Crypto Today: November 1, 2026

Each fact links to the outlet that reported it: check the original before relying on it. Not investment advice.

The FBI formally blamed North Korea’s TraderTraitor group for the record Binance hack of about $6.3 billion, while Binance began reopening withdrawals and the attackers kept moving funds across Tron, bridges and Solana. Bitcoin ETFs saw their largest outflow day of October, and the market stayed relatively steady, with bitcoin near $77,500 at the snapshot.

Markets snapshot

• BTC: $77,798.00 (+0.5% over 24 hours)
• ETH: $2,260.07 (+0.3% over 24 hours)
• SOL: $93.71 (-1.8% over 24 hours)

Prices as of Sunday, November 1, 2026.

Security & Hacks

FBI blames North Korea’s TraderTraitor for $6.3B Binance hack and asks DeFi to block stolen funds

The FBI says North Korean operators carried out the Oct. 29 Binance theft and has published hundreds of addresses, asking DeFi services and THORChain node operators to refuse transactions involving them. THORChain’s co-founder responded that node operators see only public data.

• On Oct. 29, attackers began draining Binance. Most outlets put the loss at about $6.3 billion, while Decrypt says roughly $6.4 billion, starting at 4:05 p.m. ET after US markets closed. (Cointelegraph, Decrypt, CryptoSlate)
• On Oct. 31, the FBI issued a security alert attributing the attack to North Korean cyber actors (TraderTraitor), working with the US Secret Service and IRS Criminal Investigation. (CryptoSlate, CoinDesk)
• The FBI said it had seen the attackers convert stolen assets mainly into Ethereum, and expected them to move the funds through DeFi protocols and instant swap services. (CryptoSlate)
• The FBI published hundreds of addresses tied to the theft, including BTC, ETH and SOL addresses, and urged THORNode operators, RPC node operators, DeFi platforms and instant exchanges to block transactions involving them. (CryptoSlate, CoinDesk, The Defiant)
• Chainalysis said the attackers have already used thousands of addresses, more than the FBI listed, and expects the number to keep growing. (CoinDesk)
• THORChain co-founder Chad Barraford replied that node operators hold no information beyond what is publicly visible in real time, adding that no subpoenas are needed, which he called a best case for investigators. (CryptoSlate, The Defiant)
• Separately, an Ethereum chain reorganization made THORChain double-refund a 10 ETH deposit, triggering an emergency pause on most of its bridges. Chainalysis said this briefly disrupted a laundering route, though the pause was indiscriminate rather than aimed at the hackers. (CryptoSlate)

Context: TraderTraitor is the name the FBI uses for a North Korean hacking operation. THORChain is a permissionless cross-chain swap network run by independent node operators. In September it rejected calls to block funds from Bitget’s $388 million hack, arguing it cannot selectively censor transactions, and it earned about 63% of its $3 million September income during the five-day trading surge tied to that hack. It distinguishes whole-network emergency halts from blacklisting individual addresses.

Why it matters: The appeal puts a direct US government request in front of decentralized services that say they cannot or will not filter transactions, and it tests how much of the stolen money can be cut off after it leaves centralized exchanges. The FBI’s list is already smaller than the set of addresses Chainalysis says the attackers have used.

Disputed or unconfirmed: The loss is reported as about $6.3 billion by most outlets and about $6.4 billion by Decrypt. The attribution to North Korea comes from the FBI; the articles do not describe independent confirmation beyond Chainalysis tracing laundering activity.

Watch next: Whether THORChain node operators or other DeFi services publicly act on the FBI’s address list.

Binance hackers launder funds through Tron, bridges and Solana, and lose $119M in rushed trades

The attackers are spreading stolen funds across chains and used a lending-protocol trick to get around stablecoin freezes. Bitquery estimates their hurried trades cost them about $119 million.

• On Oct. 29-30, Bitquery found the attackers lost about $119 million swapping stolen assets at unfavorable prices, including about $71.5 million above market to buy ETH on Ethereum. (CryptoSlate)
• Their buying pushed Uniswap’s main WETH/USDT pool as much as 38% above the broader market. Arbitrage traders kept about $60 million in profit after costs, and Ethereum validators and builders received about $29.5 million. (CryptoSlate)
• On Tron, the attackers swapped about 234 million USDT for TRX at $22.4 million above market, and sold tokens such as UNI, PEPE and ENA about $24.8 million below market. (CryptoSlate)
• Chainalysis said the attackers used Tron lending protocols to dodge stablecoin freezes: they deposit stablecoins and receive receipt tokens that issuers cannot directly freeze, move those to fresh wallets, redeem and bridge to ETH. About $500,000 was traced through this method. (CryptoSlate)
• Chainalysis also said the Tron operation spanned more than 1,000 addresses and over 3,000 deposits, drained about $500 million, and then spread across chains, including Solana. (The Defiant)
• Analyst SomaXBT traced about $140 million off Tron via four bridges: Relay (the most, $48 million), THORChain, Chainflip and Symbiosis. The Block put total laundering via Tron at $242 million. (The Block, The Defiant)

Context: Stablecoin issuers such as Tether and Circle can freeze tokens at specific addresses, which is why the attackers are converting to assets that cannot be frozen. Bridges move value between blockchains. MEV (maximal extractable value) is the market in which traders pay block builders to prioritize profitable trades.

Why it matters: Laundering routes that avoid freezes limit how much of the theft can be recovered, and the bridges involved are the same services the FBI has asked to block flagged addresses.

Disputed or unconfirmed: Freeze totals differ: Chainalysis (via CryptoSlate) says stablecoin freezes have restricted about $3 billion, while Decrypt reports Tether and Circle froze more than $2.3 billion. Tron figures also differ by source: $242 million (analyst via The Block), $500 million (Chainalysis via The Defiant), and about $140 million moved off Tron (SomaXBT). They may measure different things or windows.

Watch next: Whether bridges named in the tracing, such as Relay and Chainflip, respond to the FBI’s request.

Companies & Industry

Binance reopens withdrawals in phases, starting with bitcoin, and sees billions in net outflows

Binance began restoring withdrawals in stages, bitcoin first, and says it has replenished about 95% of the affected amount. It reports net outflows of $3.64 billion, while a separate tally puts the figure higher.

• Binance began reopening customer withdrawals in phases, with bitcoin first, after the roughly $6.3 billion hack. (CoinDesk, The Defiant)
• The exchange said it has replenished about 95% of the impacted amount, with less-liquid tokens making up the remaining 5%. (The Defiant)
• Binance reported $3.64 billion in net outflows after reopening, equal to 2.1% of its $171 billion in assets, and said withdrawal volumes have fallen after an initial spike. (The Block)
• A separate tally by The Defiant showed a $4.54 billion net outflow from Binance, while 10 large tracked rivals gained $564 million, with OKX leading the gains. (The Defiant)
• The Defiant cautioned that exchange-wide net flows do not show how much Binance customers moved into self-custody. (The Defiant)

Context: Binance is the largest crypto exchange. Decrypt reports it pledged to cover all losses from company funds and an emergency reserve. Net outflow means withdrawals minus deposits over a period.

Why it matters: Withdrawal behaviour is the first practical test of customer confidence after the hack. So far the outflows are a small share of reported assets, and Binance says volumes are easing.

Disputed or unconfirmed: The $3.64 billion figure is from Binance (via The Block), an interested party. The $4.54 billion figure is from The Defiant’s tracking and may use a different method or window; the articles do not reconcile the two.

Watch next: Binance’s schedule for the later withdrawal phases and the remaining less-liquid tokens.

Institutions & ETFs

Bitcoin ETFs post $643M in outflows after the Binance hack

US spot bitcoin ETFs lost $643.2 million on Friday, Oct. 30, their biggest daily outflow of October, in the first full session after the hack. Prices dipped but have since steadied.

• US spot bitcoin ETFs shed $643.2 million on Friday, the largest single-day outflow of October, erasing a four-day, $441 million inflow run. Thursday’s $17.2 million inflow came before the theft. (Decrypt)
• Ethereum ETFs lost $155.7 million on Friday, and Solana ETFs lost $10.8 million, their fifth straight day of outflows. (Decrypt)
• Bitcoin fell about 4% to roughly $76,400 on Friday and more than $1.3 billion of leveraged positions were liquidated, per Decrypt. By Saturday it had steadied near $77,520. (Decrypt)
• Block Scholes reported $1.53 billion in crypto-wide liquidations over 24 hours in an Oct. 30 note, 84% of them long positions. (CryptoSlate)
• Coinalyze showed aggregate bitcoin open interest of $28 billion on Oct. 31, up 3% in 24 hours, suggesting new positions were being opened despite the liquidations. (CryptoSlate)

Context: Spot ETFs hold the actual coin and trade like stocks, so their daily flows are watched as a gauge of institutional and adviser sentiment. Open interest measures outstanding derivatives positions, while liquidations are positions forcibly closed.

Why it matters: The reaction was far milder than the roughly 11% drop after a failed attack on Binance in 2018, per Decrypt, but ETF selling and rising derivatives exposure mean the recovery depends on demand rather than more leverage. Decrypt notes the Fed held rates at 3.75% to 4% on Wednesday with two officials voting for a hike, and traders put December hike odds above 70%.

Disputed or unconfirmed: Liquidation totals differ ($1.3 billion from Decrypt versus $1.53 billion from Block Scholes), likely because of different data providers and windows.

Watch next: The next daily ETF flow reports, to see whether outflows continue.

Regulation & Policy

Crypto PACs make a late Republican push ahead of the Nov. 3 midterms

Crypto political groups have backed Republicans in the final weeks before the Nov. 3 midterms, even though polling and online wagers favor Democrats gaining power in Congress. The winners will shape crypto legislation and regulation.

• CoinDesk reports crypto PACs made a large Republican push in the final weeks before the Nov. 3 election. (CoinDesk)
• Polling and online wagers put Democrats at a high chance of gaining greater power in Congress, the opposite direction from the industry’s spending. (CoinDesk)
• The industry has a $63 million stake in Ohio, where Sherrod Brown, described as a crypto adversary, may return to the Senate. (CoinDesk)
• CoinDesk says crypto is not a major election issue, but who takes office in January will shape the industry over the next two years. (CoinDesk, CoinDesk)

Context: PACs (political action committees) pool money to support candidates. Background: Sherrod Brown is a Democratic former senator from Ohio who has been critical of the crypto industry.

Why it matters: A shift in congressional control could change the odds for crypto legislation and the tone of oversight, and the industry’s spending leans toward the side that polls suggest is less likely to gain power.

Watch next: Election day, Nov. 3, especially the Ohio Senate race.

Quick hits

• BTCPay Server told operators to run its shutdown script after reports of hot-wallet sweeps; the alert did not name affected versions or announce a patch. (The Defiant)
• Threshold says tBTC operators patched or went offline over a Linux flaw, and a separate incident drained about 0.5 ETH from an operator’s fee account; Aave’s frozen Ethereum Core reserve holds about $136.3 million of tBTC. (The Defiant)
• The SEC alleges a $130 million crypto fraud in which scammers used the SEC’s own website to lure investors, and seeks monetary relief plus a targeted bar on future filings. (CryptoSlate)
• Two smaller exploits were reported: b14g, a Bitcoin staking platform, lost about $1.47 million (97 million CORE) on Oct. 31 via zero-token withdrawal requests, and Premia vaults lost $437K. (CryptoSlate)
• Objections to OKX’s ICE stock-token listings reached 50 symbols including Nvidia, covering 44 of 63 proposed symbols. (The Defiant)
• Solana Mobile says a fake ‘SKR Claim’ app reached its store spotlight; it patched a bug that allowed links to unpublished apps and is removing the app from affected devices. (The Defiant)