Crypto Today: November 2, 2026

Each fact links to the outlet that reported it: check the original before relying on it. Not investment advice.

The aftermath of the record Binance hack dominated the day: authorities and firms froze billions of the loot while North Korea denied blame, and separate incidents followed at a Brazilian exchange, in BTCPay Server and in a suspected $106M theft. A critical Linux flaw also put Solana validators on alert.

Markets snapshot

• BTC: $76,708.00 (-1.5% over 24 hours)
• ETH: $2,249.02 (-0.6% over 24 hours)
• SOL: $91.79 (-2.2% over 24 hours)

Prices as of Monday, November 2, 2026.

Security & Hacks

Binance hack fallout: $2.85B frozen or seized, THORChain halts swaps, North Korea denies FBI blame

Of the roughly $6.43B reportedly stolen from Binance, about $2.85B has been frozen or seized, far more than in the Bybit hack, even as laundering spreads across thousands of wallets. North Korea has rejected US blame.

• Binance’s hot wallets were drained on Oct. 29, in a theft TRM Labs attributed with high confidence to TraderTraitor, a North Korean hacking unit. (Unchained)
• Decrypt reported that $2.85B of the $6.43B stolen has been frozen or seized, versus about 3% in the Bybit hack, while automated laundering spans around 12,000 wallets. (Decrypt)
• Elliptic traced roughly 12,000 wallets across 11 blockchains, flagged the first Bitcoin mixing of the proceeds, and put remaining linked balances at $3.24B. (The Defiant)
• THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, after a block reorg bug, slowing the hackers. (Cointelegraph)
• Protos reported that the FBI told node operators such as THORChain’s to block transactions, and that the US Secret Service is also investigating. (Protos)
• Kim Yo Jong called the US accusation “absurd rhetoric”; Chainalysis cited stolen funds mixing with proceeds of an earlier exploit. (The Defiant)
• Binance has reopened withdrawals and deposits, and Protos says it has seen over $6B in net outflows. (Protos)

Context: TraderTraitor is a North Korea-linked hacking group. The previous record theft was almost $1.5B from the exchange Bybit. THORChain is a decentralized network for swapping assets across blockchains, often used to launder stolen funds. Background: figures of ‘stolen’ and ‘frozen’ come from the cited outlets and analytics firms, not from Binance in these articles.

Why it matters: The high freeze rate suggests faster coordination than in past thefts, but the scale and cross-chain spread of the laundering leave billions still at risk of disappearing. The THORChain halt also shows how infrastructure operators are being pulled into enforcement.

Disputed or unconfirmed: North Korea denies responsibility, while the US (FBI), TRM Labs and Chainalysis point to North Korea-linked actors. Frozen/stolen totals come from Decrypt and Elliptic’s figures differ in framing ($3.24B remaining linked balances).

Brazil’s Mercado Bitcoin halts withdrawals after roughly $46M drained across 10+ chains

Brazilian exchange Mercado Bitcoin paused deposits and withdrawals after wallets on at least 10 chains were emptied; estimates of losses range from $40M to $46M and rising. The exchange says customers were not harmed.

• Mercado Bitcoin paused deposits and withdrawals after wallets on at least 10 chains were emptied, days after the Binance hack. (CoinDesk)
• The exchange said it contained the incident, that there was no harm to customers and no data breach, and called the pause precautionary while it works with authorities. (Protos)
• Arkham analyst Emmett Gallic said losses exceed $46M and growing, with old deposit addresses being swept while the attacker sells memecoins and altcoins. (Protos)
• Arkham groups 36 addresses holding $46M tied to the attacker; the exchange has not disclosed a total loss. (The Defiant)
• Tether said it froze over 4.5M USDT linked to the incident, with blacklist actions visible on Ethereum and Tron; deposits and withdrawals remain suspended. (The Defiant)

Context: Mercado Bitcoin is one of Brazil’s larger crypto exchanges. Arkham is a blockchain analytics firm. Tether can blacklist addresses holding its USDT token, making it a common tool for freezing stolen funds.

Why it matters: It adds to a cluster of exchange-related thefts following the Binance hack, though no link has been shown. The exchange’s no-customer-harm claim remains untested while services are suspended.

Disputed or unconfirmed: Loss estimates differ: CoinDesk says $40M, Protos and Arkham say about $46M. ‘No harm to customers’ is the exchange’s own claim.

Watch next: Whether Mercado Bitcoin reopens deposits and withdrawals and discloses a loss figure.

Critical Linux zero-click flaw unpatched on Ubuntu, with a Claude-built exploit; Solana validators warned

A critical Linux networking bug (CVE-2026-98432, severity 9.8/10) is fixed in the kernel and by some distributions but not yet on Ubuntu, which Solana validators commonly use. Anza urged mitigations; no validator compromise has been reported.

• Anthropic published research on Oct. 27 saying an unreleased Claude research model built an exploit giving root command execution on Linux servers with an MPTCP listener, taking about 53 minutes in its demonstration. (CryptoSlate)
• Anza issued an urgent warning to Solana mainnet-beta validators on Nov. 1; the Solana Foundation’s Tim Garcia advised blocking incoming TCP packets with IPv4 options, disabling MPTCP and turning off TCP request-socket migration. (CryptoSlate, The Defiant)
• Red Hat patched on Sunday and AWS has corrected kernel packages for Amazon Linux 2 and 2023, but Ubuntu 24.04 was still listed as ‘Vulnerable work in progress’ on Nov. 2, with version 6.8.0-149.149 planned as the fix. (Decrypt, CryptoSlate)
• The bug was widely called the ‘worst bug in the history of the internet’ over the weekend, including by crypto figures. (Protos)

Context: Solana validators run the nodes that secure the network, and Anza’s requirements specify Ubuntu 24.04. MPTCP is a Linux feature letting a connection use multiple network paths. Red Hat warned filtering cannot fully eliminate exposure.

Why it matters: A takeover of a validator server could expose credentials and disrupt operations. Exposure depends on each server’s kernel and configuration.

Disputed or unconfirmed: ‘Worst bug ever’ is social-media and commentator characterization. The demonstrated exploit needed a specific MPTCP configuration, and not every validator is shown to be vulnerable.

Watch next: Release of the fixed Ubuntu kernel and operators rebooting into it.

Suspected $106M theft from an EU entity’s exchange accounts, funds routed into Monero

On-chain investigator ZachXBT says over $106M may have been stolen on Nov. 1 from an EU entity’s accounts at several exchanges, with part converted to Monero. Nobody has confirmed the loss.

• ZachXBT posted a Telegram alert on Nov. 2 saying funds were pulled as USDC and USDT from accounts at multiple centralized exchanges. (Unchained, CoinDesk)
• The actor swapped USDC for ETH, used instant exchanges including WellWallet and Kyrrex, converted some to Monero via Wagyu, and bridged across chains; he listed 11 Ethereum addresses. (Unchained)
• He said with high confidence that the actor is not Lazarus Group, without naming indicators. (Unchained)
• The victim, exchanges and method of access remain unidentified, and no exchange or victim has publicly confirmed a loss. (Unchained, CoinDesk)
• Separately, a wallet tied to a Solana arbitrage bot may have lost $786,000. (Cointelegraph)

Context: ZachXBT is a well-known independent on-chain investigator. Monero hides senders, receivers and amounts by default, making funds much harder to trace.

Why it matters: If confirmed, it is another large theft within days of the Binance hack, by an actor apparently different from North Korea, and Monero conversion limits recovery.

Disputed or unconfirmed: The loss is a single investigator’s estimate, unconfirmed by any victim or exchange; the not-Lazarus attribution is likewise his claim.

Bitcoin

BTCPay Server operators told to shut down as hot wallets are drained on versions 2.4.1 and older

BTCPay Server, open-source software for accepting bitcoin payments, told operators to switch off servers after reports of hot wallets being swept. It later tied the attacks to versions 2.4.1 and older and said it has no credible reports on 2.4.7.

• On Nov. 1 at 5:25 p.m. ET, BTCPay asked operators to run its shutdown script until the investigation was complete. (Decrypt, Unchained)
• About two hours later founder Nicolas Dorier said the project’s own public servers were not attacked, the reports involved versions before 2.4.2, and the attacker had logged in as admin, how unknown. (Unchained, Decrypt)
• Later Sunday the project said it identified an attack vector targeting 2.4.1 (released July 23) or older, and had no credible drain reports on 2.4.7. (Unchained, The Defiant)
• Hosting providers including LunaNode shut down BTCPay instances automatically to protect older versions. (Decrypt)
• BTCPay has given no loss figure, server count, advisory or fix, and did not say whether the shutdown request still stands. (CoinDesk, Unchained)

Context: BTCPay is self-hosted, so no central operator can switch instances off. Hot wallets keep keys on the internet-connected server. In August, versions before 2.4.2 had a flaw letting attackers take Lightning node credentials, and Foundation and Citadel21 were hit. Version 2.4.7, released Thursday, fixed a critical bug found via Anthropic’s scanner.

Why it matters: Merchants running outdated versions with hot wallets face direct fund loss, and the project’s response relies on voluntary action.

Disputed or unconfirmed: BTCPay has not said whether this incident is linked to August’s or to the vulnerabilities fixed in 2.4.7.

Watch next: A formal security advisory and details of the attack vector.