s investigation report stated that the decline of ACT tokens was related to the sale of a large number of ACT tokens by three VIP users and one non-VIP user. But this does not mean that the decline of each token was driven by similar user sales. For ACT tokens, user sales may be the direct cause of ACT’s decline, and the reasons behind multiple tokens seem to be related to this rule adjustment.

CoinGlass data shows that at 18:30, Binance's ACT contract holdings fell sharply by 75%. Similar situations also occurred in the holdings of tokens in several other adjustment announcements, which is difficult to explain as being caused by spot selling by individual large investors.

Second, this decline does not seem to be entirely caused by the rule adjustment. Judging from the trend of several tokens, ACT has the largest decline, while several other tokens that have been adjusted, such as 1000SATS, have also fallen, but the decline is far less exaggerated than ACT. Moreover, another token that has fallen dramatically, DEXE, is not one of the tokens adjusted this time. However, tokens like MEW, which are also on the adjustment list, have not fallen as a result, but have instead risen.

Third, was Wintermute's exit a coincidence or intentional? At the same time as ACT plummeted, Wintermute sold several MEME coins it held, and the prices of these tokens also experienced flash crashes to varying degrees. Some social media users also speculated that the main reason for the decline was that Wintermute's algorithm robot had problems due to the rules.

Overall, a more comprehensive explanation for this short-term flash crash seems to be that Binance’s adjustment of the position rules of some token contracts was the trigger, which caused the algorithmic robots of some market makers such as Wintermute to fail to make timely adjustments.

However, no matter what the specific cause of this flash crash is, the market/users are always the ones who pay the bill.

According to Coinglass data, after the ACT flash crash, ACT contracts were liquidated for $8.71 million, ranking third in the entire network (only lower than Bitcoin and Ethereum). Not only that, those users who hold spot contracts also suffered the treatment of having their assets cut in half, and it seems difficult to recover in a short period of time.

Overall, the underlying reasons for this flash crash are as follows. First, after the Hyperliquid incident, exchanges began to pay attention to the risk of whales manipulating the market, and therefore began to make adjustments. This was a good thing, but it was unexpected that it caused another stampede. Second, due to the cooling of the MEME market, related tokens have become fragile and sensitive in terms of trading depth and sentiment. Therefore, once there is an unusual transaction, it will expose the reality that MEME coins have no value support.

This "April Fool's Day scare" in the crypto market, which was worth tens of millions of dollars, finally came to a temporary end with the tacit "responsibility division" among exchanges, market makers, and project owners. But the warning buried deep inside is far more shocking than the surface. This flash crash may not have a real "murderer", but it has torn open the most real survival rule of the crypto market: in the sophisticated system built by institutions and whales, retail investors often become passive recipients of systemic fluctuations.