This Week in Crypto: Oct 31 – Nov 3, 2026

Written with AI from public reporting. Each fact links to the outlet that reported it: check the original before relying on it. Not investment advice.

This week was defined by the largest crypto theft on record. On Oct. 29, attackers took roughly $6.3–6.4 billion from Binance’s hot wallets, which are the internet-connected wallets an exchange uses for day-to-day withdrawals. The FBI and analytics firms blamed North Korea. Most of the other major stories follow from that event: a race to freeze and trace the laundered funds, Binance’s phased reopening and the outflows that came with it, ETF selling, and pressure from regulators in Asia. A run of separate breaches added to the security theme: Brazil’s Mercado Bitcoin, a suspected $133M theft from an unnamed EU entity, Chainalysis, GitBook and BTCPay Server. A critical Linux flaw found by an AI model put validator operators on alert. Outside security, the CFTC opened the door to crypto-style perpetual futures on individual US stocks.

Markets snapshot

• BTC: $77,801.00 (-3.7% over 7 days)
• ETH: $2,289.74 (-2.5% over 7 days)
• SOL: $93.39 (-7.7% over 7 days)

Prices as of Tuesday, November 3, 2026.

Security & Hacks

Binance loses about $6.3 billion in the largest crypto hack on record, traced to a months-long intrusion

Attackers spent four months compromising Binance wallet engineers, starting with a tampered software install and a fake job interview. On Oct. 29 they used Binance’s own signing systems to drain hot wallets across about 10 blockchains, taking more than four times the previous record.

• In June, according to Binance, a wallet DevOps engineer installed a tampered copy of Homebrew, a common software installer, while looking for an AI coding tool. Binance caught it, replaced his machine and reset his credentials, but by then the attacker had already reached him and his teammates. (Unchained)
• In September, a second engineer was approached through a job-hunting platform. After a fake video interview and a follow-up chat, he was asked to download an ‘assignment’ onto his work computer. It contained zero-day malware (malware exploiting a previously unknown flaw) that Binance’s endpoint tools did not detect. (Unchained, CoinDesk)
• On Oct. 20, the attacker used that computer and an internal AI tool to take over two more engineers’ machines and found a container deployment token. On Oct. 29, the attacker used stolen credentials to deploy a container and run a malicious script. (Unchained)
• Outflows began around 20:05 UTC (4:05 p.m. ET) on Oct. 29, and most of the funds left within about 20 minutes. Binance says the losses included 233.46 million XRP, about 970,500 SOL, 44.2 million OP and 18,270 BTC. Chainalysis dates the start to about 4:20 p.m. ET. (Unchained, Decrypt, Unchained)
• On Ethereum, the attacker used 50 signing transactions to exploit EIP-7702, a 2025 Ethereum feature that lets a wallet delegate powers to a smart contract. This turned a hot wallet into a ‘sweeper’ contract. Binance’s CEO Richard Teng said the delegation bypassed normal approval controls. (Unchained, Decrypt)
• The wallet used multi-party computation, a setup where no single private key exists. As a result, Binance needed a special procedure to revoke the delegation. The last unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC, and the delegation was cleared at 00:10 UTC on Oct. 30. (Unchained)
• On Nov. 3, Binance published an initial report. It says it rebuilt the affected wallet system and internal AI tool and replaced devices and credentials. It also plans an independent third-party review and a security research fund. (Unchained, The Defiant)

Context: Binance is the world’s largest crypto exchange. The previous record theft was the $1.5 billion hack of the exchange Bybit in February 2025, which was also blamed on North Korea’s TraderTraitor group. TRM Labs said the attack exploited Binance’s signing infrastructure, not a flaw in Ethereum or any other blockchain. Binance said it found no evidence that wallet private keys leaked, and that the attacker used a self-destruct mechanism to erase its tools as it went.

Why it matters: The breach shows that social engineering of individual staff, combined with internal AI tooling, can defeat the largest exchange’s controls. It is already shaping how exchanges and regulators think about hot-wallet exposure.

Disputed or unconfirmed: Totals vary: Binance says $6.34 billion, Chainalysis and TRM Labs say about $6.4 billion, and Decrypt cites $6.43 billion. The narrative of the intrusion comes from Binance’s own report, and Binance says some details will stay confidential.

Watch next: Binance’s planned independent third-party review and any further technical disclosures.

FBI formally attributes Binance theft to North Korea’s TraderTraitor and publishes a list of addresses to block

Two days after the theft, the FBI named North Korea’s TraderTraitor group. It asked bridges, DeFi platforms, node operators and swap services to refuse transactions tied to more than 600 listed addresses.

• On Oct. 29, TRM Labs linked the attack to TraderTraitor. On Oct. 30, Chainalysis said Binance funds were mixing onchain with proceeds from September’s Bitget theft, which had also been tied to North Korea. (Unchained, Decrypt)
• In an alert dated Oct. 31, the FBI, the Secret Service and IRS Criminal Investigation attributed the theft to TraderTraitor. They said the stolen assets had mostly been converted into ether. (Unchained, The Defiant, Cointelegraph)
• The alert lists 608 Ethereum, 19 Bitcoin and one Solana address. It asks THORChain, RPC node operators, instant exchanges, DeFi platforms and analytics firms to block transactions involving those addresses or funds derived from them. (Unchained, CoinDesk)
• On Nov. 1, the Secret Service said its investigators had worked with industry partners within minutes of the attack to freeze a significant portion of the stolen funds. (Unchained)
• Chainalysis noted that the attackers had already used thousands of addresses, far more than the FBI listed, and expected that number to keep growing. (CoinDesk)

Context: TraderTraitor is a North Korean state-linked hacking unit, also referred to in reporting as part of the Lazarus Group. The FBI used the same playbook after the Bybit hack, naming the group five days after that theft in February 2025. RPC node operators run the servers that wallets and apps use to send transactions to a blockchain.

Why it matters: An official government list gives exchanges and infrastructure providers a firmer basis to block funds than private analytics findings alone. It also raises pressure on permissionless services such as THORChain.

Watch next: Whether THORChain and other bridges act on the FBI list, and any updated address lists.

Binance loot laundered through Tron, bridges and onto Solana at high speed, but nearly $2.85 billion is frozen or seized

The launderers have spread funds across about 12,000 wallets and 11 chains using automated tools. However, a far larger share has been frozen than in past North Korean hacks.

• Freezes began by 5:14 p.m. ET on Oct. 29, according to Chainalysis. Stablecoin issuers Tether and Circle froze more than $2.3 billion in stolen stablecoins. (Unchained, Decrypt)
• On Oct. 31, Chainalysis said the attackers were using a Tron protocol to avoid stablecoin freezes. It also flagged signs of automated laundering, such as many addresses each receiving exactly 1 TRX before passing funds on. (The Block, Unchained)
• On Nov. 1, Chainalysis said more than $500 million had passed through over 1,000 Tron addresses and over 3,000 deposits, and that funds had begun moving to Solana. The Block, citing an analyst, put the amount laundered via Tron at $242 million. (The Defiant, Unchained, The Block)
• According to The Block’s analyst source, the bridges Relay, THORChain, Chainflip and Symbiosis moved about $140 million off Tron. Relay handled the most, at $48 million. (The Block)
• On Nov. 2, Elliptic reported the first use of a Bitcoin mixer with the proceeds. It traced about 12,000 wallets across 11 blockchains and put the remaining linked balances at $3.24 billion. (The Defiant)
• Decrypt reported that new laundering wallets were appearing at a rate of about one every 25 seconds. It put the amount frozen or seized at $2.85 billion of $6.43 billion stolen, compared with about 3% in the Bybit case. (Decrypt)

Context: Stablecoins such as Tether’s USDT and Circle’s USDC are issued by companies that can freeze tokens at specific addresses, unlike bitcoin or ether. After the Bybit hack, TraderTraitor converted about 84% of the stolen ether into bitcoin via THORChain, a cross-chain swap network. A mixer pools funds from many users to obscure where they came from.

Why it matters: The fast freezes show that centralized choke points can recover a meaningful share of stolen funds. Even so, several billion dollars remain in motion, and the shift to mixers and multiple chains makes the rest harder to stop.

Disputed or unconfirmed: Estimates of the Tron laundering volume differ: Chainalysis says over $500 million, while The Block’s analyst says $242 million. The frozen total is put at about $2.8 billion by Chainalysis and $2.85 billion by Decrypt.

Watch next: Whether more frozen funds are seized or returned, and how much moves through THORChain and Bitcoin mixers.

Brazil’s largest exchange, Mercado Bitcoin, is hacked for about $40–49 million and suspends withdrawals

Days after the Binance theft, Mercado Bitcoin’s wallets were drained across many chains. The exchange has frozen deposits and withdrawals and says customers will not lose money.

• On Nov. 2, Mercado Bitcoin paused deposits and withdrawals after wallets on at least 10 chains were emptied. It said it had contained the incident, that no customers were harmed and that no data was leaked. (CoinDesk, Protos)
• Analyst Emmett Gallic estimated the losses at over $46 million and rising. He said the hacker was sweeping old deposit addresses and selling memecoins and altcoins. (Protos)
• The exchange said partners including Tether, Circle and Chainalysis helped block $11 million of the stolen assets. It pledged to cover all user losses. (CoinDesk, The Defiant)
• On Nov. 3, Chainalysis put the theft at $49 million across 17 chains. Services remained suspended. (The Defiant)

Context: Mercado Bitcoin is Brazil’s largest crypto exchange. The company published the attacker’s wallet addresses so that others could help trace the funds. It has not said how the attackers got in or who they are.

Why it matters: This is a second large exchange hot-wallet breach in one week, which strengthens the case regulators are making for keeping more assets offline.

Disputed or unconfirmed: The loss estimate ranges from about $40 million (CoinDesk) to $46 million (Gallic) to $49 million (Chainalysis). The number of chains affected is reported as at least 10 or as 17. The statement that customers will not lose money comes from the exchange itself.

Watch next: When Mercado Bitcoin restores withdrawals and whether it discloses how the breach happened.

Investigator ZachXBT flags a suspected $106–133 million theft from an unnamed EU entity

Onchain sleuth ZachXBT says an unidentified actor drained exchange accounts belonging to an EU entity on Nov. 1 and is laundering the funds into Monero. He suspects a Western European financial institution is covering up the loss. No victim has confirmed it.

• In a Nov. 2 alert, ZachXBT said more than $106 million in USDC and USDT was withdrawn on Nov. 1 from an EU entity’s accounts at several centralized exchanges. He said he was highly confident that North Korea’s Lazarus Group was not responsible. (Unchained, CoinDesk)
• He said the actor swapped USDC for ETH, sent funds through the instant exchanges WellWallet and Kyrrex, converted part of it to Monero via the Wagyu service, and bridged funds across chains. (Unchained)
• On Nov. 3, he raised the estimate to more than $133 million after finding another $27 million-plus in exchange withdrawals. He said some of these happened after his first alert. (Unchained, Cointelegraph)
• He said his working theory is that a large Western European financial institution was exploited and is hiding it. He also said the lack of disclosure had allowed more than $30 million to be laundered that EU law enforcement could have frozen. (Unchained)

Context: ZachXBT is an independent onchain investigator whose alerts are widely followed. Monero is a privacy coin that hides senders, receivers and amounts by default, which makes funds very hard to trace once converted. The articles do not mention a Kraken action, and no exchange has been named.

Why it matters: If confirmed, this would be a large theft from a traditional financial institution, and its silence may have cost recoverable funds. Freezes by stablecoin issuers and exchanges only work if victims raise the alarm quickly.

Disputed or unconfirmed: All figures and the cover-up theory come from ZachXBT alone. He has not published evidence for the cover-up claim, and no victim, exchange or regulator has confirmed or denied a loss.

Watch next: Whether any institution, exchange or EU regulator confirms the loss.

Companies & Industry

Binance reopens withdrawals after about 45 hours, covers most losses from its own funds and sees billions leave

Binance says it is covering the full loss from company funds and its emergency reserve, and that customer balances were never affected. When withdrawals reopened, net outflows ran into the billions, though they were a small share of its total assets.

• Teng said Binance would cover all losses using company funds and SAFU, its Secure Asset Fund for Users emergency reserve. The exchange set aside more than $6.34 billion, about $5 billion of it already held in the stolen tokens, and is buying the rest on the market and over the counter. (Decrypt)
• On Oct. 31, Binance said 90% of the stolen assets had been replenished and launched a reserves page showing full backing for major tokens. It targeted Nov. 1 for reopening withdrawals and said a complete cryptographic proof of reserves would come by Nov. 3. (The Defiant, The Defiant)
• On Nov. 1, Binance began reopening withdrawals, starting with bitcoin. It said about 95% of the impacted amount had been replenished, with less-liquid tokens making up the remaining 5%. (The Defiant)
• Binance reported $3.64 billion in net outflows, which it said equalled 2.1% of its $171 billion in assets. It added that withdrawals slowed after an initial spike. (The Block)
• By Nov. 2, CoinDesk was reporting about $6 billion in outflows, under 4% of total holdings, with rival exchanges attracting deposits. (CoinDesk)

Context: Withdrawals were frozen for about 45 hours while Binance rebuilt and retested its systems. Deposits kept working throughout. A proof of reserves is a cryptographic attestation that an exchange holds enough assets to cover customer balances.

Why it matters: Binance’s ability to absorb a $6 billion loss without touching customer balances has so far prevented a broader run. The outflows still show how much the incident shook confidence.

Disputed or unconfirmed: Binance’s own figures on replenishment conflict. Its Nov. 3 report says 98% had been replenished as of Oct. 31, while its earlier updates said 90% on Oct. 31 and about 95% on Nov. 1–2. Outflow figures also range from $3.64 billion (The Block, citing Binance) to about $6 billion (CoinDesk).

Watch next: Publication of Binance’s complete proof of reserves, which it targeted for Nov. 3, and whether outflows level off.

AI & Crypto

Chainalysis and GitBook disclose breaches involving AI-driven attackers

Chainalysis, the blockchain analytics firm, says an attacker using ‘offensive agentic techniques’ reached customer names and emails. GitBook, which hosts documentation for many crypto projects, says an AI-assisted breach exposed infrastructure credentials.

• Blockchain data firm Allium disclosed a security incident on Oct. 28, after detecting it on Oct. 25. (Unchained)
• On Oct. 30, Chainalysis said an external actor using agentic AI techniques had accessed its systems and internal tools in October. The data reached included user IDs, full names, email addresses and organization role labels. (Unchained, CryptoSlate, The Block)
• Chainalysis said that, so far, it had seen no sign the intruder reached investigation files, query results, passwords, multi-factor authentication secrets or session tokens. It said the incident was unrelated to the Binance theft. (Unchained, CryptoSlate)
• Chainalysis has not said how many users were affected, when the intrusion began or how the attacker got in. It promised per-organization breakdowns and is using large language models in its security review. (Unchained, CryptoSlate)
• On Nov. 3, GitBook said attackers had accessed infrastructure credentials in an AI-assisted breach. It shut down affected systems, reset tokens and told users to rotate their keys. (Decrypt)

Context: Chainalysis’s tools are used by law enforcement and companies to trace stolen crypto. Its own breach therefore exposes the people doing that work. ‘Agentic’ refers to AI systems that carry out multi-step tasks on their own.

Why it matters: Exposed names and roles of investigators and compliance staff can fuel targeted phishing. These incidents, alongside the AI-found Linux flaw, point to AI being used on both sides of security.

Disputed or unconfirmed: The scope of the Chainalysis breach rests on the company’s own provisional findings. It has not explained how AI was used in the attack.

Watch next: Chainalysis’s per-organization breakdown of exposed records.

Regulation & Policy

CFTC allows perpetual futures on individual US stocks for the first time

The US derivatives regulator says perpetual futures, a crypto-native product, can now trade on individual stocks on registered US exchanges. It did not name any exchange, stock or start date.

• On Nov. 3, CFTC Chairman Michael Selig said the contracts can begin trading on exchanges registered with both the CFTC and the SEC. He said the products are deemed approved under the agency’s Regulation 40.3. (Unchained, The Block, CoinDesk)
• Selig classified them as security futures, which fall under joint CFTC and SEC oversight. He framed the move as giving US traders a regulated alternative to offshore venues. (Unchained, CoinDesk)
• The statement did not say whether pending filings were among the approved contracts. Coinbase has applied to list them, and Kalshi and Bitnomial filed similar proposals in September. (Unchained)
• The CFTC first allowed a bitcoin perpetual in May, approving Kalshi’s contract. CME Group sued the CFTC in June over that approval, and the agency has asked the court to dismiss the case. (Unchained)

Context: Perpetual futures, or ‘perps’, are futures contracts that never expire. Periodic payments between buyers and sellers keep their price close to the underlying asset. They are widely traded on offshore crypto exchanges. Selig tied the move to a March 2026 cooperation agreement between the CFTC and SEC.

Why it matters: This extends crypto-style leveraged trading to mainstream stocks on US-regulated venues. It could shift volume onshore, and it is likely to draw legal challenges from incumbent exchanges.

Disputed or unconfirmed: The articles provided do not cover any lawsuit against the stock-perpetual approval itself. The only challenge they report is CME’s case over the earlier bitcoin perpetual.

Watch next: Which exchange lists the first stock perpetuals, and when. Also the court’s ruling on the CFTC’s motion to dismiss CME’s lawsuit.

Institutions & ETFs

Bitcoin and ether ETFs see heavy outflows after the hack; BTC dips toward $76,000

US spot bitcoin ETFs had their largest daily outflow in about four months the day after the hack, and selling continued on Monday. Prices fell but stabilised; bitcoin was at about $77,800 on Nov. 3, down roughly 3.7% on the week.

• On Oct. 30, the day after the hack, bitcoin fell about 4% to roughly $76,400, and more than $1.3 billion in leveraged positions were liquidated. (Decrypt)
• The same day, US spot bitcoin ETFs lost $643 million, their largest single-day outflow since June 25. Ether ETFs lost $155.7 million, and Solana ETFs lost $10.8 million. (The Block, Decrypt)
• Bitcoin ETFs ended October with about $515–516 million in net outflows. Ether funds had record monthly outflows of about $1.61 billion. (Cointelegraph, Decrypt)
• On Monday, Nov. 2, spot bitcoin funds lost nearly $399 million net. BlackRock’s IBIT alone shed $405.3 million, its largest outflow since June. (Cointelegraph)
• As of Nov. 3, BTC was about $77,801 (down 3.7% over seven days), ETH about $2,290 (down 2.5%) and SOL about $93.39 (down 7.7%). Total crypto market value was about $2.63 trillion. (Decrypt)

Context: Spot ETFs hold the underlying coin and trade like stocks. Their daily flows are widely watched as a gauge of institutional sentiment. Decrypt noted that the drop was much smaller than the nearly 11% fall after a failed attack on Binance in 2018. The Federal Reserve held rates at 3.75–4% on Oct. 28, but two officials voted for a hike.

Why it matters: The hack’s main market effect has come through ETF and leveraged-position selling rather than a broad collapse. The macro backdrop, with rate-hike expectations, adds pressure.

Watch next: Daily ETF flow data, and whether expectations of a December Fed rate hike hold.

Solana & Other Chains

Critical Linux flaw found by an Anthropic AI model prompts urgent warning to Solana validators

CVE-2026-98432 lets an attacker with no credentials take over some Linux servers remotely. Anza, which develops Solana validator software, told validators to act because Ubuntu, the system it builds on, had no patch yet.

• On Oct. 27, Anthropic said one of its unreleased research models found the bug. It said Claude wrote an exploit that gains root access on servers with a multipath TCP listener: about 48 minutes to expose a kernel address, then five more to run commands. (Unchained, Protos, Decrypt)
• The issuing organization rated the flaw 9.8 out of 10. NIST had not yet published its own score. Some commentators called it the worst internet bug ever. (Unchained, Protos)
• AWS released fixed kernels for Amazon Linux and said it knew of no exploitation in the wild. Red Hat rated the flaw Critical and released a patch on Sunday, Nov. 1. (Unchained, Decrypt)
• On the evening of Nov. 1, Anza issued an ‘URGENT’ alert. It told Ubuntu operators to filter incoming traffic and disable two networking features until a fixed kernel was available. (Unchained, The Defiant)
• As of Nov. 2, Ubuntu’s tracker still listed standard kernels for 24.04 and 22.04 as vulnerable, with fixes in progress. (Unchained, Decrypt)

Context: Validators are the servers that process transactions and secure a proof-of-stake blockchain like Solana, and Solana validators need a public IPv4 address. The alert came less than two weeks after Solana activated Alpenglow, its new consensus engine.

Why it matters: Exposed validators could be taken over remotely until they are patched, which threatens network operations and the funds held on those servers. The episode also shows AI speeding up the discovery of serious bugs.

Disputed or unconfirmed: The ‘worst bug in history’ label comes from commentators. Some of them, such as Kyle Samani, are crypto investors rather than security researchers.

Watch next: Release of Ubuntu’s patched kernels and confirmation that validators have upgraded.

DeFi

Threshold pauses its tBTC bitcoin bridge; Aave freezes a $136 million tBTC market

Threshold halted minting and redemptions of tBTC, its tokenized bitcoin, for undisclosed security maintenance, while saying the token remains fully backed. Lending protocols moved to limit their exposure.

• On Oct. 31, Threshold suspended new bitcoin deposits, tBTC minting and redemptions. It did not disclose the security issue or give a reopening date. (CryptoSlate, The Defiant)
• Threshold said about 4,320 BTC sat in bridge wallets against 4,185 tBTC in circulation. It said no funds were lost and no unauthorized minting had occurred. (The Defiant, CryptoSlate)
• At 10:01 UTC on Oct. 31, on the recommendation of risk adviser LlamaRisk, Aave froze its Ethereum Core tBTC reserve. That market held about 1,760 tBTC ($136.6 million), roughly 42% of the token’s supply. Repayments, withdrawals and liquidations continued. (CryptoSlate, The Defiant)
• Gauntlet, another DeFi risk manager, pulled about 65,000 USDC from a tBTC-backed Morpho lending market, leaving about 640,000 USDC exposed. (The Defiant, CryptoSlate)
• Separately, Aave had frozen some reserves during the Binance incident, after a wallet linked to the exploiters supplied about $60 million of USDT and borrowed 19,762 WETH. Borrowing rates in those reserves reached up to 36% APR before they reopened by Oct. 31. (CryptoSlate)

Context: tBTC is a token on Ethereum backed by bitcoin held by Threshold’s bridge. While redemptions are paused, holders can only exit by selling to other users. Aave is the largest DeFi lending protocol.

Why it matters: Without redemptions, tBTC could trade below bitcoin’s price. That would make liquidations harder in lending markets that hold large amounts of the token.

Disputed or unconfirmed: The claims of full backing and no losses come from Threshold, which has not explained what prompted the pause.

Watch next: Threshold’s disclosure of the issue and a date for resuming the bridge.

Bitcoin

BTCPay Server hot wallets drained on outdated versions; merchants told to rebuild

Attackers swept about $1.6 million in bitcoin and litecoin from merchants running old versions of BTCPay Server, a self-hosted bitcoin payment tool. The project now advises affected users to replace both their servers and their wallets.

• On Nov. 1, BTCPay reported that hot wallets were being swept and asked all operators to shut down their servers. Founder Nicolas Dorier said attackers had logged in as admin on versions older than 2.4.2. (Unchained, CoinDesk)
• Later that day, BTCPay said it had found the attack vector, which affected version 2.4.1 and earlier. It said it had no credible reports of drains on the latest 2.4.7 release. (The Defiant, Unchained)
• Bitquery, a blockchain analytics firm, traced about $1.63 million (18.38 BTC and 3,405 LTC) across 682 wallet sweeps between Oct. 30 and Nov. 2. It found 87% of that moved in an eight-hour window on Nov. 1, and about $150,000 was taken after BTCPay’s warning. (CryptoSlate)
• BTCPay’s Nov. 2 advisory said the attacks used a new method against a vulnerability it patched on Aug. 7. It told past users of vulnerable versions to move to fresh servers, create new wallets and rotate all credentials. (CryptoSlate)

Context: Hot wallets on BTCPay keep their private keys on the server, so wallets whose keys are stored elsewhere, such as hardware wallets, were not affected. In August, versions before 2.4.2 had a different flaw that exposed Lightning node credentials. BTCPay has not said whether the two incidents are linked.

Why it matters: Self-hosted payment tools depend on operators applying updates. BTCPay itself said it wished it had done more to reach users of outdated installs after its August warning.

Disputed or unconfirmed: The $1.6 million figure is Bitquery’s estimate. BTCPay has not confirmed a total, and the number of sweeps does not equal the number of merchants affected.

Watch next: An official BTCPay loss total and a count of affected merchants.

Fact-check notes

Check these against the linked sources:

• Story ‘Bitcoin and ether ETFs see heavy outflows’: the Nov. 3 prices in the bottom line and in the last ‘what_happened’ bullet (BTC about $77,801 down 3.7%, ETH about $2,290, SOL about $93.39, market cap about $2.63 trillion) are cited to article 2447. That article was published Nov. 1 and gives Saturday figures instead (BTC about $77,520, down 3.3%; ETH about $2,251; SOL about $96; market cap about $2.7 trillion). None of the provided sources support the Nov. 3 numbers, so they cannot be checked or corrected from the sources.

Quick hits

• Nvidia, Costco and Nike joined companies objecting to a planned OKX–ICE tokenized stock venue; nearly 70% of initially selected firms have opted out, while 19, including Apple, Tesla and Amazon, had not objected as the 30-day window closed in. (CoinDesk)
• Security firm CertiK put 2026 crypto losses at a record $9.2 billion; it counted $3.03 billion frozen or returned in October, cutting that month’s net losses to $3.47 billion. (The Defiant)
• Justin Sun is seeking court sanctions against Trump-linked World Liberty Financial, alleging it hid its UAE citizenship to avoid federal court, and plans to refile his $45 million suit in California state court. (The Block)
• Crypto groups spent about $176 million ahead of the US midterm elections, which will decide control of Congress and shape the outlook for crypto legislation such as the CLARITY Act. (Cointelegraph)
• After the Binance hack, South Korea’s Financial Services Commission asked major exchanges at a Nov. 2 emergency meeting to hold more crypto offline (the current minimum is 80%); the Bank of Korea surveyed 31 firms on exposure to an outage at the country’s top exchange, and Bithumb disclosed a breach of employee-app data. (Unchained)
• Hong Kong’s central bank now lets banks in its Project Ensemble pilot settle tokenized deposits with each other 24/7 in tokenized central bank money. (Unchained)
• Tether CEO Paolo Ardoino said the company holds 150,000 bitcoin (about $11.5 billion), more than its USDT reserve report shows, without saying where the additional coins are held. (CoinDesk)
• New Jersey withdrew its $5 million penalty and staking restrictions against Coinbase without prejudice, and Coinbase says staking access will return to customers there soon. (The Defiant)