Key Overnight and Morning News (October 29–30)

A whale sold over 694,000 HYPE in the past five days, worth $53.27 million

Over the past five days, a mysterious “whale” sold 694,310 HYPE, worth $53.27 million.

Analyst: BTC returns above Strategy's 2026 cost line, but purchases since 2025 remain underwater

Analyst Darkfost posted that Bitcoin's price has recovered above Strategy's 2026 cost basis, but purchases since 2025 remain at a loss.

Strategy currently holds 848,517 BTC, with an overall average cost of about $75,446. Bitcoin today rose above Strategy's 2026 cost line of $78,900. However, if all purchases since 2025 are combined with sales near this summer's lows, the blended cost is still about $90,600, and the current price remains underwater. After pausing for several weeks, Strategy has resumed purchases (there were no new purchases last week). The company's one-year return is about 27.6%, and its 10-year return is about 60.3%.

ICE, parent of the NYSE, partners with Trade.xyz to bring Hyperliquid perpetual contract products to the U.S. market

Trade.xyz posted that, subject to approval by the U.S. Commodity Futures Trading Commission (CFTC), Trade.xyz and ICE, parent company of the New York Stock Exchange, plan to establish a new platform dedicated to the U.S. market, using innovative trading and clearing infrastructure built on Hyperliquid. The planned contracts cover equities, indices, commodities, foreign exchange and cryptocurrencies, and users will be able to access them through participating brokers and platforms. In addition, ICE will make an equity investment in Trade.xyz but did not disclose specific funding details.

ARK Invest buys about $9.1 million of Robinhood stock, its largest purchase in six months

Cathie Wood's ARK Invest bought about $9.1 million worth of Robinhood shares on Wednesday, its largest purchase of the stock since April 29. Earlier this month, ARK sold about $47.5 million worth of Robinhood shares between October 6 and October 9, when the stock closed between $107 and $112.

The purchase came after Robinhood released its third-quarter results. The report showed that crypto trading revenue fell 55% year over year to $120 million, while crypto trading volume dropped 38% to $50 billion.

Galaxy Digital files with the U.S. OCC to establish a national trust bank

Galaxy Digital Inc. (Nasdaq: GLXY) announced that its subsidiary Galaxy Digital LP has filed an application with the U.S. Office of the Comptroller of the Currency (OCC) to establish “Galaxy National Bank,” headquartered in New York. If approved, Galaxy National Bank will operate as a federally regulated trust institution under OCC supervision. The bank will provide Galaxy's digital asset custody, trading and staking services and conduct fiduciary investment advisory business. Through this unified federal framework, the bank will be able to serve clients across the United States.

Binance to list Predict (PREDICT) and add a Seed Tag

Binance will list Predict (PREDICT) at 18:00 on October 30 (UTC+8) and open the spot trading pairs PREDICT/USDT, PREDICT/USDC and PREDICT/TRY.

Kalshi completes $1 billion Series G led by Sequoia Capital and Wellington Management

Kalshi co-founder and CEO Tarek Mansour said that Kalshi completed a $1 billion Series G round last week, led by Sequoia Capital and Wellington Management. Other investors in the round included Baillie Gifford, Morgan Stanley Investment Management, Coatue Management and Andreessen Horowitz. In its previous funding round in May this year, the company was valued at $22 billion.

ZachXBT: Insider addresses at Axis Robotics (AXIS) sold tokens, causing the token to crash about 40%

Insiders at Axis Robotics (AXIS) obtained more than 76 million AXIS tokens (worth over $12 million) from a multisig wallet, then sold them through DEXs and transferred some tokens to the Bitget exchange. As a result, AXIS's price plunged 40% in the past 24 hours. One insider sold 42 million AXIS tokens today and currently holds more than 5.04 million USDC across eight wallet addresses.

U.S. September core PCE price index rises 0.3% month over month, in line with expectations

The U.S. core personal consumption expenditures (PCE) price index rose 0.3% month over month in September, compared with an estimate of 0.3% and a prior value of 0.2%. It rose 3.1% year over year, compared with an estimate of 3.1%.

Huobi HTX reaches constructive communication with the UK FCA; related litigation has been properly resolved

Huobi HTX announced that after the UK Financial Conduct Authority (FCA) brought legal proceedings against the exchange in the UK, the matter has now been properly resolved following a period of constructive communication between the two sides. Huobi HTX said that during the communication, it continued to cooperate with the FCA and, based on its commitment to continuously complying with regulatory standards, progressively strengthened restrictions related to the UK market and exit arrangements, and introduced supporting operational measures. These measures were implemented before the settlement was reached. The settlement further consolidates those measures and does not constitute an admission by Huobi HTX of any legal liability, wrongdoing or violation.

Huobi HTX stressed that the settlement eliminates the relevant legal uncertainty and is consistent with the exchange's commitment to continuously improving compliance. In the future, HTX will continue to work constructively with all industry parties, including regulators where appropriate, to safeguard user interests and promote the healthy development of the digital asset ecosystem.

Legendary U.S. investor Stan Druckenmiller posts first tweet, says he has become a Trade.xyz investor

Legendary U.S. investor Stan Druckenmiller posted his first tweet, saying that he has become a Trade.xyz investor. Druckenmiller said that as a market participant, he looks forward to using the product to improve his investment process.

Previously, ICE, parent company of the NYSE, partnered with Trade.xyz to bring Hyperliquid perpetual contract products to the U.S. market.

Sky Ecosystem Q3 report: net income reaches $37.19 million, with positive net income for six consecutive quarters

Sky Frontier Foundation released the Sky Ecosystem third-quarter report. Net income for the quarter reached $37.19 million, up 11.8% quarter over quarter, marking the sixth consecutive quarter of positive growth, while the margin increased from 31.0% to 37.5%. Total protocol revenue was $99.29 million, up 14.2% year over year and down 7.4% from the second quarter; total expenses fell 16.0% to $62.10 million. Protocol collateral stood at $11.41 billion, up 25.3% year over year and down 7.3% from the second quarter. sUSDS supply was $4.52 billion, up 118% year over year but below the second quarter's $5.52 billion. During the quarter, $28.47 million was transferred to the Sky reserves, whose balance stood at $85.08 million at the end of the period.

HYPE breaks above $90, up more than 13% in 24 hours

According to OKX market data, HYPE briefly surged past $90 and is now trading at $91.67, up 13.19% in 24 hours.

Alphabet (GOOGL) stock falls 12.18% intraday to $287.13

According to Binance market data, Alphabet (GOOGL) stock fell 12.18% intraday and is now at $287.13.

zkLink: Block production paused and withdrawals disabled; attacker can receive a 20% white-hat bounty if funds are returned

zkLink released an update on the security incident, confirming an ongoing attack targeting zkLink Nova's Arbitrator contracts on Ethereum and Optimism. The team has paused zkLink Nova block production, applied an emergency fix to the affected contracts, and temporarily closed withdrawals to cut off further attack paths; in addition, the technical team is conducting a comprehensive security review of all related components. The team said it will restore zkLink Nova's services only after confirming that all risks have been eliminated. It also offered the attacker a 20% white-hat bounty if the funds are returned, with no further liability pursued.

Previously, reports said that the zkLink cross-chain bridge on Ethereum was under attack and had lost about $786,000.

Google posts its largest single-day decline in history, with $500 billion in market value erased

Google parent Alphabet posted the largest single-day decline in its history, with the drop widening to 13% and its market capitalization falling by more than $500 billion from the previous trading day's close. The company's third-quarter revenue was $127.58 billion, up 25% year over year, below the market expectation of $127.91 billion; adjusted earnings per share were $2.67, below the expected $2.97. Google Cloud revenue rose 103% year over year to $30.71 billion, but its core advertising business underperformed expectations, and free cash flow recorded a net outflow of $9.07 billion. The market is concerned that as AI investment continues to climb, slowing search advertising growth may further increase pressure on profitability and cash flow.

1kx report: Blockchain industry revenue expected to reach $100 billion in 2026

Investment firm 1kx released its annual blockchain revenue report, covering more than 2,600 protocols and more than 100 public companies. It expects blockchain industry revenue to reach $100 billion in 2026 (revised down 28% from its previous forecast due to price volatility). Unlike the overall downward trend, the share of revenue from institutional adoption and broader economy applications will rise to 30% in 2026; revenue from the broader economy surpassed revenue at the blockchain infrastructure layer for the first time in the third quarter.

Public companies currently account for 16% of blockchain revenue, up from 7% in 2022; although market concentration is high, leadership among protocols by revenue continues to change. In addition, a record 283 protocols returned value to token holders in the third quarter through mechanisms such as token buybacks, burns or fee sharing.

Polymarket launches five-minute crypto up-or-down prediction markets on its U.S. platform

Prediction platform Polymarket launched five-minute cryptocurrency up-or-down betting contracts on its regulated U.S. platform. The platform is operated by QCX LLC and regulated by the U.S. Commodity Futures Trading Commission (CFTC). Traders can bet on whether assets including Bitcoin, Ethereum, Solana and XRP close above or below their starting price within five minutes. A correct prediction pays $1 per share, while an incorrect one pays zero, a structure similar to binary options that lowers the threshold for short-term derivatives trading.

The launch comes as the CFTC re-examines whether Polymarket complies with the terms of a 2022 settlement and scrutinizes customer protection measures on its U.S. platform. Previous research has pointed to potential settlement manipulation risks in the old five-minute contracts, and the platform has switched to a time-weighted average price (TWAP) settlement mechanism.

Musk retweets legendary investor Stan Druckenmiller's post about investing in Trade.xyz

Musk retweeted legendary investor Stan Druckenmiller's post disclosing his investment in Trade.xyz, saying "Interesting."

Previously, legendary U.S. investor Stan Druckenmiller posted his first tweet, saying he had become a Trade.xyz investor.

Axis Robotics denies that team or investor AXIS tokens were sold

Axis Robotics issued a statement about the sell-off of $AXIS between October 28 and 29. Axis Robotics stressed that tokens belonging to the team or investors were not sold. The allocations of the core team and investors (as well as all other locked allocations, totaling 83.5% of total supply) remain in vesting contracts co-managed with Binance. The tokens that were sold came from the initial circulating supply in the published tokenomics, specifically the "ecosystem" allocation. Because many ecosystem participants are not crypto-native, their allocations were delivered through a single over-the-counter (OTC) counterparty; the written agreement signed by both parties included lock-up terms.

Judging from the selling pattern (tokens were deposited to exchanges through hundreds of newly created addresses within hours of delivery), it is highly likely that the OTC counterparty sold the tokens on the open market. If true, this would have breached the agreement between the two parties. The team has suspended all further cooperation with the counterparty, is reviewing the relevant agreements with legal counsel, and will seek all available remedies under the agreement framework.

Previously, according to on-chain detective ZachXBT, insider addresses at Axis Robotics (AXIS) sold tokens, causing the token to crash about 40%.

Multiple Polymarket users say assets were transferred without authorization, suspecting a front-end attack

Polymarket trader Car posted on X that about $800,000 of assets in their Polymarket account were stolen, all positions were sold, and a friend's account lost about $600,000. They reminded users to lock their accounts and refrain from interacting with the website for the time being. Several other users also reported on X and in the Polymarket Discord community that the website front end appeared to have been attacked and assets were transferred without authorization. One user said about $200,000 was stolen, while another said they received an unauthorized withdrawal signature request on the official website. As of publication, Polymarket had not responded. In June this year, Polymarket suffered a front-end phishing attack after a third-party vendor was compromised, and about $2.94 million in user assets were stolen.

Polymarket exchange enters cancel-only mode, suspends relayer operations

According to Polymarket's official status page, the Polymarket exchange has entered cancel-only mode, relayer operations have been suspended, and officials are investigating an incident. The notice was issued at 02:05 Beijing time, and the trading API (CLOB) was shown as having a major outage. Previously, multiple Polymarket users said on X that their account assets had been transferred without authorization; trader Car said $800,000 was stolen, and a friend lost $600,000; the community suspected a front-end attack. As of publication, Polymarket had not announced the cause or losses.

Polymarket: Third-party service provider compromised, affected users to receive full compensation

Polymarket Traders posted on X that it had identified and fixed an issue affecting its international platform Polymarket.com, caused by a compromise of one of its third-party service providers. The matter has been referred to relevant law enforcement, and all affected users will receive full compensation. Out of caution, the platform has temporarily suspended trading and is working to restore access. Previously, multiple Polymarket users said their account assets were transferred without authorization; trader Car said about $800,000 was stolen. As of publication, officials had not disclosed the name of the service provider involved or total losses.

Data: Suspected Polymarket attacker converts about $2.65 million into POL

Arkham data shows that an address suspected to be the Polymarket attacker (0x3F99…Ffc18) swapped the USDC.e and USDC proceeds into POL, at one point holding about $2.65 million in POL. Polygonscan shows that the address subsequently transferred out about 28.64 million POL in three transactions. Cybersecurity firm Hudson Rock said the address was hardcoded as a backup collection address in a script hosted by web performance monitoring service DebugBear that contained wallet-draining code. Previously, Polymarket said a third-party service provider had been compromised and affected users would receive full compensation. According to Decrypt, this is Polymarket's third security incident this year; it lost about $700,000 in May and about $3 million in June.

Nasdaq reportedly urging listed companies to oppose tokenization of their shares on OKXICE

Crypto reporter Eleanor Terrett posted on X that, according to information obtained by her co-host Jacquelyn Melinek, Nasdaq representatives have been reminding its listed companies not to let their shares be tokenized and traded through OKXICE TSV, a joint venture between OKX and Intercontinental Exchange (ICE). Melinek said an executive at a Nasdaq-listed company told her that Nasdaq representatives proactively contacted the company and advised it to oppose tokenized trading on OKXICE, offering a call to explain why. So far, 38 companies have objected, 23 of which are listed on Nasdaq. Nasdaq has previously publicly expressed concerns about tokenized stocks trading outside traditional market structures and said it does not plan to launch a TSV; it is working with Kraken on its own tokenization model, expected to launch in the second quarter of 2027. Nasdaq had not responded to a request for comment.

Coinbase posts Q3 net income of $719 million; prediction markets annualized revenue exceeds $200 million

Coinbase reported 2026 third-quarter results: net income of $719 million and adjusted net income of $78 million; adjusted EBITDA was $333 million, up 60% quarter over quarter. Its share of crypto trading volume rose to 10.70%, the fourth consecutive quarterly increase; platform assets accounted for 12.50% of total crypto market capitalization. Average USDC held across Coinbase products reached $22 billion, up 49% year over year and a record high; prediction markets annualized revenue exceeded $200 million; subscription and services revenue accounted for 49% of total net revenue; paid Coinbase One subscribers rose 24% year over year, a record high.

Strategy posts Q3 net income of $19.53 billion; CFO to step down

Strategy reported 2026 third-quarter results: operating income was $20.91 billion, a record high for the company; net income was $19.53 billion, or $44.75 per diluted share, compared with net income of $2.79 billion in the same period last year. Third-quarter digital asset gains were $20.91 billion. As of October 25, the company held 848,517 BTC, up 26% year to date; it had purchased $14.33 billion of BTC year to date and repurchased $2.04 billion of STRC. In addition, Chief Financial Officer Andrew Kang will step down on November 5 and remain as an advisor through December 31; Executive Vice President of Operations Reza Virasteh will succeed him as CFO on January 1, 2027.

Analysis: More than 700 users affected by theft in Polymarket incident; trader Car accused of fabricating theft claim

Bubblemaps posted on X that in the Polymarket token theft incident caused by a compromised third-party service provider, more than 700 users were affected, with about $2.7 million stolen. The main attacker address is 0x3F99…Ffc18, and the funds have been swapped into POL and transferred out. Bubblemaps also corrected its earlier claim, saying that trader Car, who previously said about $800,000 was stolen, fabricated the theft, and that the asset transfer pattern did not match other victim wallets. As of publication, Car's earlier related posts had been deleted.

Binance hot wallet suspected of being attacked, about $2.5 billion in assets transferred out

According to Etherscan data, at 04:24 Beijing time, Binance hot wallet "Binance 14" (0x28C6…1d60) sent about 167,500 ETH (about $379 million), 1.615 billion USDT, and more than 60 tokens including RLUSD, wBETH, XAUt, UNI and USD1 to a new address 0x5227…CB2f8c in one transaction, with a total value of about $2.5 billion. On-chain data shows that the address that initiated the transaction, 0x7C86…5CA0, was funded by Tornado Cash. BWEnews, Tree News and others said the hot wallet was suspected of being hacked. As of publication, Binance had not responded.

Binance suspected hack tracker: Another 780 million USDC transferred out, bringing cumulative total to about $3.3 billion

According to Etherscan data, after Binance hot wallet "Binance 14" was suspected of being hacked and about $2.5 billion in assets were transferred out at 04:24 Beijing time, the same originating address (0x7C86…5CA0) triggered another transaction at 04:41, transferring 780 million USDC from "Binance: Hot Wallet 34" to the same receiving address 0x5227…CB2f8c, bringing the two transactions to a total of about $3.3 billion. In addition, the receiving address has transferred about 195,500 ETH to a new address 0x8532…43D4. As of publication, Binance had not responded.

$629 million liquidated across the market in the past hour, including $607 million in longs

CoinGlass data shows that after reports that Binance's hot wallet was suspected of being hacked, the crypto market fell sharply. In the past hour, $629 million in contracts were liquidated across the market, including $607 million in long positions and $21.7388 million in short positions. BTC liquidations totaled $190 million, ETH $157 million and SOL $46.8101 million. In the past 24 hours, total liquidations were $953 million, with the largest single liquidation on Binance-BTCUSDT worth $11.0867 million.

Binance: Investigating a potential security issue, no confirmed impact on user funds

Binance posted on X that the team has noticed reports of a potential security issue and is actively investigating, and has not confirmed any impact on user funds. The security team is urgently reviewing all relevant information and will publish updates through official channels once verified. Binance also reminded users to be wary of scams and not to trust unofficial links, messages or requests for account information. Previously, on-chain data showed that Binance hot wallets Binance 14 and Hot Wallet 34 had large amounts of assets transferred out in the early hours of today, totaling about $3.3 billion.

CZ: Binance appears to have been hacked; about $1.794 billion in stablecoins frozen

Binance founder CZ posted on X that user funds are safe, this indeed looks like a hack targeting Binance, and thanked Tether (about $971 million) and Circle (about $823 million) for quickly freezing the relevant funds. CZ said he no longer manages Binance.com, but as a shareholder, he expects all user funds to be fully covered. Previously, Binance officially said it was investigating a potential security issue and had not confirmed any impact on user funds.

Ethena: About $8.8 million unrealized PNL exposure to Binance, far below reserve fund

Ethena posted on X that its total unrealized profit and loss (PNL) exposure to Binance is about $8.8 million, far below its excess reserve fund of more than $60 million. Ethena previously said that all collateral involving exchange exposure is held with off-exchange custodians rather than directly on exchanges. Ethena said that proof of reserves executed by multiple external institutions will be published in the coming hours. Previously, on-chain data showed that Binance's hot wallet was suspected of being attacked and large amounts of assets were transferred out.

Data: Stablecoins frozen in connection with suspected Binance hack reach about $2.1 billion

Whale Alert posted on X that an address on the Tron network holding about 313 million USDT has been frozen, and the freeze is related to the suspected Binance hack. Together with the roughly $971 million USDT frozen by Tether and $823 million USDC frozen by Circle, the stablecoins frozen in connection with the incident total about $2.107 billion. SolanaFloor also said Tether and Circle have frozen about $2.1 billion in USDT and USDC. Binance has not yet disclosed the losses or cause.

Tether CEO: Over 1.567 billion USDT related to Binance hack frozen

Tether CEO Paolo Ardoino posted on X that Tether has frozen more than 1.567 billion USDT related to the suspected hack of the Binance exchange, and protecting the industry and partners is its top priority. Circle had previously frozen about $823 million in related USDC, bringing the combined total to about $2.39 billion. Binance officially said it is investigating a potential security issue and has not confirmed any impact on user funds.

Binance updates statement: User funds completely safe, still investigating potential security issue

Binance posted an updated statement on X saying that user funds are completely safe, the team has noticed reports of a potential security issue and is actively investigating, and the security team is urgently reviewing all relevant information and will publish updates through official channels once verified. Previously, Binance's statement said "no impact on user funds has been confirmed at this time." In addition, Tether CEO Paolo Ardoino said more than 1.567 billion related USDT had been frozen, and Circle had frozen about $823 million in related USDC.

Data: Outflows from suspected Binance hack may reach $5.6 billion, involving Bitcoin and Tron

On-chain estimates show that the total amount transferred out of Binance wallets in the suspected hack was about $5.8 billion. According to on-chain statistics, as of 5:22 Beijing time, about $5.643 billion had flowed out of Binance-labeled wallets, including $3.528 billion on Ethereum, $1.449 billion on Bitcoin, $628 million on Tron, and $38 million combined on Arbitrum, Optimism and Base; Tether and Circle have frozen at least $2.316 billion in stablecoins. Binance has not confirmed the hack and says user funds are completely safe.

Coinbase CEO plans to sell up to 8.1674 million shares, worth about $1.31 billion

Coinbase's latest quarterly report (10-Q) shows that CEO Brian Armstrong entered into a Rule 10b5-1 trading plan on August 12, intending to sell up to 8.1674 million Class A common shares by exercising vested stock options, provided the stock price meets certain threshold prices, with an expected execution period from November 16, 2026 to October 22, 2027. According to The Defiant, the shares are worth about $1.31 billion, and co-founder Fred Ehrsam and executive Emilie Choi have also adopted stock selling plans.

Binance: Some users' withdrawals blocked by technical glitch, being restored

Binance posted on X that it has noticed that some users are experiencing crypto withdrawal issues due to a technical error. The technical team is working to restore normal withdrawals and will update promptly once fully restored. User funds are safe (SAFU). Previously, Binance's hot wallet was suspected of being attacked, and on-chain data showed related outflows may reach $5.6 billion; Binance previously said user funds were completely safe and that it was still investigating a potential security issue.

BNB falls 6.23% intraday, hitting a low of $678

According to OKX market data, BNB fell to an intraday low of $678.13 today and is now at $703.55, down 6.23% for the day; BTC is now at $79,117, down 3.25% for the day. Previously, Binance's hot wallet was suspected of being attacked, and on-chain data showed related outflows may reach $5.6 billion. Binance subsequently said some users' withdrawals were blocked by a technical error and were being restored.

Binance: Conducting security check, withdrawals to resume after security issue is resolved

Binance posted on X that the team is conducting a security check, withdrawals will resume after the security issue is fully resolved, user funds remain safe, and further updates will follow. Previously, Binance said some users' withdrawals were blocked by a technical error and were being restored; on-chain data showed that Binance's hot wallet was suspected of being attacked, with related outflows possibly reaching $5.6 billion.

Data: Binance suspected hack-linked address borrows about 19,800 ETH from Aave

Odysseus of Phylax Systems posted on X that an address linked to the suspected Binance hot wallet hack deposited about $60 million USDT into Aave and borrowed 19,762 ETH (about $44.7 million). Etherscan data shows that the address has been tagged "Binance Hot Wallet Exploiter 3"; starting at 04:57 Beijing time on October 30, it approved and deposited USDT into Aave V3, then borrowed about 19,762 ETH in two transactions and transferred a total of 23,314.5 ETH to another exploit-linked address.

CZ: Binance net loss from hack may slightly exceed $1 billion, will cover all of it

DefiLlama founder 0xngmi posted on X that Binance has about $144 billion in custody assets; after the USDT and USDC freezes, the total loss from this incident is about $1 billion, only 0.69% of its custody assets, which Binance can easily cover with its balance sheet. Binance founder CZ retweeted the post and said the loss may be slightly higher than that, but it will all be covered. According to Lookonchain monitoring, more than $5.8 billion in assets were stolen from Binance, of which 1.58 billion USDT and 823 million USDC (a total of $2.41 billion) have been frozen.

He Yi: Ripple and WLFI helped freeze related assets; Binance withdrawals suspended until environment confirmed safe

Binance co-founder He Yi posted on X, thanking the Ripple team for quickly freezing about $200 million in related assets (without specifying the currency) and the World Liberty Financial team for freezing $27 million USD1 and 48 million WLFI (about $2 million). He Yi said that for security reasons, Binance has suspended withdrawals until the environment is confirmed safe, and user funds are safe (SAFU). Previously, Binance's hot wallet was suspected of being attacked, and on-chain data showed related outflows may reach $5.6 billion.

Data: Binance suspected hack-linked address has sold about 4.7 million UNI for ETH

Etherscan data shows that an address tagged "Binance Hot Wallet Exploiter 15" and linked to the suspected Binance hack is swapping UNI for ETH through Uniswap. According to monitoring by multiple users on X, the address had previously received about 7.02 million UNI. As of publication, the address had about 2.3196 million UNI remaining (about $14.89 million), meaning it had sold about 4.7 million, and it currently holds about 12,283.8 ETH (about $27.89 million).

Aave: Temporarily freezes all DAO markets on V3 and V4 due to Binance incident

Aave posted on X that it is aware of reports that a Binance-linked wallet may have suffered a security incident; Aave contracts are unaffected and all positions remain overcollateralized. As a precaution, all DAO-operated markets on Aave V3 and V4 have been frozen, suspending new deposits and borrows, while users can still withdraw assets and repay existing positions. Aave founder Stani Kulechov said the team is closely monitoring the situation and will unfreeze the markets as soon as feasible. Previously, an address linked to the suspected Binance hack had deposited about $60 million USDT into Aave and borrowed 19,762 ETH.

Data: Binance hacker is selling PEPE and other tokens on-chain, still holds about $39.51 million in ENA

Lookonchain posted on X that the hacker in the suspected Binance hack is swapping PEPE, UNI, LINK and other tokens for ETH on-chain. The hacker still holds large amounts of altcoins, including 217 million ENA (about $39.51 million), 7.58 trillion PEPE (about $34.41 million), 2.575 million LINK (about $28.07 million), 128,000 AAVE (about $15.90 million), 1.938 million UNI (about $12.62 million), 74.56 million ARB (about $11.54 million), 21.85 million ONDO (about $8.52 million), 17.32 million WLD (about $6.73 million), among others. Lookonchain warned that these tokens may face significant selling pressure.

Upbit warns users to be cautious about deposits to Binance, may restrict withdrawals if necessary

South Korean crypto exchange Upbit issued a notice warning about deposits of digital assets to Binance, saying that because Binance has experienced a security incident and some digital assets show signs of being stolen, users should be especially careful when depositing digital assets to Binance. Upbit said it is continuing to monitor the situation and may restrict withdrawals to Binance if necessary to protect investors; it will make a separate announcement if deposit and withdrawal support involving the exchange changes.

Binance: Binance Alpha trading suspended, to resume after security issue is resolved

Binance posted on X that as part of ongoing security measures, Binance Alpha trading has been temporarily suspended, affecting functions including CEX purchases of tokens using spot wallet funds, Alpha instant trading and CEX purchases in prediction markets; trading will resume after the security issue is resolved, and user funds remain safe. Previously, Binance said it was conducting a security check and that withdrawals would resume after the security issue was fully resolved.

Binance: Verified total frozen assets reach $2.54 billion, may continue to rise

Binance posted on X that the figures circulating externally for frozen funds vary, including $1.8 billion; after verification, the current total frozen assets are $2.54 billion. The figure may continue to rise as the team works closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze more assets. Binance said it will publish only confirmed data. Previously, Binance suspended withdrawals and Binance Alpha trading and said user funds are safe.

Following Upbit, Bithumb also warns users to be cautious about deposits to Binance

Bithumb has confirmed that the overseas exchange Binance appears to have experienced a security issue and reminded users to be careful with crypto asset withdrawals involving the exchange. Bithumb said it is continuing to monitor the relevant market conditions and may restrict withdrawals to Binance if necessary to protect user assets; it will make a separate announcement if deposit and withdrawal support involving the exchange changes. Previously, Upbit issued a similar warning.

Wintermute: Exposure to Binance is less than 20% of net assets, operations will not be disrupted

Wintermute founder Evgeny Gaevoy wrote that Binance is well able to absorb three to four times the current loss and remain largely intact, is very likely to survive this incident, and user funds are likely safe, but people should not deposit until Binance identifies the problem. He also said Wintermute has exposure to Binance, but it is less than 20% of net assets, and its operations will not be disrupted in any time frame or under any scenario.

GSR CEO: Exposure to Binance is less than 5% of net assets, business expected to see no major impact

GSR CEO Xin Song wrote regarding reports that Binance was hacked that GSR is working with its exchange contacts to better understand the issue and identify where it can help. GSR said its exposure to Binance is limited, at less than 5% of net assets, and it does not expect significant disruption to daily business.

Shenyu: Binance 14 hot wallet has still not revoked EIP-7702 delegation; about 2,961 ETH at risk of being swept again

Cobo co-founder Shenyu posted on X that the EIP-7702 delegation of the hot wallet tagged Binance 14 has still not been revoked after more than two hours. Another transaction transferring about 2,961 ETH to the address has long been pending confirmation due to low gas; once it is included on-chain and the base fee falls below 4.4 gwei, the attacker may be able to transfer this batch of ETH again.

Binance: Working closely with all parties to trace and freeze assets; cumulative frozen amount expected to rise further

Binance released an update on the security incident, saying its team continues to work closely with law enforcement, asset issuers, blockchain intelligence agencies and industry partners to trace and freeze more related assets. The cumulative frozen amount is expected to rise further, and the latest progress will be shared promptly as more information is confirmed.

He Yi: User funds are safe; Binance will bear all hack losses

Binance co-founder He Yi said user funds are safe and Binance will bear all losses from the hack. Deposits and withdrawals will be temporarily suspended while the team conducts security checks, freezes funds and cooperates with law enforcement. After the investigation is complete, Binance will publish a full post-mortem and reminds users to rely only on official channels for updates.

Arbitrum Security Council freezes about $30.5 million in Binance attack

The Arbitrum Security Council has executed a transaction to freeze about $30.5 million in the Binance exploit.

Analysis: Suspected Binance attacker mistakenly used MetaMask Gas Station, possibly leaving traceable records

Protocol engineer Justin Kalland wrote that the Binance attacker may have made an operational mistake. The attacker transferred 175 million USDT to a new wallet; about 2.5 minutes later, the wallet received 2 ETH for gas, consistent with the pattern of other attacker wallets. Two minutes later, the wallet used MetaMask's Gas Station even though it already had enough gas. Three consecutive transactions were bundled into the same block: the ETH top-up from Gas Station, an unlimited USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The ETH top-up amount exactly equaled the sum of the maximum gas budgets for the latter two transactions, precise to the wei.

Kalland speculated that the attacker was using a MetaMask wallet and, in a hurry, mistakenly selected USDT as the gas payment method. MetaMask sometimes defaults to this, and the top-up order within the same block matches its implementation. He noted that using Gas Station requires going through MetaMask Sentinel, so transactions pass through MetaMask rather than a normal RPC, and this interaction may leave off-chain records at MetaMask, including IP metadata. Among all the attacker wallets he checked, this was the only one that showed use of Gas Station.

Hacker has sold all 7.77 trillion PEPE from Binance hot wallet for ETH; PEPE price falls 12.33%

The hacker has sold all 7.77 trillion PEPE from the Binance hot wallet for 14,049 ETH, causing the PEPE price to fall 12.33%. The sale was worth more than $31.9 million, at an average price of about $0.0000041.

The unrealized gain on 11.8 trillion PEPE transferred out by Justin Sun since October 17 has narrowed to $4.45 million (average withdrawal price about $0.000004114), after briefly reaching $18.55 million last night.

Blockaid CEO: Binance hack may stem from compromised signing system, not stolen private keys

Blockaid CEO Ido Ben-Natan said that today's Binance hack may have stemmed from a compromised signing system rather than stolen private keys. The attacker reportedly bundled 50 EIP-7702 authorizations into a single transaction to hijack Binance wallets. Binance has not confirmed the specific attack method.

Analysis: Binance hot wallet attacker suspected to be same group as earlier Kelp DAO attacker

The hacker behind the Binance hot wallet attack is suspected to be the same group as the earlier Kelp DAO attacker. Thirty minutes ago, the Binance hacker transferred all 74.56 million ARB to address 0x0000000000000000000000000000000000000DA0, which Arkham has tagged as Kelp DAO Hacker. These tokens have not yet been moved or sold. Kelp DAO was attacked on April 18 this year, losing about $292 million in rsETH; at the time, the community speculated it was the North Korean hacking group Lazarus Group.

Ai Yi issued a correction: after verification, 0x0000000000000000000000000000000000000DA0 was a vanity address matching DAO characteristics that the Arbitrum Security Council specifically used as a multisig or temporary custody address to handle frozen assets in the Kelp DAO theft; this operation should not be hacker activity, but rather confusion caused by on-chain entities.

Binance: Verified total frozen amount is about $3 billion

Binance released an update saying that the currently verified total frozen amount is about $3 billion. The Binance team is working closely with law enforcement, issuers, blockchain intelligence firms and industry partners to continue tracing and freezing more assets. Binance said it will publish only confirmed figures and will provide further updates as more information is verified, and that user funds are safe.

Hacker has sold UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD, obtaining 70,480 ETH in total

The Binance hacker has sold UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD, obtaining a total of 70,480 ETH ($158.25 million). Details: 7.02 million UNI ($39.63 million, average price $5.65); 217.5 million ENA ($33.93 million, average price $0.16); 7.77 trillion PEPE ($31.66 million, average price $0.0000041); 2.57 million LINK ($26.05 million, average price $10.14); 127,953 AAVE ($14.27 million, average price $111.55); 21.85 million ONDO ($6.62 million, average price $0.30); 17.32 million WLD ($6.09 million, average price $0.35).

Chainalysis: Binance stolen amount was about $5.912 billion at the time of the incident

Chainalysis posted on X that it currently estimates the amount stolen from Binance at about $5.912 billion at the time of the incident, nearly four times the amount stolen in the second-largest crypto theft (Bybit, 2025).

Previously, Binance said the verified total frozen amount was about $3 billion.

Machi Big Brother liquidated eight times in six hours, all positions wiped out, account left with $1.50

Huang Licheng (@machibigbrother) was liquidated eight times in the past six hours, and all positions were wiped out. His Hyperliquid account has only $1.50 left.

Whale closes 36,500 ETH to avoid liquidation, cumulative loss exceeds $38 million

A whale holding a 93,184 ETH ($214 million) long position closed 36,517 ETH ($80.56 million) to avoid liquidation and still holds 56,667 ETH ($125 million). The new liquidation prices are $2,122.44 and $2,129.72, respectively. The whale's cumulative loss exceeds $38 million.

SlowMist CISO recommends investigating private key leakage path and abnormal withdrawal tools in Binance hack

SlowMist Chief Information Security Officer 23pds wrote: "In Binance's one-time asset theft incident, based on historical forensic experience, the attacker was able to bypass the risk control system. Whether the intrusion path was a private key leak or a compromised signing machine still needs to be confirmed. I personally lean toward the private key leak hypothesis. In addition, the attacker most likely used customized withdrawal tools. I recommend that the security department focus its traceback and forensics on the private key leakage chain and the characteristics of abnormal withdrawal tools."

Hacker moves more than $1 billion in ETH to new wallets, possibly preparing to launder via mixers

The hacker group reportedly behind the $5.8 billion Binance attack is moving more than $1 billion in ETH to new wallets and may be preparing to launder it through mixers such as Tornado.