Daily News on Bitcoin • Read Our Latest Article 📖 https://nitter.cf/t.co/6qXRYNRbT9 • Live on X and YouTube every Wednesday @ 11 EST
NYC
Joined January 2015
- Tweets90.7K
- Following759
- Followers265K
- Likes42.6K
Pinned Tweet
NEW POD | “That next cycle will be even more money printing. It has to be. They've got no way out.”
Michael Howell (@crossbordercap) on:
🔸 Who's winning the US-China capital war
🔸 Why Europe has nowhere to hide
🔸 BTC's next liquidity cycle
Watch: youtu.be/eQsFOxzso84
DID YOU KNOW: America’s worst stock market crash and the world’s worst crypto exchange hack both happened on October 29th?
BINANCE ATTACKER STOLE $6.28 BILLION ACROSS 8 BLOCKCHAINS IN COORDINATED EXPLOIT
On-chain analysis shows the attacker spent a day preparing, tested EIP-7702 wallet delegation and deployed automated sweeping contracts before striking.
Over $6 billion was drained in just 55 minutes, including 18,270 BTC.
Roughly $2.8 billion has since been frozen, while $3.27 billion remains movable.
Expert breakdown below.
Binance hot wallets lost ~$6.28B across 8 chains today. $6.07B went in the first 55 minutes, and the attacker kept re-sweeping one Ethereum wallet for two more hours.
Since then Tether, Circle, Ripple, Paxos, World Liberty and Binance have frozen ~$2.80B. About $3.27B can still move, mostly BTC and ETH.
I traced it all on-chain, including how the attacker raced the freezes 🧵
BINANCE REPORTEDLY FOUGHT BACK AGAINST HACKERS IN REAL TIME, RECOVERING $823 MILLION IN USDC
According to an on-chain analysis, Binance’s wallet key remained functional even after attackers used a malicious EIP-7702 authorization to take control of the wallet.
Binance reportedly used its signing key to execute transactions through the compromised wallet, recovering $823 million in USDC.
The attackers had allegedly obtained 50 valid authorizations signed by the wallet key, with one successfully activating malicious code that drained 65 assets.
Even after Tether and Circle blacklisted the attacker’s address, the draining reportedly continued, including a $200 million USDT deposit swept just 100 seconds after arriving.
BINANCE REPORTEDLY STILL SENDING CUSTOMER DEPOSITS TO COMPROMISED HOT WALLET AS HACKERS CONTINUE DRAINING FUNDS
Binance reportedly still has automated deposit wallet sweeps enabled, transferring newly deposited funds into its compromised hot wallet.
The attacker is allegedly draining the wallet as new funds arrive, potentially putting additional customer deposits at risk.
Users are being warned to avoid depositing funds until the situation is resolved.
CRITICAL QUESTION EMERGES IN BINANCE HACK OVER HOW ATTACKERS GAINED CONTROL OF ITS WALLET
Attackers reportedly used EIP-7702 delegation to redirect Binance’s wallet to malicious code, allowing funds to be drained.
But how did they obtain authorization?
Two possibilities are being investigated:
1) a stolen private key or
2) a malicious authorization signature obtained through a compromised signing process.
Neither has been confirmed.
If the private key wasn’t stolen, the attack could expose a major vulnerability in how exchanges authorize transactions, rather than how they secure private keys.
POLYMARKET HALTS TRADING AFTER HACKERS DRAIN USER FUNDS WITHOUT PASSWORDS OR SEED PHRASES
Attackers allegedly exploited users’ active sessions to sell their positions and withdraw funds directly through Polymarket’s own system.
The attack reportedly originated from a compromised DebugBear website performance monitoring script, which was replaced with malicious code that users’ browsers trusted.
Trading resumed after roughly one hour. Polymarket says affected users will be reimbursed and the incident has been referred to UK law enforcement.
BINANCE-LINKED BITCOIN HOT WALLET REPORTEDLY DRAINED OF 17,500 BTC
A Bitcoin address identified as a Binance hot wallet in the exchange’s own transparency disclosures has reportedly seen approximately 17,500 BTC moved out.
The transfer comes amid reports of a major security breach involving Binance-linked Ethereum wallets.
It remains unclear whether the Bitcoin transfer was unauthorized or a move to safety.
Looking at Binance's Blog "Ensuring transparency":
binance.com/en/square/post/9…
The address:
bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h is their hot wallet address and just got drained for ~17,500 BTC
mempool.space/address/bc1qm3…
ATTACKERS REPORTEDLY EXPLOITED ETHEREUM’S EIP-7702 TO DRAIN BINANCE WALLETS
On-chain analysis suggests attackers obtained signed authorizations allowing them to install malicious code on Binance-linked wallets without directly accessing their private keys.
The attackers then used a function called “sweep” to transfer ETH and dozens of tokens into an attacker-controlled wallet.
The same delegated permissions were reportedly used to move another $780 million in USDC from a separate Binance hot wallet.
The attacker’s transaction relayer was funded through Tornado Cash, while nearly 195,460 ETH was subsequently transferred to a newly created wallet.
How the attackers obtained the authorizations remains unknown. Binance says user funds are safe and is investigating.
ok safe to say binance is pwned
The biggest assets were approximately:
• 1.615B USDT
• 62.6M RLUSD
• 29,934 wBETH
• 11,372 XAUt
• 6.19M UNI
• 198.4M ENA
• 7.175T PEPE
• 27.8M USD1
• 2.26M LINK
• 127,853 AAVE
about $2.5B at the explorer’s prices.
1. The attacker deployed a delegate contract, 0x63e842b0...73e9c6fAe, from the relayer at 15:59 UTC.
2. About four hours later, the relayer submitted an EIP-7702 authorization transaction
That installed the malicious 7702 delegate code on Binance 14.
3. The relayer then made a call to Binance 14, executing the delegate code, and transferring Binance 14’s ETH and token balances.
4. The calldata is labeled sweep(address, address[]). The second argument is a list of recognizable token-contract addresses plus the zero-address (eth).
5. The same relayer later used the same delegate to move 780M USDC from Binance Hot Wallet 34 into the same pool
• The relayer 0x7C... was funded by three Tornado Cash 0.1 ETH withdrawals over the prior two days.
• The same pool also received 28,005.6 ETH from Binance 16 24 seconds after the main sweep.
• The pool then forwarded 195,460 ETH to a fresh, unlabeled EOA
• That EOA has only one transaction and currently holds the 195,460 ETH.
What's a bit unclear is why the relayer was needed in the first place. If they had the private keys to the Binance wallets, they could have just sent the assets out in an atomic bundle without needing a relayer at all.
So it seems likely that they didn't have the private keys and instead just had the 7702 auth signatures, which must have been phished somehow.
I think we can go ahead and assume DPRK.
🚨 OVER $5 BILLION REPORTEDLY MOVED FROM BINANCE-LINKED WALLETS IN SUSPECTED HACK
On-chain analysis suggests attackers exploited Ethereum’s EIP-7702 delegation feature to drain assets, including $1.6 billion in USDT and another $780 million in USDC.
Binance says user funds remain safe and an investigation is underway.
Bitcoin News retweeted
Now tracking over $5B that has left Binance today
Posting potential Binance hacked wallets, over $3B has moved from the exchange
Over $900M USDT frozen so far though.
arkm.com/explorer/entity/21a…
🚨 TETHER AND CIRCLE FREEZE $1.8 BILLION IN STABLECOINS FOLLOWING SUSPECTED BINANCE HACK
Tether froze approximately $971 million in USDT, while Circle froze $823 million in USDC.
Former Binance CEO CZ said the incident appears to be a hack and that user funds are safe.
Although he no longer runs Binance, CZ said he expects all affected user funds to be fully covered.
STRATEGY REPORTS RECORD $21 BILLION Q3 OPERATING INCOME, HOLDS 848,517 BITCOIN
Strategy reported $19.5 billion in net income and $44.75 earnings per share, driven by a $20.9 billion gain on its Bitcoin holdings.
The company raised $21.2 billion in capital YTD, purchased $14.3 billion in Bitcoin and grew its holdings 26% to 848,517 BTC.
Strategy also repurchased $2 billion of STRC shares, built a $5.1 billion USD reserve and announced CFO Andrew Kang will step down November 5.
BITCOIN ART MAGAZINE REBRANDS AS TIMECHAIN ART MAGAZINE, OPENS PRE-SALE FOR FIRST ISSUE
The 154-page edition features 30 artists, including cryptograffiti, Trevor Jones and FractalEncrypt, with 70 pages dedicated to full-page artwork.
The cover features cryptograffiti’s sculpture for the Hal Finney-inspired Finney Freedom Prize, with a foreword by Lawrence Lepard.
Three limited collector editions will also be available, including a Patron Edition capped at 21 copies.
🇺🇸 FRANKLIN TEMPLETON LAUNCHES TWO ETFS THAT TURN STOCK DIVIDENDS INTO BITCOIN
Franklin Templeton's FBEQ and FIBT started trading on Nasdaq on Thursday, the asset manager announced. Both start at 95% US stocks and 5% Bitcoin, and the dividends the stocks pay are reinvested into Bitcoin.
FBEQ tracks about 500 of the largest US companies for a 0.09% fee. FIBT tracks 100 of the largest Nasdaq-listed companies, excluding financials, for 0.19%.
The Bitcoin share is trimmed back to 4.5% at each quarterly rebalance if it tops 5%, and capped at 20% in between. The funds don't hold Bitcoin directly. They get exposure through Bitcoin ETPs, including Franklin's own, and derivatives.
For buyers, dividends from the largest US companies become a steady Bitcoin purchase, with no wallet or exchange account needed.
Lava (@lava_xyz) has quickly become the best platform for bitcoin financial services: bitcoin-line-of-credit with the lowest rates and most flexible terms, a credit card that earns you BTC rewards on each transaction, and more.
For over a year, they have been shipping non-stop, and they have no plans to slow down.
Check out Lava today.
🤝 Paid partnership
Over the last 12 months at Lava, we have shipped:
- Lava BLOC, the world's first bitcoin line of credit, with flexible repayment and the industry's lowest fixed rates.
- Lava Card, a credit card that earns bitcoin back at 150M+ merchants in 150+ countries, funded by stablecoins, local currency, or your BLOC.
- Lava Yield Account, which pays 6.5% on USD by funding bitcoin-backed loans.
- Bitcoin buying and selling with zero platform fees and zero spread.
- Global money movement, with local-currency on- and off-ramps and stablecoin payments across multiple networks.
- Lava Prime, for individuals who want to borrow $5M+ on custom terms.
- Lava for Business, for companies who want to manage their bitcoin treasury.
- Lava Refinance, for people who want to move high-rate loans from other platforms to Lava at a lower fixed rate.
- Lava Private, for large bitcoin holders who want full wealth management.
- Security built on distributed key management, audited cold storage, 24/7 monitoring, and zero rehypothecation.
- Automated compliance, with KYC/AML and fraud prevention that adapts by country and secures our multinational operations.
- Native apps on iOS, Android, and Web.
The platform has processed $1B+ in payments, and we have secured access to $1B+ in low-cost credit capital to keep growing.
We serve customers in 150+ countries. They have borrowed against their bitcoin to buy homes and cars, pay their kids' college tuition, cover medical bills, take vacations, and improve their lives without selling their bitcoin.
There is a lot more coming over the next year. Stay tuned.
STRATEGY REPORTS EARNINGS TODAY WITH BITCOIN ABOUT 6% ABOVE WHAT IT PAID
Strategy holds 848,517 BTC bought at an average of $75,446, according to its Oct. 26 filing. With Bitcoin near $80,300, that's a paper gain of about $4 billion on $64 billion spent.
The company bought no Bitcoin in the week to Oct. 25. It spent $204.9 million buying back its STRC preferred shares instead.
Strategy's Oct. 5 filing estimated a $20.91 billion third-quarter gain on its Bitcoin, which was worth about $83,500 per coin on Sept. 30.
Results come after the 4 PM close, with a webinar at 5 PM ET. Coinbase also reports after the bell.
🇺🇸 GOOGLE ENTERS BITCOIN CUSTODY AS WALL STREET ACCELERATES DIGITAL ASSET ADOPTION
Google is testing a new institutional custody system that supports Bitcoin, with a commercial launch targeted for early 2027.
Its Multi-party Compute technology splits private keys into multiple shares, eliminating the need for a traditional seed phrase.
But unlike Bitcoin multisig, institutions must rely on Google’s infrastructure to coordinate transactions.
The move signals growing institutional demand for digital asset custody, even as questions remain about control and self-sovereignty.
