C€rtifi£d 🥷

How a crypto bottom usually forms Bad news keeps coming. The price stops falling. Shorts pile in. Then it turns. We checked the some major BTC bottoms against Binance funding data. In 6 of them, shorts were paying longs at the low: Dec 2019: $6,427 Mar 2020: $3,622 Jun 2022: $17,593 Nov 2022: $15,443 Feb 2026: $59,800 Jul 2026: $57,759 Today: $71,400. Funding still positive. 73% of accounts long. The bad news is here. The shorts aren't. Yet.

A lesson from seven years of Binance data. This one took time. We matched every BTC funding reading Binance has published since 2019, all 7,856 of them, against what the price did over the next two weeks. The more traders paid to hold longs, the deeper the drop that followed: Funding negative: 6.3% average dip 0 to 5% a year: 7.4% 5 to 10%: 7.8% 10 to 20%: 7.8% 20 to 40%: 12.5% Over 40%: 14.1% The lesson: a crowded long is not a reason to buy. An expensive long is a warning. Today: 8.2%. Crowded, not yet expensive.

We read Binance's wallets every day since November 3. ETH held: Nov 3: 221,582 Nov 5: 287,742 Nov 7: 283,043 Nov 10: 310,240 40% more ETH in one week. 18% more than before October 29. Net inflow to Binance, last 7 days: $2.54B. People vote with deposits. 🔶

Binance futures, share of accounts long right now: SOL 78.4% ETH 78.0% BTC 75.5% XRP 73.7% DOGE 73.4% BNB 73.3% Prices over the last 30 days: down 6% to 18%. Bitcoin's long share went from 60% to 76% in a month. Remember, the market is not a democracy. The minority always wins.

When an exchange breaks, its token breaks first. FTX, 2022: FTT down 95% in ten days. WazirX hack, 2024: WRX down 28% in a week. Bitget hack, September: $388M stolen, BGB down up to 10%. Binance, October 29: $6.3 billion stolen. The largest hack in crypto history, 16 times Bitget's. The last 30 days, hack included: SOL: down 18.3% XRP: down 16.0% ETH: down 9.7% BTC: down 7.4% BNB: down 5.7% The hacked exchange's own token fell the least of all five.

Trump was going to make America the crypto capital. Here is the receipt. Oct 10, 2025 one tariff post. Bitcoin from $122K to $102K in hours, the biggest liquidation day crypto has ever seen. A wallet opened a giant short minutes before the post. No one has been held accountable. TRUMP$1.20 peak $79.70. Today $1.18. MELANIA$0.0614 peak $13.05. Today $0.06. Tonight: 4,259 BTC leave the wallets backing Trump Media's convertible notes and land on Crypto.com

BNB Chain's next upgrade reserves 5% of every block for payments. We measured what that means. 600 random blocks from the last 24 hours: Payments: 1 in 5 transactions Block space they use: under 1% The 5% lane fits about 100 payments per block. Today's demand: 18. Room for 5x more payments, even when a memecoin rush fills the rest.

Binance blocked 57 North Korean attacks this year. Number 58 was a job interview. June: an engineer installs a coding tool from an ad. It's tampered. Binance catches it, wipes the device, rotates credentials. But the team is already mapped. September: another engineer gets a recruiter on LinkedIn. Two rounds of interviews, one with the "CEO" of a company that doesn't exist. Then a take home assignment. The assignment is the malware. October 20: through that laptop and an internal AI tool, the attackers reach two wallet developers. One has a container deployment token sitting on his machine. October 29, 20:24 UTC: $6.3B leaves Binance in under an hour. It took them five months to get in. Six days later, they still can't get out. 522,409 ETH in eight wallets. Not one transaction since the theft. 18,270 BTC. Not one satoshi moved. $2B in USDT and USDC. Frozen in their wallet. The FBI has their name. 600+ addresses flagged. Meanwhile ETH trades above its price the hour before the hack. Binance has replenished 98% from its own funds and reopened withdrawals. The most expensive job interview in history, and the people who ran it can't spend a dollar of it. If you work in crypto, read that timeline twice: • No dev tools from ads. Ever. • A recruiter's assignment is untrusted code. Never on a work machine. • A deploy token on a laptop is a key. Guard it like one. • If your signer signs anything, it will sign an EIP 7702 authorization. Make it refuse by default.

We followed the Binance attacker's Tron money. It leads to the same wallet as the Bitget hack. THE PATH (every hop onchain) • 20:21 UTC, 29 Oct: Binance Hot 7 on Tron sends 612.7M USDT and 46.4M TRX to TG5iBMQ… • 00:06 UTC: 46.38M TRX moves on to TRBdWq… • From there to TDNF7…, directly and through a pooling wallet • TDNF7 swaps TRX and USDT through THORChain into ETH, paid out to: 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 We matched each payout to its Tron source by the router's OUT memo. Example: 299,998 TRX in, 6.01 ETH out (0xbd3d97e2…). THE SAME WALLET'S OTHER FEEDER A Bitcoin wallet, bc1qxtl05…, swaps BTC into ETH for the same address through THORChain. It was active since 23 Oct, before the Binance theft. Its funds trace back to a wallet that appeared two days after the $388M Bitget breach. WHAT IT MEANS Two exchange hacks, one month apart, settling into one address. That points to one actor. We traced the Binance side hop by hop and it holds. Analysts at TRM Labs and Chainalysis name North Korea's TraderTraitor. Same playbook as Bybit: a compromised engineer machine, a hijacked signing flow, THORChain for the exit. Every hop is public. Every hop is watched.

Binance's preliminary finding,a compromised DevOps laptop gave the attacker access to a service container, which pushed unauthorized withdrawals. No private key leaked. Here is what the chain showed at 20:24 UTC, hours earlier👇 • Binance 16 signed nine transfers to the attacker inside its normal withdrawal flow. Same key, but different software: a 2.4 gwei tip instead of the bot's 1.0, and custom gas limits instead of its fixed 207,128. • On Bitcoin, 18,270 BTC left at 10 sat/vB. Binance's normal payouts that hour paid 5. Real signatures. Wrong software. That is what a hijacked signing pipeline looks like. Response👇 • 00:10:35 UTC: Binance revoked the EIP 7702 delegation on Binance 14. The door is closed. • Since then, Binance 14 has been moving what is left to Binance 8. • About $3B frozen with partners. Attacker now 👇 • 511,854 ETH in 8 wallets. Not one of them has sent a single transaction. • 18,270 BTC, untouched. • Every wallet is mapped and watched. User funds, covered. SAFU. 🔶

Plot twist on the Binance hack, scammers are now trying to rob the hacker. 04:35 UTC, fake transfers "from" the exploiter's wallets, copying its real amounts (41,397.81 and 3,552) to lookalike addresses. Address poisoning. One bad copy paste and the thief gets robbed.

Who funded the Binance exploiter? We traced every wallet back. All roads end at Tornado Cash, six withdrawals, 1.5 ETH total, 28 to 29 Oct. No CEX touchpoint. One exception, the exploiter bridged via MetaMask Bridge → Bridgers to Arbitrum. Order hakpi6.

How the Binance hot wallet drain was done. We checked every signature. THE REHEARSAL 02:28 UTC: the attacker deploys a sweeper contract. Its code obeys one address only: the attacker's own, hardcoded. 13:51 to 16:47: they practise on their own fresh wallets. EIP 7702 delegation, then sweep. Again with a second version. No Binance address is touched. THE SIGNATURES 20:20:59, block 26300753: one transaction carries 50 EIP 7702 authorizations. We recovered the signer of all 50. Every one is Binance 14, Binance's largest Ethereum hot wallet. Mainnet only, nonces 18914775 to 18914824. Binance 14 only reached nonce 18914775 at 20:17:47, so these were signed live, within about three minutes, padded 50 numbers ahead because the wallet sends about five txs a block. Binance 14's next own tx skips from 18914808 to 18914810. Nonce 18914809 was the authorization that landed. THE SWEEP 20:24:23: one call moves 167,464 ETH, 1.6B USDT and 60 more tokens out of Binance 14. 20:41 and 20:59: the same contract makes Binance 14 order a smart wallet it owns to pay out 780M and 43M USDC. 20:24:47: Binance 16, a separate wallet, signs nine transfers to the attacker. They sit inside its normal withdrawal sequence but were built by different software: 2.4 gwei tip instead of 1, and custom gas limits instead of the fixed ones every Binance withdrawal uses. WHAT IT PROVES No smart contract bug. No token approval. The attacker could make two Binance hot wallet keys sign whatever they wanted, in real time. Whether that came from a leaked key or a compromised signing device is not public.

We traced the Binance hot wallet drain transaction by transaction. Here is what the chain shows. SETUP 28 Oct 07:39 UTC: a fresh wallet, 0x7c86…5ca0, receives its first gas from Tornado Cash. Three 0.1 ETH withdrawals over two days. 29 Oct 15:59: it deploys a small contract, 0x63e8…6fae. The bytecode hardcodes 0x7c86 as the only operator. Afternoon: test transactions to throwaway addresses. KEY MOMENT 20:20:59: 0x7c86 sends one EIP 7702 transaction to Binance 14, Binance's largest Ethereum hot wallet. Inside: 50 authorizations, all signed with Binance 14's own key, for 50 consecutive nonces (18914775 to 18914824). Spraying nonces guarantees one lands on a wallet that sends thousands of txs a day. Result: Binance 14 now runs the attacker's code. Tx: 0xad99264d…298b SWEEP 20:24:23: a single call drains Binance 14 into a new address, 0x5227…2f8c: • 167,464 ETH • 1,615,409,499 USDT • 7.17T PEPE, 2.26M LINK, 82.5 WBTC • 60 more tokens Tx: 0x53bd38b8…e2f3 20:24:47: Binance 16 sends 28,005.6 ETH and 55.7M USDT to the same address. These were signed by Binance 16's own key. 20:41 and 20:59: 780M and 43M USDC pulled from a Binance controlled contract. 21:04: a second sweep takes fresh deposits, including 1,699.9 ETH. WHERE IT WENT 20:29: two test sends of 0.5 ETH. Then: • 500M USDT to 0x9749…c762, swapped through Uniswap into 122,313 ETH • 200M USDT to 0x0ddf…697e, then 190M on to 0x8d53…639a • 195,460 ETH to 0x8532…43d4, untouched so far THE RESPONSE 21:05: Tether freezes about $971M USDT. Circle freezes about $823M USDC. 21:16: Binance says it is investigating. Etherscan tags 0x7c86 and 0x5227 as "Binance Hot Wallet Exploiter". WHAT IT TELLS US Not an approval bug, not a smart contract hack. Two hot wallets produced valid signatures for an attacker: Binance 14 signed the 7702 delegation, and Binance 16 signed the transfers. Something in the signing path was compromised. How is not public. No exchange deposits, no bridges and no Tornado deposits yet. Receipts, all on Etherscan: 1. EIP 7702 delegation on Binance 14, 50 signed authorizations: etherscan.io/tx/0xad99264d55… 2. The sweep, 167,464 ETH + 1.6B USDT + 60 tokens in one call: etherscan.io/tx/0x53bd38b816… 3. Attacker wallet, funded by Tornado Cash: etherscan.io/address/0x7c860… 4. Collection wallet: etherscan.io/address/0x5227f… 5. 195,460 ETH, untouched: etherscan.io/address/0x8532f…

We have begun monitoring Binance's Tx. Stay calm. Only follow Binance official announcements.