Withdrawals from Jupiter Lend, the Solana lending market run by Jupiter, are being held up by what the team called a liquidity crunch tied to broader market conditions. Borrowers have drawn down nearly all available stablecoin liquidity, leaving depositors waiting in line.

Jupiter Lend's public API shows the USDC vault holding about $417M in supplied assets, with only around $15 available for immediate withdrawal on Friday afternoon. Earlier in the day the figure was reportedly as low as $3.35.

The team says the protocol is functioning as expected, all funds are safe, and withdrawals will resume as borrowers repay loans or new deposits arrive. Other vaults are less strained: JupUSD shows about $323K withdrawable out of $45M, and USDT about $1.2M out of $16.7M.

No timeline for fully restoring withdrawals has been given. Until utilization drops, USDC depositors depend on repayments, which high borrow rates are designed to encourage.

While moving loot out of the drained Binance hot wallet, the attacker's address sent 18 different altcoins straight to the Newton Protocol (NEWT) token contract instead of a wallet, in a run of transfers between 04:45 and 05:00 UTC on October 30.

The batch included about 8M NEWT, 4.66B DENT, 314M HOT, 111M ANIME, 49M CELR and 31.7M WOO, along with DOLO, HIGH, SIGN, FTT, RESOLV, LQTY, ANKR, KNC, ARPA, GLM, RARE and BARD.

Around $3.32M in tokens is now stuck in the token contract, where it cannot be recovered.

The slip is a small fraction of the roughly $6.3B taken from Binance, about $3B of which has already been frozen by stablecoin issuers and networks, while the attacker keeps converting the remaining altcoins into ETH.

Of the $6.0B taken from Binance hot wallets, $2.75B (46%) is frozen or seized, almost all of it on Ethereum and Tron. The other $3.16B is still with the hacker, and $1.41B of that sits in BTC, which nobody can freeze.

Only $82M has left the tracked wallets so far. Follow the money live on LayerHub: 145 wallets across 10 networks, refreshed within a minute.

Three of Coinbase's top insiders adopted prearranged Rule 10b5-1 trading plans during the third quarter, as disclosed in the company's latest quarterly filing with the SEC.

CEO Brian Armstrong's plan covers up to 8.17M Class A shares from exercised vested options, with sales possible between November 16, 2026 and October 22, 2027.

Co-founder and board member Fred Ehrsam may sell up to 3.87M shares starting December 7, 2026, while President and COO Emilie Choi's plan covers up to 1.56M shares from January 4, 2027. Together the plans total about 13.6M shares.

All sales depend on COIN trading above threshold prices set in each plan. Such plans are adopted in advance during open trading windows, so executives can sell on a fixed schedule without insider trading concerns.

To dump stolen coins before the freezes, the attacker bought ETH at up to 32% above Binance and sold dozens of altcoins at deep discounts. On Uniswap, ETH hit $3,487 while Binance showed $2,266. Every dollar of that gap landed in someone's pocket.

Block builders took the most. In the hour from 20:30 UTC, Ethereum builders and validators collected about 7,200 ETH (~$16.5M) in tips. The same hour a day earlier paid 4.55 ETH. Titan built 191 of 298 blocks, and beaverbuild got 1,070 ETH (~$2.4M) from a single transaction.

Arbitrage bots came second, with about $12.7M for the top 10. The best one borrowed 11,701 ETH on Aave, sold it on-chain near $2,595 and bought it back near $2,221, clearing about $4.4M. Another wallet pulled 4,175 ETH from Kraken and sold it on-chain 72 seconds later for $11.24M, about $1.8M above the Binance price.

Market makers got far less than you'd think. The hacker sold 325M USDT for ETH through UniswapX and 1inch Fusion at an average of $2,657. Most fillers bought that ETH on Uniswap in the same transaction, so the spread leaked to pools, arbs and builders. The biggest filler, registered on 1inch as Kipseli, handled 145M USDT, kept about 149 ETH (~$337K) and paid builders 1,221 ETH. One resolver did it differently: it posted 28.6M of the stolen USDT as collateral on Compound, borrowed 10,041 ETH and now sits on about $6M. That USDT is still there.

Bots cleaned up the altcoin dump, about $9.4M for the top three. jaredfromsubway sandwiched 25 of the hacker's 29 ONDO sales. UNI went for $5.69 vs $6.41 on Binance.

On Tron the attacker swapped 234M USDT into TRX at $0.367 while Binance showed $0.334, about $21M handed to arbitrageurs. Uniswap LPs earned about $2.2M in fees, 130x a normal hour.

The window stayed open for about 45 minutes, and anyone could trade it: buy ETH on a centralized exchange, sell it on-chain for 10%+ more. The catch was having money outside Binance, where withdrawals were frozen.

On October 29 the Binance hacker drained the exchange's hot wallets at 20:24 UTC and started a race against the freezes. Stolen USDT can be blocked by Tether at any moment, ETH cannot. So between 20:34 and 20:49 UTC the hacker sold 325M USDT in 9 orders through UniswapX and 1inch Fusion and got 122,316 ETH, at an average of $2,657. Binance was trading near $2,300. The last order went through 8 minutes before the first freeze of the night. Speed cost the hacker about $45M on this one swap.

ETH at $3,487, for one block

At 21:09 UTC, ETH in Uniswap's main ETH/USDT pool hit $3,487 while Binance showed $2,266. In the same block, USDT itself traded at $0.798 against USDC on Uniswap. Part of the spike was USDT breaking down, not ETH flying: in USDC pools ETH peaked around $2,780. Either way, the on-chain premium stayed above 10% for about 45 minutes.

Who got the money

• Block builders and validators: ~7,200 ETH (~$16.5M). That is what they collected in tips in the hour from 20:30 UTC. The same hour a day earlier paid 4.55 ETH. Titan built 191 of the 298 blocks, and a single transaction paid beaverbuild 1,070 ETH (~$2.4M).
• Arbitrage bots. The best one borrowed 11,701 ETH on Aave in 18 loans, sold it on-chain near $2,595 and bought it back near $2,221, clearing about $4.4M. Another wallet pulled 4,175 ETH from Kraken and sold it on-chain 72 seconds later for $11.24M, about $1.8M above the Binance price.
• A 1inch resolver that kept the stolen USDT. Instead of buying ETH on the market, it posted 28.6M of the hacker's USDT as collateral on Compound, borrowed 10,041 ETH and handed the hacker 9,566. The position is still open, worth about $6M, and the stolen USDT is still sitting there.
• The biggest filler, with the smallest cut. A resolver registered on 1inch as Kipseli handled 145M USDT, 45% of the volume. It kept about 149 ETH (~$337K) and paid builders 1,221 ETH, eight times more.

Then came the altcoins

After ETH, the hacker dumped dozens of tokens at a discount, and the bots were waiting. jaredfromsubway sandwiched about 25 of the hacker's 29 ONDO sales. 7M UNI went for an average of $5.69 while Binance showed $6.41. On Tron the attacker swapped 234M USDT into TRX at $0.367 against $0.334 on Binance, another ~$21M given away. Across all legs, our on-chain estimate puts the hacker's total overpayment at about $90M.

Why market makers did not take it all

The trade was open to anyone: buy ETH on a centralized exchange, sell it on-chain for 10% more. The catch was having ETH outside Binance, where withdrawals were frozen, and beating bots that hand most of the spread to builders just to land first. Most fillers bought the hacker's ETH on Uniswap in the same transaction, so the spread leaked to pools, arbitrageurs and block builders.

Every dollar the hacker paid for speed ended up with someone who was faster.

Figures are on-chain estimates against Binance prices in the same minute. Builder tips are paid out of the arbitrage spreads, so the groups overlap. Sources: Ethereum and Tron on-chain data, Binance 1-minute prices, TRM Labs.

The attacker drained Binance's hot wallets at 20:24 UTC. The first freeze landed 33 minutes later. By 01:19, issuers and one L2 had locked about $3B. Here's how the night went (UTC):

20:57 World Liberty blacklists 48.5M WLFI. First freeze of the night

21:01 Tether freezes 971M USDT in a single wallet

21:04 Circle freezes 822.6M USDC, working with law enforcement

21:07-21:21 Tether hits Avalanche, Tron and gold: 8.4M USDt, 378.7M USDT, 12,574 XAUt (~$50M)

21:18 The attacker moves 30M USDT. Tether freezes the sender 36 seconds later and catches the money at the next address

22:00 Ripple freezes 40.5M RLUSD in the same block as the attacker's last sale

22:06 Tether blacklists the hacked Binance hot wallet itself, so the attacker's later USDT sweeps fail

22:10 World Liberty and BitGo freeze 27.8M USD1

22:30 Paxos freezes 1,907 PAXG (~$8M)

22:48 Binance blacklists 29,934 of its own wBETH (~$75M)

00:08 Arbitrum Security Council takes back 8,426 ETH and 74.6M ARB ($30.5M), the only ETH anyone recovered

01:19 First Digital confirms an FDUSD freeze, amount not disclosed

DeFi shut its doors too. Aave froze 175 markets on 16 networks, trapping 60M USDT of the attacker's collateral. Compound, Moonwell, Kamino, BENQI and Venus paused markets.

Not everything was caught. About 435M USDT was sold before the blacklists, 325M of it to market makers at a discount of over 10%. Around $3.27B sits in BTC, ETH, XRP, TRX and SOL, which nobody can freeze. THORChain, the attacker's main exit, froze nothing.

Elon Musk mocked Binance co-founder Changpeng Zhao with a laughing emoji under an older CZ post warning users about malicious email attachments. In response, CZ asked Musk to stop trolling, calling it a bad time and asking for a little support instead.

CZ added that Binance's $500M investment in Musk's Twitter takeover has since turned into SpaceX shares worth more than $1B.

The exchange is dealing with what it estimates as a $6.3B security incident, the largest hack in crypto history. Binance said the attack likely started from a compromised DevOps engineer's laptop, and stablecoin issuers and other firms have since frozen roughly $3B of the stolen funds.

Binance first linked the security incident to a compromised DevOps engineer laptop, but its latest investigation update says further points of breach have since been found. The exchange called it a complex attack and said it is working with law enforcement while the facts are still being gathered.

The incident has an estimated total impact of about $6.3 billion. Outflows stopped once withdrawals were paused, and Binance and its partners have frozen around $3 billion of the affected assets so far, with Tether, Circle and Ripple among those freezing funds.

Binance says all losses will be covered from the SAFU fund and company money, and withdrawals remain on track to resume in about 45 hours.

Deposits are unaffected. The exchange has also promised an updated Proof of Reserves once the incident is resolved, which will be the first full public check on its balances after the attack.

Between February 2025 and October 2026, attacks publicly tied to TraderTraitor, the North Korean unit inside Lazarus, took about $8.57B from crypto exchanges and bridges. Binance accounts for 74% of that sum. About 33% of the total is frozen, but almost all of it comes from one case.

Bybit, Feb 2025: $1.46B

A Safe{Wallet} developer's computer was hacked and malicious JavaScript was injected into the interface. Bybit's signers saw a normal-looking transaction and approved the drain of a cold wallet. About 3% was frozen. Within a month 86% of the ETH had been converted to BTC, most of it through THORChain. This is the only attack in the list with formal FBI attribution.

BtcTurk, Aug 2025: $48M

Hot wallets were breached, most likely through a stolen key. There is no data on frozen funds. Part of the stolen ETH later helped fund the Kelp attack.

Kelp DAO, Apr 2026: $292M

The attackers hacked two internal RPC nodes and DDoSed the external ones. The LayerZero bridge relied on a single verifier, which confirmed a fake burn. The Arbitrum Security Council froze about $71-75M (~25%). Around $220M has been laundered through THORChain, Wasabi, Tornado and Umbra.

AFX Trade, Jul 2026: $24.15M

A fake recruiter spent two weeks working with the team. A malicious git config gave the attackers the bridge validator keys. The stolen USDC became 12,467 ETH. Nothing has been recovered.

Bitget, Sep 2026: $387.5M

A zero-day in a third-party security product let the attackers forge withdrawal commands in the wallet system and wipe the logs. Every stablecoin was swapped within 41 minutes, so only $0.84M (0.2%) was frozen. $269M went through THORChain.

Binance, Oct 2026: $6.36B

A DevOps engineer's laptop led to a service container and then to signing access in the hot-wallet system across 10 chains. On Ethereum the attackers used 50 pre-signed EIP-7702 authorizations, after 36 hours of staging and test runs. About $2.7B (42%) is frozen: Tether ~$1.77B, Circle ~$825M, Ripple $40.5M, WLFI $27.8M, Arbitrum ~$30M. Roughly $2.4B in ETH and BTC is out of reach.

What the six have in common

• People, not code. None of the attacks used a smart contract bug. The way in was always a person or a piece of infrastructure.
• Stablecoins are the only thing that gets frozen. Binance's 42% exists because issuers caught about $2.66B in stables in time. Without Binance, about $117M of $2.21B was frozen, roughly 5%.
• THORChain is the exit. Loot from Bybit, Kelp, Bitget and Binance was moved to BTC through it.
• Weeks of preparation. Operator wallets funded through Tornado ahead of time, two weeks of social engineering at AFX, 36 hours of staging at Binance.

How solid is the link

Only Bybit has formal FBI attribution. The rest comes from analysts: TRM Labs, Elliptic and others. So far the link between the hacks rests on on-chain tracing: ZachXBT matched Binance and Bitget funds at one THORChain address. A shared laundering address points to one network, but it is not proof of one team.

Also linked: Phemex (~$85M, January 2025) sits just outside the window. MistTrack traced Binance funds to a wallet the Phemex hacker used before. With Phemex, the total is about $8.66B in 21 months.

Excluded: Drift ($285M, April 2026). TRM ties it to a different North Korean group.

Sums are at the time of each attack. Sources: TRM Labs, ZachXBT, Elliptic, BlockSec, MistTrack.