Withdrawals on Binance have been frozen since last week's security incident, which the exchange traced to a compromised DevOps engineer's laptop. Its fourth recovery update sets phase one of the restart for November 1 between 06:00 and 09:00 UTC.

The first wave covers 15 networks, including BTC, Ethereum, BNB Chain, Tron, Solana, XRP, Arbitrum, Base and Sui, with USDT and USDC on most of them. Assets were prioritized by user demand over the past week, and more networks will be added once security checks are complete. Deposits were not affected.

Binance says it has now covered about 95% of the hacked amount with company funds, up from 90% a day earlier.

The remaining 5% are less liquid tokens outside the top ten that the exchange is still buying through market and OTC channels. Users may see delays during the rollout, and a full post-incident report is promised once the investigation ends.

Laundering of funds from the $6B+ Binance hack, which the FBI has reportedly attributed to North Korea's TraderTraitor group, has moved onto cross-chain bridges. Roughly $38M passed through Relay Protocol in about seven hours, with transfers still in progress at the time of the alert.

Relay says it runs active KYT (know-your-transaction) screening designed to stop flagged funds, yet the flows went through. The same wallets could not move funds at a comparable pace through THORChain.

$38M bridged in 7 hours, with transfers still ongoing.

Bridges and swap protocols remain the main exit route for large exploits, and the case puts pressure on Relay to block further transfers from the flagged addresses.

The October 29 theft from Binance hot wallets now has an official attribution: the FBI linked the attack to North Korea's TraderTraitor group and urged the industry to help block laundering of the stolen crypto.

Unauthorized transfers totaled about $6.4B across multiple blockchains, the largest theft in crypto history. Roughly $2.8B has been frozen so far.

The FBI blamed the same unit for the $1.5B Bybit theft in February 2025. Blockchain analytics firms TRM Labs and Chainalysis had already pointed to TraderTraitor a day after the hack, after stolen funds commingled on-chain with proceeds from last month's Bitget theft.

Binance says 90% of the stolen assets have already been replenished.

The exchange has started drawing on its emergency reserve after a breach it estimates at $6.3 billion, confirming a 7,499 BTC transfer out of its SAFU fund to help cover user losses.

Binance says it has already replenished 90% of the stolen amount and plans to rebuild SAFU to about $1 billion afterwards.

The exchange has pledged to cover all losses from SAFU and company funds, and earlier said it had reserved over $6.34 billion for that purpose. Withdrawals remain paused while the withdrawal service is rebuilt, with a restart targeted for November 1 and a full Proof of Reserves report expected by November 3.

The biggest crypto hack in history began with a rehearsal: before the October 29 breach, attackers ran two test sequences of code on Ethereum accounts they controlled while trading on Binance carried on as normal.

The rogue code then gave them access to exchange-owned blockchain accounts. As the attackers emptied those wallets, Binance's own funds kept refilling them, and the drain continued.

Most of the estimated $6.3B left Binance hot wallets on 10 blockchains in about 20 minutes.

The account shows how automated hot wallet top-ups can amplify a breach once attackers control withdrawals from exchange accounts.

Two days after setting aside more than $6.34B of company funds for the record hot wallet breach, Binance published its third recovery update: replenished assets now cover 90% of the stolen amount, up from about 80% in the previous update.

BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now 100% backed. The remaining 10% consists of less liquid tokens outside that list, which Binance is still buying through market and OTC channels with industry partners.

The gap is being filled with a partial deployment of the SAFU fund, part of the Futures insurance fund and the corporate treasury. Binance says users will not bear the loss and has committed to rebuilding SAFU back to about $1B.

A new Proof of Reserves snapshot was taken at 00:00 UTC on October 31, with the full zero-knowledge proof expected by November 3. The next milestone is reopening withdrawals, which the exchange says remains on track for Sunday, November 1.

Blockchain analytics firm Chainalysis, whose tools are used by exchanges and law enforcement to trace crypto flows, disclosed a security incident in a notice to customers. An external attacker using "offensive agentic techniques" gained access to its systems and internal tools in October.

The exposed data includes user IDs, full names, email addresses and organization role labels. The company found no sign that investigation graphs, cases, notes, query results, passwords, MFA secrets or session tokens were accessed.

Chainalysis has not disclosed how many users or organizations were affected and says the incident is unrelated to the recent Binance theft.

The firm has notified all customers, brought in outside security experts and is patching the exploited vulnerabilities. Names, work emails and roles could still be used for targeted phishing against customer staff.

Malaysia's Securities Commission ordered Binance to stop operating in the country in July 2021, after finding it was illegally running a digital asset exchange. The exchange is now in talks to obtain a Malaysian license, aiming to return after a five-year absence.

As recently as July 2026, Malaysia's Ministry of Finance said Binance was not licensed or registered with the SC to carry out capital market activities, and that its website and app remained blocked for local users.

A license would reopen a regulated Southeast Asian market to the largest exchange by trading volume. Until then, Malaysian users can only trade on SC-registered platforms.

A wave of frontend hijacks hit DeFi apps overnight, with security firm Blockaid flagging sites that were actively serving the Step Drainer to visitors. The first alert covered flap.sh and Kintsu, and the list later grew to include pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app and others.

The affected domains rely on different DNS providers, but all of them are registered with Name.com. Developer banteg pointed to the registrar as the likely common point of compromise, which Name.com has not confirmed so far.

At least 12 DeFi frontends were flagged as serving the drainer.

A registrar-level breach would let attackers redirect domains without touching the protocols' smart contracts. Users are advised not to sign transactions on the affected sites until the teams confirm the issue is resolved.

A full list of Major Upcoming Events, to be updated