Crypto Today: October 30, 2026

Written with AI from public reporting. Each fact links to the outlet that reported it: check the original before relying on it. Not investment advice.

Binance, the world’s largest crypto exchange, lost about $6.3 billion in the largest exchange hack on record, and blockchain analytics firms quickly pointed to North Korea. The fallout reached leveraged traders, institutional holders and other exchanges, while smaller stories included a suspected hardware wallet implant and the Strategy CFO’s exit.

Markets snapshot

• BTC: $77,306.00 (-0.1% over 24 hours)
• ETH: $2,244.41 (-0.2% over 24 hours)
• SOL: $95.65 (+0.5% over 24 hours)

Prices as of Saturday, October 31, 2026.

Security & Hacks

Binance loses about $6.3 billion in largest exchange hack on record

Attackers drained roughly $6.3 billion from Binance wallets on Thursday, the biggest exchange theft ever recorded. Binance has pledged to cover all losses, but withdrawals remain suspended and its own reserve data shows a gap until stolen assets are replaced.

• Thursday (Oct. 29), attackers moved about $6.36 billion out of Binance wallets across 10 blockchains, most of it in around 20 minutes starting at 4:05 p.m. ET, according to TRM Labs. (Decrypt, The Block)
• On Ethereum, the attacker used an EIP-7702 delegation, which lets an ordinary wallet run smart contract code, to turn a Binance hot wallet into a sweeper, with 50 pre-signed authorizations prepared in advance; on the other nine chains funds left through ordinary signed transfers, per TRM. (Decrypt)
• Binance said its investigation pointed first to a compromised DevOps engineer’s laptop that gave access to internal infrastructure. (Cointelegraph)
• CEO Richard Teng later said the investigation had found a wider breach, with hackers erasing evidence and bypassing security checks. (CoinDesk, Decrypt)
• Binance’s own reserve data lists the drained wallets as backing customer balances, leaving its ether backing an estimated 6% short until the stolen assets are replaced. (CoinDesk)
• Binance is targeting a restart of withdrawals on Sunday and plans to publish its proof of reserves on Monday; it has publicly committed to cover all losses. (CoinDesk, The Defiant, Decrypt)

Context: Binance is the largest crypto exchange by volume and holds a large share of customer assets in hot wallets, which are internet-connected wallets used for day-to-day withdrawals. The previous record was the $1.5 billion Bybit hack of February 2025, which started the same way, with one compromised machine.

Why it matters: The theft is roughly four times the previous record and hits the exchange most of the industry relies on for liquidity. How quickly Binance restores withdrawals and shows full backing will shape confidence in centralized exchanges.

Disputed or unconfirmed: Binance first pointed to one engineer’s laptop, then said there were additional points of breach; the full cause remains unsettled. The loss is given as about $6.3 billion by Binance, $6.36 billion by TRM and $6.4 billion by Chainalysis.

Watch next: Withdrawal restart targeted for Sunday (Nov. 1) and Binance’s proof of reserves due Monday (Nov. 2).

North Korea’s TraderTraitor blamed for Binance hack as attacker launders funds and issuers freeze about $3 billion

Three analytics firms attribute the hack to North Korea, with TRM and Chainalysis naming the TraderTraitor group. Issuers and others have frozen roughly $3 billion, but the attacker still holds about $2.4 billion out of reach.

• TRM Labs attributed the hack to North Korea’s TraderTraitor with high confidence, citing on- and off-chain intelligence and similarities to the Bybit hack and April’s KelpDAO exploit. (Decrypt, Cointelegraph)
• Chainalysis said its strongest evidence was seeing Binance loot mix in real time with funds from last month’s Bitget exploit, previously attributed to North Korean actors; ZachXBT also saw funds from both hacks converge at one address. (Decrypt, Cointelegraph, The Defiant)
• Singapore-based Pangolin Intelligence also told CNN it believed a North Korean unit was responsible; CoinDesk reported researchers suggesting the Lazarus Group. (Decrypt, CoinDesk)
• Both TRM and Chainalysis said the attacker’s operating wallet was funded through the Tornado Cash mixer, and Chainalysis described never-before-seen automated laundering patterns involving thousands of transactions. (Decrypt)
• The attacker sold USDT to market makers and borrowed ETH against USDT on Aave to outrun freezes, and now holds over 420,000 ETH and 18,270 BTC, about $2.4 billion, according to TRM. (Decrypt)
• Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB; Binance puts total frozen funds at about $3 billion. (Decrypt, The Defiant)

Context: TraderTraitor is a North Korean state-linked hacking group that the FBI tied to the Bybit theft. Chainalysis and TRM are blockchain analytics firms that trace stolen funds. Background: North Korea has repeatedly denied hacking allegations, and the articles note the same.

Why it matters: Attribution to a state actor lowers the odds of recovering the remaining funds and raises the likelihood of government involvement. The freezes show how much stolen money can be stopped when issuers act fast, and how much cannot.

Disputed or unconfirmed: Attribution comes from private analytics firms, not a government; CoinDesk’s report names Lazarus Group while TRM and Chainalysis name TraderTraitor. North Korea has denied past allegations.

Trezor warns CryptoBilis buyers to move funds after suspected hardware implant in a Safe 5

Trezor is treating one customer report of an implant inside a Safe 5 bought from reseller CryptoBilis as credible, though it has not examined the device. It asks buyers since March 2026 to move funds to a new seed.

• A customer reported through Trezor’s responsible disclosure program a Safe 5 bought from CryptoBilis in August 2026 that contained an added circuit board with a cellular module. (Unchained, Protos)
• The implant reportedly captures what the screen shows, including the recovery phrase, and sends it over a mobile network when plugged in, similar to implants found in Ledger devices. (Unchained, Protos, The Block)
• Trezor has not received the device and said it would examine it on arrival; it has found no tampering in four CryptoBilis-bought devices it inspected. (Unchained, Protos)
• Trezor asked anyone who bought a wallet from CryptoBilis since March 2026 to move funds to a fresh seed and not reuse the old one; it will provide replacements. (Unchained, Protos, The Defiant)
• Trezor says no CryptoBilis buyer has reported a loss of funds. (The Defiant, Unchained)

Context: A seed (recovery phrase) is the backup that controls a wallet’s funds. Trezor dropped CryptoBilis as a reseller on Oct. 9 after tampered Ledger devices were sold through it. An analyst tallied more than $86 million reportedly drained from Ledger users, and Protos reports Trezor is reviewing other Asia-based resellers.

Why it matters: If confirmed, it would be the first sign that Trezor devices, not only Ledger’s, were tampered with through this reseller. The case shows supply-chain risk from buying hardware from third parties.

Disputed or unconfirmed: The implant is unconfirmed and rests on one customer’s description. Trezor earlier said there was no evidence its devices had been compromised.

Watch next: Trezor’s lab examination of the reported device once it arrives.

Markets

Binance hack fallout: liquidations, institutional outflows, exchange restrictions and a weaker price outlook

The hack triggered $1.5 billion in leveraged liquidations, institutional withdrawals from exchanges and trading limits at India’s CoinDCX. Standard Chartered says prices may stay under pressure.

• A selloff in bitcoin, ether and XRP wiped out $1.5 billion in leveraged bets, with long positions making up nearly 84% of forced closures and Binance handling almost half the total. (CoinDesk)
• A rebound has since begun catching short sellers. (CoinDesk)
• Institutional investors rushed to pull funds from exchanges, suggesting the fallout is spreading beyond Binance. (CoinDesk)
• CoinDCX, India’s largest crypto exchange, restricted new futures positions after the incident disrupted a key liquidity provider; it said deposits, withdrawals and customer funds were unaffected. (CoinDesk)
• Standard Chartered said crypto prices may stay under pressure before finding a base, citing the Binance breach and a Polymarket exploit. (CoinDesk)

Context: Liquidations occur when exchanges forcibly close leveraged positions after price moves. Binance also supplies liquidity to other platforms, so its disruption spreads. Market snapshot as of Oct. 31: bitcoin about $77,306 (down 3.9% over 7 days), ether about $2,244 (down 5.1%), solana about $95.65 (down 5.6%).

Why it matters: Concentration risk in one exchange is now visible in prices, derivatives and counterparties. Institutions moving assets off exchanges could change where trading volume sits.

Disputed or unconfirmed: Standard Chartered’s outlook is one bank’s view, not a forecast supported by the other articles.

Companies & Industry

Strategy CFO Andrew Kang resigns as company reports record paper operating income and insider sales draw scrutiny

Strategy reported $20.9 billion of Q3 operating income that came from marking up its bitcoin, and announced CFO Andrew Kang is leaving Nov. 5. The stock fell more than 8% on the news, per Protos.

• Strategy reported $20.91 billion of Q3 operating income, all from a gain on digital assets; excluding it, operations lost about $2.6 million. (Unchained, CoinDesk)
• The company added 7,218 BTC in the quarter, down from 85,296 in Q2, and sold 5,552 BTC to fund preferred dividends and STRC repurchases. (Unchained)
• Kang said he is leaving Nov. 5 for personal reasons; CEO Phong Le becomes principal financial officer and Reza Virasteh becomes co-CFO from Jan. 1, 2027. (Unchained, Protos)
• Insiders sold 227,580 MSTR shares this year; Le sold the most, and Kang sold 43,897 shares for about $5.5 million, last on June 9, under a 2024 trading plan covering tax withholding. (Protos)
• StoneX and TD Cowen kept buy ratings, citing a $4.83 billion cash reserve and a more stable STRC preferred structure. (The Block)

Context: Strategy is the largest corporate bitcoin holder, with 848,517 BTC, and funds purchases by issuing stock and preferred shares such as STRC. It reports bitcoin at fair value, so price rises show as profit.

Why it matters: The profit figure reflects bitcoin’s price, not business cash flow, and a CFO exit during a heavy-issuance strategy draws attention.

Disputed or unconfirmed: Strategy says Kang’s resignation is for personal reasons with no disagreement; Protos draws a link to insider sales, which the company and insiders deny.

Watch next: Kang’s departure on Nov. 5 and Le taking over as principal financial officer.

Quick hits

• Utah filed 13 felony charges against Kalshi over sports contracts, while the CFTC contests state authority. (CryptoSlate)
• Tether reported a $1.5 billion Q3 operating profit and a $7.95 billion reserve buffer; BDO’s attestation covered the September-end report, not the whole quarter. (The Defiant)
• Coinbase’s Q3 net income rose 66%, with prediction markets and derivatives helping offset weaker spot trading. (The Block)
• Israel extradited an alleged Nomad bridge exploiter to the US after its Supreme Court ruled that exploiting a coding flaw can count as computer intrusion. (Decrypt)
• Zcash Community Grants proposed redirecting about $124 million toward mining rewards, but critics say it does not address governance concerns. (Cointelegraph)
• Polymarket suffered its second multimillion-dollar security breach in four months. (CryptoSlate)