Crypto Today: October 31, 2026

Each fact links to the outlet that reported it: check the original before relying on it. Not investment advice.

The Binance breach, put at $6.3 billion by CoinDesk, dominated the day: the exchange says it has replaced 90% of the stolen assets and is aiming to resume withdrawals on Nov. 1. The fallout spread into DeFi lending and bridges, and into Chainalysis, the analytics firm tracing the funds, which disclosed its own separate breach.

Markets snapshot

• BTC: $77,567.00 (+1.2% over 24 hours)
• ETH: $2,261.00 (+0.9% over 24 hours)
• SOL: $96.00 (+0.6% over 24 hours)

Prices as of Saturday, October 31, 2026.

Security & Hacks

Binance says 90% of stolen assets replaced and aims to restart withdrawals Nov. 1

Binance says it is covering the losses from its own funds, futures reserves and its SAFU emergency fund, and has replaced about 90% of what was taken, with withdrawals targeted for Nov. 1. The company’s claims are not yet independently verified; full proof of reserves is due by Nov. 3.

• CoinDesk reported that Binance suffered a breach of about $6.3 billion and is absorbing the losses through corporate funds, futures reserves and SAFU, so user balances stay intact. (CoinDesk)
• Binance says it has replenished about 90% of the stolen assets; the remaining shortfall is in less-liquid tokens, which it is buying through market and over-the-counter trades. (Cointelegraph, CoinDesk)
• The exchange is targeting Sunday, Nov. 1, to restart withdrawals. (Cointelegraph, The Defiant)
• A new reserves page reports full backing for major tokens, with the complete cryptographic proof expected by Nov. 3. (The Defiant)
• Binance confirmed a transfer of 7,499 BTC from SAFU after the hack and pledged to rebuild the fund to about $1 billion. (The Defiant)

Context: Binance is the world’s largest crypto exchange by volume. SAFU is its emergency insurance fund, built from trading fees to compensate users after incidents. The headline title given for this story also refers to the FBI naming TraderTraitor, a North Korea-linked hacking group, but the supplied article text does not describe that attribution.

Why it matters: If the replacement and reserve claims hold, users avoid losses at the largest exchange. The restart and proof of reserves will test whether the claims can be verified.

Disputed or unconfirmed: The 90% replenishment, full backing and restart timeline come from Binance itself. The supplied articles do not include the FBI’s attribution to TraderTraitor, so it is not confirmed here.

Watch next: Withdrawal restart targeted for Nov. 1; full cryptographic reserve proof expected by Nov. 3.

Chainalysis discloses breach by attacker using ‘offensive agentic techniques’

Chainalysis said an outside actor accessed its systems this month and exposed customer names, emails, user IDs and organization role labels. It says there is no sign investigation data, passwords or session tokens were accessed, and the incident is unrelated to Binance.

• In an Oct. 30 disclosure, Chainalysis said it detected unauthorized access to its systems and internal tools this month. (CryptoSlate)
• Exposed data categories include names, email addresses, user IDs and organization role labels, though not every field is confirmed for every user. (CryptoSlate)
• The company says it found no indication of access to investigation content, clear-text passwords, multifactor secrets or session tokens; this is provisional. (CryptoSlate)
• It described the intruder’s methods as ‘offensive agentic techniques’ but gave no technical account of how AI was used. (CryptoSlate, The Block)
• Chainalysis notified all customers, engaged outside security experts and urged organizations to enable two-factor authentication and watch for unexpected password resets. (CryptoSlate, Cointelegraph)
• It did not give a count of affected records or name the intruder. (CryptoSlate)

Context: Chainalysis is a blockchain analytics firm used by law enforcement and companies to trace funds. It has also been tracking the Binance theft.

Why it matters: Exposed names and emails of people at investigative and compliance teams could help phishing aimed at them.

Disputed or unconfirmed: The unrelated-to-Binance claim and the finding that investigation data was untouched come from Chainalysis itself and are preliminary.

Watch next: Customer-specific breakdowns of affected records, which the company promised.

Binance attackers use Tron lending route and receipt tokens to dodge stablecoin freezes

Chainalysis says the attackers moved stolen stablecoins through a Tron DeFi protocol and receipt tokens to avoid freezes by issuers.

• Attackers raced to convert stolen stablecoins into assets issuers cannot freeze, as Tether and Circle moved to immobilize billions of dollars. (Cointelegraph)
• Chainalysis flagged a DeFi receipt-token route in the hack. (The Defiant)
• An onchain example shows USDT deposited into JustLend, transferred as jUSDT, and redeemed by another wallet. (The Defiant)
• The Block reports Chainalysis says attackers are using a Tron protocol to evade stablecoin freezes. (The Block)

Context: Tether and Circle issue USDT and USDC and can block specific addresses. JustLend is a lending protocol on Tron; depositing gives a receipt token (jUSDT) that can be moved and redeemed by someone else.

Why it matters: Receipt tokens can carry value across wallets without moving the frozen stablecoin itself, which complicates freezing.

Disputed or unconfirmed: The route is described by Chainalysis, and the example is one onchain case, not a full account of the flows.

DeFi

DeFi lenders and bridges freeze markets and pause operations as Binance hack spills over

Aave froze its tBTC reserve after Threshold paused its bridge, and Aave cut borrowing caps while lending rates spiked on Morpho. Threshold says tBTC remains fully backed.

• Aave froze a reserve for tBTC after Threshold, the tBTC issuer, paused minting and redemptions; repayments, withdrawals and liquidations continue, and Aave’s Ethereum Core market holds about $136.5 million of tBTC deposits. (The Defiant)
• Aave had imposed an emergency freeze on Oct. 29. LlamaRisk, its risk provider, described the exploiter’s Aave position as overcollateralized and subject to normal liquidation. (CryptoSlate)
• As of an Oct. 30 update, LlamaRisk executed lower borrowing ceilings and temporary interest-rate changes on Aave V3 and V4, estimating they remove roughly $3.8 billion of unused borrowing capacity; GHO cap cuts were still queued. (CryptoSlate)
• At 00:26 UTC on Oct. 30, Core USDC utilization was 97.8%, with several other reserves displayed at 100%. (CryptoSlate)
• Threshold said tBTC is fully backed while the bridge pause continues; Gauntlet says about 640,000 USDC remains supplied to a tBTC-backed Morpho market. (The Defiant)
• On Morpho, borrow rates hit roughly 40% when liquidity in a reUSD-backed market vanished within two hours; rates across four tracked markets eased to about 9%–13% by Oct. 31. (The Defiant)

Context: Aave and Morpho are lending protocols where users deposit crypto and borrow against it. tBTC is a bitcoin-backed token run by Threshold. Freezing a reserve blocks new deposits and borrowing but lets users repay and withdraw.

Why it matters: The episode shows how a centralized exchange failure can strain on-chain lending, trapping liquidity and spiking borrowing costs.

Disputed or unconfirmed: Threshold’s claim that tBTC is fully backed is the issuer’s own. LlamaRisk’s own documents also list conflicting rate settings, so the deployed parameters are unclear.

Watch next: Whether Threshold resumes tBTC minting and redemptions and Aave lifts the tBTC freeze.

Companies & Industry

ICE to run regulated US perpetual futures market built on Hyperliquid

Intercontinental Exchange agreed on Thursday to run a regulated US perpetuals market on Hyperliquid with Trade[XYZ]. HYPE rose about 13%, but revenue to Hyperliquid is undisclosed.

• ICE, owner of the NYSE, agreed Thursday to run a regulated US market for perpetual futures built on Hyperliquid; Stan Druckenmiller said he invests in partner Trade[XYZ]. (Unchained)
• HYPE has risen about 13% since the announcement, to near $90 on Friday afternoon. (Unchained)
• None of the announcements reveal how much revenue Hyperliquid will earn from US trading. (Unchained)
• Hyperliquid spends nearly all its trading fees buying HYPE; from Oct. 9 to Oct. 29 the fund bought 436,765 HYPE for $35.5 million, by Unchained’s count. (Unchained)
• Trade[XYZ]'s markets carry about 30% of Hyperliquid’s trading but pay for about 5% to 7% of the buyback, and a ‘growth mode’ can cut protocol fees 90%. (Unchained)

Context: Perpetual futures are contracts that never expire. Hyperliquid is a crypto derivatives exchange whose builders can list their own markets under its HIP-3 upgrade.

Why it matters: The deal brings a major regulated exchange operator to onchain derivatives, but how much fee income reaches Hyperliquid’s buyback is unclear.

Quick hits

• CertiK puts 2026 crypto losses at a record $9.2 billion, with $3.03 billion frozen or returned in October, cutting the month’s adjusted losses to $3.47 billion. (The Defiant)
• The SEC charged BG Wealth Sharing and DSJ Exchange over a scheme that took more than $130 million, alleging they used real filings and fake registration certificates to appear approved. (Unchained)
• Israel extradited Alexander Block to the US on charges tied to the 2022 Nomad bridge exploit; he has not been convicted. (Unchained)
• KuCoin ended service for users in Russia and Belarus, while Russia’s central bank gave exchanges 90 days to join a self-regulator. (Unchained)
• About a dozen DeFi websites registered through Name.com were hijacked, with roughly $138,000 stolen. (The Block)
• b14g says 97 million CORE was drained and paused its contracts; exchanges froze about 9 million CORE and staked BTC was unaffected. (The Defiant)