Binance says $6.34B set aside to cover hack losses
Lead · Cointelegraph · 2026-10-30
Binance announced Friday that approximately $6.3 billion in assets were stolen in what appears to be the largest hack in cryptocurrency history. The exchange has allocated $6.34 billion from its own reserves to cover user losses. Tether and Circle froze approximately $1.79 billion in USDT and USDC associated with the hack. Binance CEO Richard Teng stated the attack was not a single action but involved multiple points of breach. Binance is working with law enforcement to recover the $3 billion currently frozen.
This is the largest security breach in crypto history and directly impacts the funds and security posture of millions of users holding assets on the world's largest exchange.
- $6.3 billion stolen; $6.34 billion set aside by Binance to cover losses
- $3 billion in stolen funds frozen by Tether, Circle, and law enforcement
- Attack involved multiple breach points; Binance working with FBI for recovery
TRM, Chainalysis tie Binance hack to North Korea's TraderTraitor
Decrypt · 2026-10-30
Both TRM and Chainalysis have attributed the $6.3 billion Binance hack to North Korea's TraderTraitor hacking group, linking it to the earlier Bybit hack. The group has a history of conducting cryptocurrency exchange raids. This attribution comes as Binance announced it has set aside $6.34 billion to cover user losses from the exploit.
Attribution to a state-sponsored North Korean group raises concerns about persistent, sophisticated targeting of major cryptocurrency exchanges and the geopolitical dimensions of crypto security.
- TraderTraitor group blamed for both Binance and Bybit hacks
- North Korean state-sponsored attribution indicates sophisticated adversary
- Pattern of targeting major exchange platforms for asset theft
EIP-7702 enables sponsored transactions on Ethereum wallets
Decrypt · 2026-10-30
EIP-7702 is an Ethereum upgrade that grants ordinary user wallets the ability to run smart contract code. This functionality enables batched transactions and sponsored transactions, where one party can pay fees on behalf of another. The upgrade has drawn scrutiny in the context of the Binance hack, as some analysts suggested the feature may have amplified the scale of losses, though security experts note it did not cause the breach itself.
Understanding EIP-7702's capabilities and limitations helps readers assess both its benefits for user experience and its potential security implications in an active threat landscape.
- Allows standard wallets to execute smart contract code
- Enables batched and sponsored transaction functionality
- May have amplified Binance hack losses but did not cause the breach
EIP-7702 may have amplified Binance hack, experts say
Cointelegraph · 2026-10-30
Security researchers have stated that while EIP-7702 did not directly cause the Binance hack, the upgrade may have enabled attackers to circumvent the exchange's withdrawal security protocols more effectively. Attackers could have drained Binance wallets without the upgrade, but EIP-7702 likely simplified the process by enabling sponsored and batched transactions. This finding highlights how new protocol features can interact with security architectures in unexpected ways.
As Ethereum continues to add functionality, understanding how new features interact with exchange security systems is critical for protecting user assets.
- EIP-7702 not root cause but may have simplified attack execution
- Likely helped bypass withdrawal safeguards and rate limits
- Demonstrates unintended security interactions with new protocol features
Binance hacker's Bitcoin haul tops Coinbase corporate treasury
Cointelegraph · 2026-10-30
Early Friday morning, the Binance hackers controlled 18,270 BTC, a sum exceeding Coinbase's reported corporate Bitcoin treasury. The attackers also amassed over 500,000 ETH from the breach. This concentration of stolen assets in hacker wallets highlights the scale of the Binance hack and underscores the challenge law enforcement and frozen-asset recovery efforts face in preventing the criminals from liquifying or moving funds to uncontrolled jurisdictions.
The size and composition of stolen assets illustrate the scale of the breach and the potential for significant market impact if funds are dumped on open markets.
- Hackers controlled 18,270 BTC, exceeding Coinbase corporate holdings
- Over 500,000 ETH also in attacker wallets
- Asset concentration demonstrates massive scale of theft
Binance CEO: attack involved multiple points of breach
Decrypt · 2026-10-30
Binance CEO Richard Teng clarified that the $6.3 billion hack was not executed as a single action but instead involved multiple points of breach across the exchange's systems. This disclosure suggests a coordinated, multi-stage attack rather than exploitation of a single vulnerability. The finding has implications for how security audits and incident responses should be conducted in the wake of the breach.
The multi-vector nature of the attack indicates sophisticated coordination and raises questions about Binance's security architecture and monitoring systems.
- Attack used multiple breach points, not single vulnerability
- Indicates coordinated, multi-stage operation by attackers
- Suggests gaps in security monitoring and detection systems
Trezor warns CryptoBilis Safe 5 buyers of suspected hardware implant
Decrypt · 2026-10-30
Trezor reported receiving a credible report of a hardware implant discovered inside a Safe 5 device sold by CryptoBilis. While Trezor has not yet examined the affected device, the company is treating the report as credible and has urged all CryptoBilis Safe 5 buyers to immediately move their funds to secure locations. This incident raises concerns about hardware wallet supply chain security and third-party distributors.
Hardware wallet compromises undermine the security of offline storage and represent an existential threat to users who may believe their funds are protected.
- Suspected hardware implant found in CryptoBilis Safe 5 devices
- Trezor treating report as credible despite not examining device
- Supply chain compromise affects all CryptoBilis Safe 5 buyers
Israel extradites Nomad Bridge exploiter to US for $2.8M theft
Decrypt · 2026-10-30
Israel's Supreme Court extradited an alleged Nomad Bridge exploiter to the United States to face charges over a $2.8 million theft. The court ruled that exploiting a software vulnerability counts as computer intrusion under Israeli law, even when the software technically allowed the transaction to proceed. This legal precedent has implications for how courts worldwide classify and prosecute vulnerability exploitation in cryptocurrency systems.
The ruling establishes important legal precedent for prosecuting smart contract exploits as computer crimes, potentially strengthening enforcement against protocol vulnerability abuse.
- Israel Supreme Court extradited suspect to US over $2.8M Nomad theft
- Ruled vulnerability exploitation counts as computer intrusion
- Sets precedent for prosecuting code flaws as intentional crimes
Polymarket resumes after $2.65M exploit; third-party provider compromised
The Block · 2026-10-29
Polymarket halted trading and entered cancel-only mode after over $2.5 million was lost within minutes due to an exploit. The platform subsequently identified that a third-party service provider was compromised, facilitating the attack. After investigation and remediation, Polymarket has resumed normal trading operations.
Third-party provider compromises represent an often-overlooked attack vector that can bypass direct platform security measures, raising questions about vendor risk management.
- Over $2.65 million stolen in minutes from Polymarket
- Third-party service provider compromised by attackers
- Platform resumed trading after canceling affected transactions
Crypto liquidations jump to $1.57B as Binance hack sends markets lower
CoinDesk · 2026-10-30
The $6.3 billion Binance hack and subsequent market downturn resulted in $1.57 billion in crypto liquidations as leveraged traders' positions were closed by exchanges. Bitcoin and ether both declined significantly in the hours following the hack disclosure. The cascading liquidations added downward pressure to already-declining markets.
Liquidation cascades amplify market volatility and can create feedback loops where forced selling drives further price declines, affecting even unlevered traders.
- $1.57 billion in positions liquidated following hack announcement
- Bitcoin and ether both declined sharply post-disclosure
- Leverage amplified market impact of initial asset decline
ICE to launch regulated Hyperliquid perps in US via Trade[XYZ]
The Block · 2026-10-29
Intercontinental Exchange (ICE), the parent of the New York Stock Exchange, announced a partnership and investment in Trade[XYZ] to launch regulated, Hyperliquid-based perpetual futures trading in the United States. This move represents a significant step toward bringing decentralized derivatives infrastructure into a regulated US framework. HYPE token surged 15% on the announcement.
Regulated perps access through traditional exchange infrastructure could significantly expand institutional participation in crypto derivatives and bring more trading volume on-chain.
- ICE (NYSE parent) partnering with Trade[XYZ] for US perps launch
- Hyperliquid-based platform bringing DeFi derivatives into regulated US market
- HYPE token surged 15% on partnership announcement
Coinbase Q3 net income swings to $719M on crypto gains
Decrypt · 2026-10-29
Coinbase reported third-quarter net income of $719 million, a substantial increase primarily driven by gains on its cryptocurrency holdings. Revenue remained flat at $1.22 billion, unchanged from the prior quarter. Analysts credited expansion in prediction markets and derivatives offerings for helping offset weaker spot trading activity. The results were announced before the Binance hack.
Coinbase's strong profit despite flat revenue shows the earnings power of on-balance-sheet crypto holdings and diversified revenue streams beyond trading fees.
- $719 million Q3 net income vs flat $1.22B revenue
- Gains on crypto holdings drove profitability, not trading activity
- Prediction markets and derivatives offset weaker spot trading
Curve Finance launches on Stellar, first non-EVM deployment
The Block · 2026-10-29
Curve Finance, the major stablecoin and AMM protocol, has launched natively on Stellar mainnet. This marks Curve's first deployment outside EVM-compatible blockchains, expanding the protocol's reach beyond Ethereum and its L2s. The launch diversifies Curve's presence across multiple blockchain ecosystems.
Curve's expansion to non-EVM chains signals growing interoperability across blockchain ecosystems and enables Stellar users to access battle-tested DeFi infrastructure.
- Curve's first native deployment outside EVM ecosystem
- Stellar mainnet now supports Curve stablecoin and AMM functionality
- Expands protocol reach across multiple blockchain platforms
“Record hack shakes exchange security; protocol upgrades under scrutiny”