Cryptoccino — Saturday 31 October 2026
☕ 9 min read
Today's Roast
Single shot · top move 2.2% (BNB)
The Pour. The largest exchange in crypto got emptied, and everyone is debating whether the floor held or just looks like it did.
Today. Binance’s $6.3B breach: North Korea, EIP-7702, and whether $6.34B covers it Security Desk · BTC below $77k, $1.57B liquidated, then Wall Street says buy the dip Markets · CFTC, Lummis, and Trump all reach for the Binance hack as regulatory leverage On the Hill.
Prices
- BTC$77,181−1.7%
- ETH$2,239−0.2%
- BNB$703−2.2%
- SOL$96.02−1.9%
- XRP$1.24−1.1%
- DOGE$0.0752−1.5%
SECURITY DESK
North Korea’s TraderTraitor drains $6.3B from Binance in the largest crypto hack on record.
theblock coindesk decrypt bloomberg_crypto chainalysis decrypt coindesk
What happened. Starting around 4:20 p.m. ET on 29 October, funds began leaving Binance hot wallets across multiple chains. TRM Labs and Chainalysis both attribute the attack to TraderTraitor, the North Korea-linked group responsible for the Bybit hack earlier this year. CEO Richard Teng confirmed the breach involved EIP-7702 delegation, a self-destruct mechanism, and multiple compromise points, not a single intrusion vector.
Why it matters. At $6.3 billion this eclipses every prior crypto theft and accounts for the bulk of North Korea-linked hack losses, which Chainalysis now puts at nearly 89% of all stolen crypto in 2026. Binance has ringfenced $6.34 billion of its own funds to cover user losses and says withdrawals will restart Sunday, but roughly $3 billion has been frozen by partners including Circle, which locked $823 million in USDC. The Fear and Greed Index sat at 30 heading into the session, and that caution proved warranted: the hack landed on an already-fragile tape.
The catch. Experts are split on whether the frozen assets can actually be recovered, and roughly 120 million TRX has already moved to an unknown wallet beyond freezing reach. The wider breach scope Teng disclosed suggests Binance’s internal forensics are still incomplete, which makes the Sunday withdrawal target feel optimistic. The FBI and Secret Service have joined the investigation, but state-sponsored attackers with established laundering infrastructure are a different problem from ordinary theft recovery.

BTC briefly below $77k, $1.57B in leveraged positions wiped. The Binance breach hit an already-stressed market: Bitcoin dropped roughly 3% and Ethereum followed, triggering $1.57 billion in liquidations across the book. For context, the last time Binance was breached in 2018, BTC fell nearly 11%; the shallower move this time reflects both deeper liquidity and faster institutional response. Wall Street desks at Cantor Fitzgerald, TD Cowen, and Compass Point called it exchange-specific and pointed clients toward Coinbase, Robinhood, and Strategy as cleaner proxies.
coindeskdecryptdecrypt
Nasdaq posts its steepest single-day fall since June as AI spending scepticism bites. Intel’s worst daily drop in 50 years, a warning from Reddit that Google’s AI search is gutting referral traffic, and Amazon swinging to a $42.4 billion free cash outflow on AI capex all landed in the same session. The macro backdrop amplified crypto’s own stress rather than providing any offset. Tech and crypto were selling off in tandem, which removed the usual safe-haven rotation argument.
cryptobriefingdecryptdecrypt
Strategy CFO departs as the firm posts a record quarterly operating profit. Andrew Kang resigned the same day Strategy reported its best-ever quarterly numbers, sending MSTR down about 6%. Analysts at StoneX and TD Cowen kept buy ratings, pointing to the $4.83 billion cash reserve and a more stable preferred-stock structure that sets up continued BTC accumulation. The CFO exit is the headline risk; the underlying thesis is unchanged for now.
coindesktheblock
Coinbase Q3 net income up 66% as prediction markets and derivatives offset softer spot. Bernstein analysts credited Coinbase’s expanding perps and prediction market businesses for carrying the quarter while spot trading volumes stayed subdued. The result landed the same day Binance was making global headlines for all the wrong reasons, a contrast Wall Street was quick to note. Coinbase shares feature prominently in the ‘buy on weakness’ lists circulating after the hack.
theblock

Hacker dumps an obscure 2017-era token, which crashes 90% within hours. Among the assets drained from Binance hot wallets was a low-liquidity token dating to 2017; the attacker liquidated it into the open market, collapsing its price by 90% before most holders could react. The incident is a reminder that exchange hot wallets often carry long-tail assets that become weapons when force-sold. Binance has not named the token publicly.
coindesk
India’s CoinDCX halts new crypto futures positions as Binance incident disrupts liquidity. CoinDCX, India’s largest crypto exchange, suspended new futures bets citing a liquidity crunch flowing from the Binance breach, since the exchange relies on Binance infrastructure for parts of its derivatives offering. Existing positions were not closed, but the restriction illustrates how deeply Binance’s plumbing runs through regional exchanges. No timeline for resumption was given.
coindesk
XRP Ledger tightens access controls for restricted token holders. XRPL developers have pushed through rule changes that narrow which accounts can hold tokens flagged as restricted, giving issuers more granular compliance controls over their assets on-chain. The update is aimed at regulated issuers who need to enforce transfer restrictions without relying solely on off-chain mechanisms. No material market impact so far.
coindesk
OpenAI trims its fundraising target by $10 billion as investor appetite for AI cools. The revised round reflects both macro pressure on tech valuations and specific concern about the pace of AI return on investment after a week of heavy capex disclosures from Amazon, Intel, and others. For crypto operators, the cooling signals that the AI-funding tailwind that boosted AI-adjacent tokens and infrastructure plays through mid-year may be losing force. Valuation targets were also cut alongside the headline figure.
coindeskcryptobriefing

Binance hack mechanics: EIP-7702 delegation and multi-chain hot wallet drain. The attacker used EIP-7702, which allows an EOA to temporarily delegate execution to a smart contract, to bypass Binance’s normal approval controls across Ethereum and several other chains. A self-destruct mechanism was used to obscure the contract after funds moved. Binance’s own post-mortem confirms multiple breach points were involved, not a single signing key compromise.
coindeskdecryptdecrypt
Trezor flags credible hardware implant report in Safe 5 units sold by CryptoBilis. Trezor has not yet physically examined the device but is treating the report as credible and has told anyone who bought a Safe 5 through the CryptoBilis reseller to migrate funds immediately. Supply-chain implants are among the hardest hardware wallet attack vectors to detect after the fact. No dollar figure is attached yet.
theblockdecrypt
Chainalysis itself discloses a cybersecurity incident on the same day it publishes its Binance attribution. The blockchain analytics firm said the incident mirrors recent breaches at other tech platforms but gave no further detail on scope or method. The timing, publishing the definitive TraderTraitor attribution report while simultaneously managing its own breach, is notable. No indication yet that the incidents are linked.
chainalysis
Alleged Nomad Bridge exploiter extradited from Israel to the US. Israel’s Supreme Court held that exploiting a smart contract flaw qualifies as computer intrusion even when the protocol technically permitted the transaction, clearing the path for extradition. The case involves roughly $2.8 million in losses and sets a precedent that ‘the code allowed it’ is not a complete legal defence. US prosecutors now have custody.
decrypt

CFTC chair calls for mandatory US registration of offshore exchanges after Binance breach. Michael Selig argued that had Binance been required to register with the CFTC and meet US-grade cybersecurity standards, the attack surface may have looked different. The argument is expedient but not straightforward: Binance’s compliance posture is already a long-running issue, and registration alone does not guarantee security controls. Expect this framing to appear in upcoming committee hearings.
decrypt
Senator Lummis argues the CLARITY Act would classify Binance as a ‘covered person’ subject to US rules. Lummis used the hack to push the CLARITY Act, saying exchanges of Binance’s scale and US user base should fall under the statute’s definition regardless of where they are domiciled. The bill’s passage odds remain uncertain, but the Binance incident has handed proponents a concrete data point. Trump separately said the White House is ‘looking into’ the hack as calls for new legislation grow louder.
cryptobriefingcryptobriefingtheblock
Texas brothers sentenced to 15 years for $8M crypto kidnapping in Minnesota. Raymond and Isiah Garcia held a family at gunpoint for more than nine hours, forcing the victim to transfer over $8 million in cryptocurrency, in one of the most significant ‘wrench attack’ sentencing outcomes to date. The 15-year terms signal that US courts are treating physical crypto extortion with the same severity as comparable financial crimes. Prosecutors framed it as a deterrent in a threat category that has grown sharply.
theblockdecrypt
What else is grinding?
- CZ and Elon Musk traded public jabs after Musk appeared to mock the Binance breach, with CZ pointing out that Binance’s $500M Twitter investment is now worth over $1B in SpaceX shares.
decrypt - Around 120 million TRX drained in the Binance hack has moved to an unidentified wallet, placing it beyond the reach of the freezes applied to other stolen assets.
cryptobriefing - Recall Foundation is planning to burn 358.6 million RECALL tokens as the project winds down, one of the cleaner shutdowns in the AI-token cohort this cycle.
cryptobriefing - Choice has launched sLINJ, a leveraged INJ staking token targeting roughly 12% APY, adding another structured yield product to an already crowded liquid staking derivatives space.
cryptobriefing - The SEC issued exemptive relief from Treasury central clearing requirements for certain inter-affiliate and non-US repo transactions, giving broker-dealers more runway on the compliance path.
sec_press
Last sip. Binance says withdrawals restart Sunday, but the forensics are still incomplete and the people who took the money have done this before.