In Focus/Hacks & Security
Exchange and wallet breaches, phishing, drained funds — and what happened next.
Two days after the $6.3 billion theft from Binance, the fight has moved to Washington. The CFTC chair is pitching his voluntary registration plan for offshore venues, an industry group wants Congress to act before it adjourns, and the two parties are reading the same hack in opposite ways, three days before the Nov. 3 election.
A day after the largest theft in crypto’s history, Binance says it has ring-fenced more than $6.34 billion of its own money to restore customer balances, while two U.S. analytics firms name North Korea’s TraderTraitor unit as the likely culprit. Withdrawals stay shut, and the questions have moved from how much was taken to who pays and what rules change.
Binance said in its seventh incident update that it has refilled about 98% of the assets hit in last week's hack from its own funds, and will buy the last 2% of thinly traded tokens on the open market and over the counter. A new proof-of-reserves snapshot taken at 00:00 UTC on Nov. 4 covers 44 tokens, up from 10, with the full zero-knowledge proof expected to take 50 to 60 hours. Co-CEO Richard Teng put the amount frozen or intercepted so far at about $2.85 billion. Source: The Daily Hodl
The Liquid Federation said on Tuesday that its bitcoin reserves again cover all LBTC one-to-one, closing a gap left by a Sept. 6 exploit that drained about 4,000 BTC. The attacker returned roughly 3,400 BTC a day later; the last 550 BTC arrived in two deposits on Monday, which a Federation board member attributed to Blockstream. The Federation says governance and security changes will follow in the coming weeks. Source: The Block
Binance's SAFU emergency fund now holds about 7,500 BTC, roughly half of the 15,000 BTC it held after converting from stablecoins in February, after four withdrawals on Oct. 31 to help cover the $6.3 billion theft. At around $77,000 per coin, the remainder is worth about $580 million. Binance says it will rebuild the fund to about $1 billion but has given no timetable. Source: Bloomingbit, citing CoinDesk
Circle said it has frozen more than $1.1 billion in USDC connected to last week's Binance theft, up from the roughly $823 million it locked in the attacker's wallet within minutes of the hack. The company has not explained the gap between the two figures. Bitcoin and ether, which no issuer can freeze, make up an estimated $2.4 billion of the stolen funds, according to TRM Labs. Source: American Banker
After Tether froze 378.7 million USDT, the attackers still had about $249 million to work with on Tron, and roughly $242 million of it moved out through Relay, THORChain, Chainflip and other services within two days, according to on-chain analyst SomaXBT. Elliptic estimates about $3.3 billion of the loot sits in assets no issuer can freeze, including 18,270 BTC that has not left the 19 bitcoin addresses named by the FBI. Source: The Block
Binance restarted withdrawals on Sunday in a first phase that began with the bitcoin network shortly after 06:00 UTC, followed by ether, BNB and some USDT and USDC routes, across 15 networks in total. The exchange said it has now bought back about 95% of the roughly $6.3 billion taken in last week's hack, up from 90% a day earlier, with the rest made up of less liquid tokens. No date has been set for the second phase, and deposits stayed open throughout. Source: Reuters via Business Standard
The FBI on Saturday attributed the theft of more than $6 billion from Binance to TraderTraitor, the North Korean group it also tied to last year's $1.5 billion Bybit hack. The bureau said most of the stolen assets have been swapped into ether and asked exchanges, analytics firms and node operators to block transactions linked to addresses it published. Source: AP via ClickOrlando
Binance said Saturday it has replaced 90% of the roughly $6.3 billion taken from its hot wallet, up from about 80% a day earlier, with its ten most-held assets, including BTC, ETH, USDT and USDC, now fully covered. The exchange still plans to reopen withdrawals token by token on Sunday, Nov. 1, while a full zero-knowledge proof of reserves is expected around Nov. 3 UTC. Source: Cointelegraph
Coinbase said it had changed the systems it uses to hold crypto keys offline, describing the move as purely precautionary after the theft at Binance. Kraken said it was studying the incident for lessons for its own defenses, and OKX chief executive Star Xu called for a real-time alert system so exchanges can share attack data and freeze suspected stolen funds quickly. Source: Reuters via The Business Standard
U.S. spot bitcoin ETFs posted about $643 million in net outflows on Oct. 30, ending a four-day run of inflows and marking the largest one-day withdrawal since June. BlackRock's IBIT lost roughly $234 million and Fidelity's FBTC about $201 million, while ether funds shed another $156 million or so, according to Farside data. Source: crypto.news
OKX founder Star Xu called on exchange chiefs to agree common security standards, arguing safety should not be a field for competition. His proposals include real-time settlement between verified exchanges, added checks and delays for large withdrawals to unknown addresses or smart-contract approvals enforced at the signing layer, and joint incident alerts and asset freezes. Source: CoinDesk
Aave paused new deposits and borrowing across every DAO-operated V3 and V4 market, while still letting users withdraw and repay, after a wallet linked to the Binance attack posted stolen USDT as collateral and borrowed roughly 20,000 ETH. Aave said its contracts were not affected and positions remain overcollateralized. Source: Cointelegraph
Belgian hardware wallet maker NGRAVE said it is facing a high-level cyber threat and told users to watch for phishing by text, email, fake websites and bogus support staff, adding it never asks for recovery phrases. The warning follows an Oct. 17 incident in which attackers hijacked a third-party push service for its LIQUID app and drained at least $2.56 million from about 70 wallets. Source: ChainCatcher
Hardware wallet maker Keystone said a third party obtained customer names, contact details, shipping addresses and order information through its Shopify-based online store. The company said private keys, recovery phrases and payment details were not exposed, and it warned users about scammers posing as Keystone. It detected the access on Oct. 20 and disclosed it publicly on Oct. 24, but has not said how many customers were affected. Source: The Block
