Co-CEO Yi He shared the figure on November 3 in a detailed incident report on the October 29 breach, which reportedly took about $6.34 billion in digital assets from the exchange.

The blocked attempts relied on social engineering, tampered software packages and fake job interviews, all aimed at reaching sensitive data and planting malware on internal systems. Binance attributed the breach to North Korea's TraderTraitor group, the unit also tied to the February 2025 Bybit hack.

Binance froze or intercepted roughly $2.85 billion of the stolen assets and has pledged to replenish affected user funds.

Withdrawals, paused after the attack, have been restored in phases since November 1. North Korea rejected the accusations. The case shows that employee-targeted schemes like fake hiring now sit on the front line of exchange security.

The theft took 4 minutes, the setup took 5 months. Binance's incident report traces it to a poisoned Homebrew install in June and a fake job interview in September that put a 0-day on a work laptop.

On October 20, an internal AI tool led the attackers to two wallet engineers and a deploy token. On October 29, 233M XRP left the hot wallets, followed by SOL, OP and 18,270 BTC.

Pausing withdrawals didn't stop it: an EIP-7702 delegation kept moving funds on-chain for ~4 hours, until it was cleared at 00:10 UTC.

$2.85B is frozen, and the FBI names North Korea's TraderTraitor.

The motion is the latest turn in Tron founder Justin Sun's lawsuit over his frozen WLFI tokens. In a statement on X, Sun said his lawyers asked the court to sanction World Liberty Financial and its lawyers for disclosing only months into the case that the company is a UAE citizen.

World Liberty's original filing in April listed Florida as its sole citizenship. On August 26, days after a hearing that kept some of Sun's claims in federal court, the company named 22 entities in its ownership chain and citizenship in Florida, Delaware, Puerto Rico and the UAE, then argued the federal court could no longer hear the case.

Sun, who put $45 million into WLFI, says fighting the company's arbitration request cost him hundreds of thousands of dollars in legal fees.

Sun plans to refile his claims in California state court once the sanctions motion is resolved. World Liberty has rejected his earlier allegations over the token freeze.

Same volume, very different books: Lighter and Variational each did about $72-73B in 30 days, but Variational holds 30% more open interest.

OI is the money actually at risk, and it is far harder to inflate than volume. Around 1 turn a day means real positions: Hyperliquid, Aster, GRVT, Antarctic. Hyperliquid alone holds 61% of the top 15's OI.

At 8-10 turns a day the same capital is flipped over and over: the shape wash trading, points farming and paid market making leave on a chart. Veranta (ex-Avantis, zero fees) did $21B on $73M of OI, Nado $10.6B on $42M.

High turnover doesn't prove fake volume, but it shows how much of a ranking is backed by real positions. The median top-15 DEX turns its OI 3 times a day.

Earlier findings pointed to a single compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container that submits withdrawals. Binance has now tied that compromise to a bogus job interview, a lure North Korea-linked groups use to get targets to run malicious code during fake hiring tests.

The theft on October 29 took about 20 minutes and drained roughly $6.3 billion from hot wallets across several blockchains. The FBI attributed it to TraderTraitor, the North Korean unit also blamed for the 2025 Bybit theft.

About $3 billion has been frozen onchain, including roughly $1.57 billion in USDT by Tether and more than $800 million in USDC by Circle.

Binance has pledged to cover every loss and set aside $6.34 billion for it. CEO Richard Teng has said the attack involved additional points of breach beyond one engineer's permissions, and a full post-mortem is still pending.

London-based high-frequency trading and market-making firm LO:TECH closed a $12M Series A led by MMC, with Faction, 13 Books Capital and new investor Atka also participating.

The firm, founded by Tim Meggs, Marcus Horsley and Alex Williams after FTX's collapse, runs mostly proprietary trading and also sells market data and trading technology to venues and token issuers. Alongside the round, it is launching execution services across traditional, digital and prediction markets.

Since its $5M seed in August 2025, LO:TECH's revenue has tripled and it now works with more than 50 clients, including public companies.

The capital funds new teams in New York and Singapore for round-the-clock coverage of 24/7 markets. LO:TECH plans to seek regulatory approval in each market it enters and is currently looking at US licences.

The Ethereum privacy L2 rolled out Aztec Tierra (Alpha V6), a network upgrade that fixes the critical proving system vulnerability found in V5 and adds formal verification of core cryptographic components plus an AI-powered security testing harness.

Client-side proofs for private transactions now take 1 second on a native device, a 2x speedup, while Ethereum-to-Aztec message delivery drops from about 2 minutes to as low as 12 seconds.

A batch of private apps is launching or preparing deployments alongside the upgrade, led by zk.money and Nyx for private payments, plus Nemi (private perps), Xochi (private intents), Galactica (private AI inference), Nulo wallet and Olla liquid staking for AZTEC.

Aztec runs with more than 3,000 validators, no centralized sequencer and no privileged viewing keys. The network is still in Alpha, so the security fixes in Tierra are a key test before broader app adoption.

Perpetual futures, the instrument that grew up on offshore crypto venues, are moving deeper into US regulated markets. CFTC Chairman Michael Selig said that perpetual contracts on individual equity securities can now trade on CFTC-registered exchanges that are also notice-registered with the SEC to list security futures.

The "Equity Perps" were deemed approved under CFTC Regulation 40.3 as security futures products under the Commodity Futures Modernization Act of 2000. That puts them under both the Commodity Exchange Act and federal securities laws, with joint CFTC and SEC oversight built on the memorandum of understanding the two agencies signed earlier this year.

The move follows the CFTC's May 2026 approval of the first true bitcoin perpetual futures contract, KalshiEX's BTCPERP, extending the product beyond digital commodities into traditional securities.

Selig framed the decision as a way to bring US traders onshore rather than leaving them to offshore and often unregulated venues. For crypto exchanges and onchain perp platforms that already list stock perpetuals, it means a regulated US alternative now exists.

In a recent interview in Washington, Hyperliquid co-founder Jeff Yan described the protocol as blockchain infrastructure for financial trading rather than a crypto exchange. Under his US plan, firms offering products on top of Hyperliquid would handle know-your-customer checks and market surveillance themselves.

The model is already taking shape. Payward, the parent of Kraken, plans to offer Hyperliquid-based perpetual futures to US investors through Bitnomial and NinjaTrader Clearing, while Intercontinental Exchange is taking a minority stake in HIP-3 platform Trade.xyz to build a US perpetuals market, pending regulatory approval.

Hyperliquid's trailing 12-month revenue stands at $713M, and Trade.xyz has passed $500B in cumulative trading volume.

Hyperliquid still officially restricts US users. Yan named tokenized real-world assets, including shares of large companies, as a next area of growth, though any such markets would depend on outside builders launching them.

Blockchain investigator ZachXBT raised the suspected loss to $133 million after spotting another $27 million in withdrawals from centralized exchanges, up from the $106 million he flagged on Monday. The victim, an unidentified European Union entity, has not been publicly named.

Kraken said the incident did not originate on its platform, but some of the assets were moved through accounts it has now restricted. The exchange is working with law enforcement on recovery and said no customer accounts were taken over. Crypto.com blocked funds linked to the incident, while OKX is looking into the matter.

$62.98M in stablecoins was converted into 27,553 ETH within about four hours. Only $3.74M remains in USDC that Circle could freeze, and Tether has frozen $1.1M in USDT.

ZachXBT believes a large Western European financial institution was exploited and that the incident is being covered up, a claim that remains unverified. He said the laundering through instant exchanges, bridges and Monero does not match typical Lazarus Group patterns.