Crypto Today: November 3, 2026

Each fact links to the outlet that reported it: check the original before relying on it. Not investment advice.

Binance’s account of how attackers drained about $6.34 billion from its hot wallets dominated the day, and the fallout spread to its finances, South Korean regulators and the wider hunt for stolen funds. Separately, US regulators opened the door to perpetual futures on individual stocks, and a rival group promptly sued to stop it.

Markets snapshot

• BTC: $77,751.00 (+1.4% over 24 hours)
• ETH: $2,287.81 (+1.8% over 24 hours)
• SOL: $93.31 (+1.7% over 24 hours)

Prices as of Tuesday, November 3, 2026.

Security & Hacks

Binance says the $6.34B hack began with a tainted install and a fake job interview, and ended with an EIP-7702 trick

Binance’s first report says attackers spent roughly four months compromising wallet engineers, then used an internal AI tool and stolen credentials to reach its hot-wallet signing service. They drained about $6.34 billion on Oct. 29, and Binance says it has rebuilt the affected systems.

• In June, a Binance wallet DevOps engineer downloaded a tampered Homebrew installation while looking for an AI coding tool. Binance caught the compromise and reset his credentials and hardware, but says he and colleagues had already been exposed to the attacker. (Unchained)
• In September, a second engineer was approached on a job platform by someone posing as a project director. After a video interview, he was told to download an ‘assignment’ to his work computer. It was malware that Binance’s endpoint tools missed. (Unchained, CoinDesk)
• On Oct. 20, the attacker used that engineer’s machine and an internal AI tool to take over the first engineer and a third, and found a container deployment token. (Unchained, The Defiant)
• On Oct. 29, the attacker used stolen credentials to log into the third engineer’s computer, deploy a container and run a malicious script. (Unchained)
• Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to the attacker. Solana and Optimism hot wallets lost about 970,500 SOL and 44.2 million OP, and another wallet sent 18,270 BTC. (Unchained)
• The attacker then used the internal signing service and 50 signing transactions to exploit EIP-7702, granting a contract it controlled partial rights over a hot wallet. Because the wallet used multi-party computation, no single key could revoke the delegation, so Binance built a special procedure that took extra time. (Unchained, CoinDesk, The Defiant)
• The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC, and Binance cleared the delegation at 00:10 UTC on Oct. 30. The exchange says it has rebuilt the wallet system and AI tool, replaced devices and decommissioned the engineers’ credentials, and plans an independent review and a security research fund. (Unchained, Cointelegraph)

Context: Binance is the world’s largest crypto exchange. A hot wallet is an internet-connected wallet used for day-to-day withdrawals. EIP-7702 is an Ethereum feature that lets a wallet delegate some transaction powers to a contract. Multi-party computation splits signing authority across parties so no single key exists. Per another outlet, the FBI has attributed the theft to North Korea’s TraderTraitor group, and CoinDesk describes the attackers as North Korea-linked.

Why it matters: The attack went through people and internal tooling rather than a flaw in blockchain code, and the delegation could not be quickly revoked because of how the wallet’s keys were designed. Binance says some technical details will stay confidential, so outsiders cannot yet fully verify the account until the independent review.

Disputed or unconfirmed: The account comes from Binance itself, an interested party. Binance’s own replenishment figures also differ: it said 98% of impacted token assets were replenished as of Oct. 31, while its recovery updates gave 90% for Oct. 31 and about 95% on Nov. 2.

Watch next: The independent third-party review Binance has promised, though no date has been given.

Suspected EU theft estimate rises to $133M as Kraken restricts accounts and ZachXBT alleges a cover-up

Onchain investigator ZachXBT now puts a suspected theft from an EU entity above $133 million, and says the victim’s silence let more than $30 million be laundered. Kraken has restricted accounts but says its own systems were not compromised.

• ZachXBT’s first alert put the suspected theft above $106 million. He said funds left multiple exchange accounts on Nov. 1 as USDC and USDT, and that he was highly confident North Korea’s Lazarus Group was not responsible. (Unchained)
• A follow-up traced another $27 million or more in exchange withdrawals by the same actor, some after his first disclosure, lifting the total above $133 million. (Unchained, Cointelegraph)
• He said the thief swapped USDC for ETH, used instant exchanges including Kyrrex and WellWallet, and moved part into Monero via Wagyu. (Unchained)
• ZachXBT’s working theory is that a large Western European financial institution was exploited and it is being covered up. As of publication, no institution, exchange or regulator had confirmed or denied a loss. (Unchained)
• Kraken restricted accounts, saying its own systems and customer accounts were not compromised and that it is working with law enforcement on recovery. (The Defiant)

Context: Tether and Circle can freeze USDT and USDC at flagged addresses, but that only works if someone raises the alarm while funds remain reachable. Monero hides senders, receivers and amounts by default, which makes tracing harder.

Why it matters: If the victim has not disclosed, freezing tools may be unused while funds move toward untraceable assets.

Disputed or unconfirmed: The theft total, the victim’s identity and the cover-up claim all rest on ZachXBT, whose post offered no evidence for the cover-up. Kraken’s statement that its systems were not compromised is its own.

Watch next: Whether any institution, exchange or regulator confirms a loss.

Companies & Industry

Binance’s recovery drains its reserves while withdrawals reopen in phases

Binance has spent about half of its SAFU bitcoin, roughly $580 million worth, and reportedly has no cyber insurance, so it is covering the loss with company funds and other reserves. Withdrawals reopened in phases and CEO Richard Teng says deposits are starting to outpace outflows.

• Binance reopened withdrawals on Sunday, Nov. 1, and said additional assets would become available from 04:00 UTC on Tuesday as security checks were completed. (Cointelegraph)
• Nearly $11 billion left the exchange over 46 hours, for net outflows of $5.3 billion. Teng said hourly deposits were beginning to exceed withdrawals. (CoinDesk)
• Data shows Binance has spent about half of its SAFU bitcoin, roughly $580 million worth. That leaves the fund below the $800 million level at which Binance’s own rules call for a top-up, and the exchange has not said when it will refill it. (CoinDesk)
• Bloomberg Law reported that Binance has no cyber insurance for the hack. Binance says it reserved more than $6.34 billion in company funds and is drawing on emergency and futures reserves to replace stolen assets. (The Defiant)

Context: SAFU (Secure Asset Fund for Users) is an emergency fund Binance created to reimburse users after security incidents. A phased reopening means assets are enabled for withdrawal gradually as security checks finish, rather than all at once.

Why it matters: How fast confidence returns depends on whether net flows stay positive while reserves are drawn down. A depleted SAFU fund and no insurance leave less buffer if another incident occurs.

Disputed or unconfirmed: The claim that deposits are beginning to exceed withdrawals comes from Binance’s CEO. The no-insurance report is from Bloomberg Law, and the SAFU figure is from onchain data analysis, not from Binance.

Watch next: The Tuesday 04:00 UTC phase of withdrawals, and any announcement on when SAFU will be refilled.

Regulation & Policy

CFTC clears perpetual futures on individual stocks for US exchanges; a Citadel-backed group sues

CFTC Chair Michael Selig said perpetual futures on individual stocks can now trade on CFTC-registered US exchanges. A group backed by Citadel Securities and other firms sued the agency, arguing the products belong under SEC authority.

• In a statement on Tuesday, Selig said the contracts can begin trading for the first time on CFTC-registered exchanges, meaning futures exchanges also notice-registered with the SEC for security futures. The statement did not name an exchange, list the stocks, or give a start date. (Unchained, The Block)
• The CFTC treated the contracts as approved under Regulation 40.3, describing them as security futures products under joint CFTC-SEC oversight. Selig said this gives US traders an alternative to offshore, often unregulated venues. (Unchained, CoinDesk)
• The step widens a product the agency first allowed for bitcoin in May, when it approved Kalshi’s BTCPERP contract. CME Group sued over that approval in June, and the CFTC has asked a judge to dismiss it. (Unchained)
• A group backed by Citadel Securities and other firms then sued the CFTC, arguing stock perps belong in the SEC’s hands. (CoinDesk)

Context: Perpetual futures (‘perps’) are futures with no expiry date, using recurring payments between long and short holders to keep prices near the underlying asset. They are popular on offshore crypto venues. Coinbase has filed to list stock perps, and Kalshi and Bitnomial submitted similar proposals in September, though the statement did not say whether those are the contracts now approved. Selig tied the move to a March 11 CFTC-SEC memorandum of understanding.

Why it matters: It brings a crypto-native trading model to US stock exposure under regulated venues, but the lawsuits show that the jurisdiction question between the CFTC and the SEC is still contested.

Disputed or unconfirmed: The CFTC says it has authority; the plaintiffs argue the products belong with the SEC. Only the plaintiffs’ broad position is described in the coverage, not the full complaint.

Watch next: Which exchange lists the first stock perp and when, and the court’s handling of the new suit and the CFTC’s motion to dismiss CME’s case.

South Korea reacts to the Binance hack with cold-storage pressure, a bank stress survey and a call for a cyber chief

South Korea’s financial regulator asked exchanges to hold more customer crypto offline, the central bank surveyed banks on hack exposure, and President Lee Jae Myung said the country needs a cybersecurity czar.

• At an emergency meeting on Nov. 2, the Financial Services Commission (FSC) asked major exchanges to move more customer assets into cold wallets, monitor deposits and withdrawals constantly, add incident-response staff, report abnormal access quickly and build extra reserves. It named no exchange and set no new ratio. (Unchained, Cointelegraph)
• Exchanges must already keep at least 80% of the value of user crypto offline. Figures from Sept. 30 put Upbit at 99.17%, Bithumb at 94.76%, Coinone at 85%, Digital X at 82.79% and Streami (Gopax) at 80.54%. (Unchained)
• The Bank of Korea, in its first such survey, asked 31 financial firms how a major crypto hack, a price crash or losses at another firm would affect them. (CoinDesk, Unchained)
• President Lee Jae Myung said he wants a government-wide agency to handle cyberattacks as AI raises security concerns across financial institutions and critical infrastructure. (CoinDesk)
• Industry participants asked the FSC to ease limits on halting withdrawals when another exchange is hacked, and the FSC plans to review that. (Unchained)

Context: Cold wallets are offline storage that is harder to attack than hot wallets. The FSC is South Korea’s main financial regulator, and DAXA is the exchange industry group.

Why it matters: South Korea is one of the biggest retail crypto markets, and the response suggests tighter offline-storage and incident rules may follow, which would shrink the online balances exchanges can use.

Disputed or unconfirmed: The 99% figure is attributed by News1 to industry sources, with no FSC official quoted. The online-share calculations are Unchained’s own.

Watch next: Whether the FSC sets a higher offline ratio such as 99%, which News1 reported the industry has discussed. The FSC has not mentioned it.

Quick hits

• The Liquid Network says its bitcoin-backed tokens are fully backed again after the $320 million exploit, thanks to a final 250 BTC transfer, though the federation has not said who paid, and the headline attribution to Blockstream is not in the coverage cited here. (CoinDesk)
• Mercado Bitcoin says it will cover all user losses from a hack of nearly $40 million, with partners including Tether, Circle and Chainalysis helping freeze $11 million of stolen assets. (CoinDesk)
• Arbitrum’s 12-person security council briefly rewrote a core contract to move $30 million of Binance hack funds from an address it held no key for, then restored the code; it is the second such use this year. (CoinDesk)
• Amazon, Tesla and SpaceX have joined objections to the OKX–ICE tokenized stock venture, bringing opt-outs to 56 companies, nearly 80% of its initial stock selection. (CoinDesk)
• Justin Sun is seeking sanctions against Trump-linked World Liberty Financial, saying it did not disclose UAE ties until months into his lawsuit over $45 million in WLFI tokens. (CoinDesk)
• Tether CEO Paolo Ardoino said at the Plan ₿ Forum that the company holds about 150,000 BTC, roughly 50,000 more than the 100,060 implied by its Q3 reserve report. (Decrypt)