cover

Binance co-founder He Yi responded to users on the X platform, stating that the current $6.3 billion has covered all stolen assets, and Binance still needs to go through formal processes to recover the frozen $3 billion.This response was directed at user @LIZHIGE2026 regarding whether the frozen USDT will be returned to Binance. He Yi also addressed concerns from the public about Binance's solvency, assuring users that they can feel at ease.

Binance released a second update on the security incident signed by Co-CEO He Yi and Richard Teng, stating that the technical team aims to begin phased withdrawals within approximately 34 hours, contingent on the completion of security checks; services such as deposits that were not affected are operating normally.Binance stated that it has reserved over $6.34 billion in funds, of which $5 billion consists of stolen tokens, covering about 80% of the affected amount, with the remaining portion being purchased through market and over-the-counter channels; the first reserve proof snapshot will be conducted within 12 hours, with results announced on November 2.In terms of investigation, in addition to the initially suspected laptop breach, other points of compromise have been discovered, and no evidence of wallet private key leakage has been found so far. Further technical findings are expected to be disclosed within approximately 48 hours.ChainCatcher previously reported that the losses from this incident are approximately $6.3 billion, with about $3 billion frozen on-chain.

According to market news, the United States Secret Service stated that investigators are collaborating with private sector partners, including Circle, to identify, freeze, track, and recover funds stolen from Binance.

According to CoinDesk, analysts from three Wall Street firms—Cantor Fitzgerald, TD Cowen, and Compass Point—believe that despite Binance experiencing a hack of approximately $6.3 billion, there are currently no sufficient signs indicating that this event will threaten the entire cryptocurrency market, and the previous trend of market recovery is unlikely to be interrupted.Cantor Fitzgerald analyst Ramsey El-Assal pointed out that Tether has frozen over $1.5 billion in stolen assets, Circle has frozen about $800 million, Ripple has frozen about $200 million, and Binance claims that the total amount of frozen stolen funds is approximately $3 billion. He believes that the cryptocurrency industry is gradually enhancing its ability to respond to such security incidents and expects that after market panic subsides, cryptocurrency-related stocks like Coinbase, Robinhood, and Strategy are likely to rebound, advising investors to buy on dips.TD Cowen analyst Lance Vitanza believes that this attack exposes security weaknesses in Binance's own transaction signature infrastructure, rather than issues with the underlying technology of cryptocurrencies like Bitcoin. The market sell-off may provide an opportunity to increase holdings in Bitcoin and stocks of publicly traded companies that hold Bitcoin.Compass Point analysts believe that Binance has sufficient liquidity to cover the funding gap, expecting that its excess USDT reserves, BTC reserves, and USDC funds are enough to cover the losses. However, the firm also warns that Binance's compensation to customers may put pressure on the supply of stablecoins and could drive users to shift from centralized exchanges to competing platforms such as Coinbase, Bullish, and Hyperliquid.

Trader Killa posted that the collapse of FTX marked the bottom of the market, and this Binance hacking incident may have a similar effect. He believes that the best way to recover losses is to drive prices significantly higher rather than further declines, and mentioned that Binance holds billions of dollars in Bitcoin, having the financial strength to initiate billions of dollars in long positions, which may not be directly observed by retail investors.Killa also speculated that Binance may have generated about $1 billion in revenue through liquidation, slippage, and trading fees. Although the market may take some time to digest the short-term impact of this incident, he remains optimistic about the medium to long-term trend of the crypto market.

The Financial Services Agency of Japan (FSA) released a commissioned research report on overseas financial regulatory systems, totaling 609 pages, authored by the Japanese law firm Atsumi & Sakai. The report covers eight countries and regions, including the United States, the United Kingdom, the European Union, China, and Hong Kong, aiming to provide references for Japan's financial system planning and legislation.The report focuses on outlining the regulatory systems for cryptocurrency exchanges, stablecoins, and the tokenization of real-world assets (RWA) in various regions, including the U.S. "GENIUS Act," the EU MiCA regulations, the UK's stablecoin regulatory framework, and China's regulations on virtual currencies and RWAs to be released in February 2026.The report points out that, according to current Chinese regulations, the issuance, trading, and related services of RWA tokenization within the country are generally prohibited, except for businesses that have obtained approval from the competent authorities and rely on specific financial infrastructures. Additionally, the report discusses Hong Kong's expansion of the scope of tokenized securities trading and related market regulatory arrangements.

Binance founder Zhao Changpeng stated that the recovery work for token assets seems to have begun.He added that users pay transaction fees in the currency they are trading when using Binance, so Binance will naturally accumulate various tokens that it lists.Zhao Changpeng also emphasized: "User funds are safe!"

Synthetix posted on platform X that the SNX stolen from Binance has been recovered by Synthetix protocolDAO and is currently stored in the protocolDAO multi-signature wallet, to be returned at Binance's request. Synthetix has notified Binance.On-chain data shows that Synthetix protocolDAO has returned approximately 8.41 million SNX from the attacker's address, valued at about 1.53 million USD.

According to a post by Binance, the platform has begun to recover affected assets for users and continues to work with law enforcement, asset issuers, blockchain intelligence companies, and industry partners to track, freeze, and recover more funds.Binance stated that the company has set aside over $6.34 billion to cover the losses caused by this incident, of which $5 billion is held in tokens that are identical to the affected assets. The remaining portion is being purchased through market channels and over-the-counter (OTC) channels to match the types of tokens for the remaining affected assets and to fill the asset gap. Due to the low liquidity of some tokens and the time required for OTC settlements, the related purchases may take a long time. The aforementioned amount does not include assets that have been frozen or are protected, as these assets are still being recovered and verified.Currently, $3 billion in assets have been frozen, and Binance is working with partners and law enforcement to recover the related assets. Binance stated that it will continue to use company resources to cover the confirmed funding gap and will publish more verified information as the recovery work progresses. Ultimately, all user funds will be verified through publicly available reserve proof.

Binance co-founder CZ and co-founder and Chief Customer Service Officer He Yi responded to the recent loss issues at Binance. CZ stated that previous analyses indicated that after USDT and USDC were frozen, Binance's total loss was approximately $1 billion, accounting for about 0.69% of its managed assets. He noted that the actual loss might be slightly higher than that figure, but Binance will bear it.He Yi replied that the company's annual revenue is sufficient to cover the losses, so there is no need to sell SpaceX shares for the time being. CZ then added that he did not mention selling SPCX shares, but merely listed some funding situations that might be known.

Binance founder Changpeng Zhao posted on the X platform that Binance suffered a hacker attack resulting in a loss of approximately 6 billion USD, of which 3 billion USD has been frozen, the SAFU fund is about 1 billion USD, and the remaining gap is about 2 billion USD.Changpeng Zhao stated that the SPCX stocks held by Binance are worth over 1 billion USD, which can cover most of the remaining gap, and the remaining part is still painful but manageable. This portion of the stocks comes from the 500 million USD that Binance invested when participating in Elon Musk's acquisition of Twitter. Changpeng Zhao previously mentioned that the actual loss might be slightly higher, but Binance will bear the responsibility.

Crypto KOL Crypto Brave (@cryptobraveHQ) analyzed that the loss from the Binance hack may be around 3 billion dollars, and Binance could earn back the stolen funds in less than a year.It cited estimates from third parties such as Forbes, stating that Binance's revenue for 2024 and 2025 is approximately between 16 billion to 17 billion dollars each year. Based on a profit margin of half (Coinbase's latest data is about 59%), the annual profit is around 8 billion to 8.5 billion dollars, making the 3 billion dollar loss roughly equivalent to more than half a year's profit.Based on the calculation of BNB destruction in 2025 being about 4.4 billion to 4.5 billion dollars, the 3 billion dollar loss is approximately equivalent to 8 to 9 months of destruction amount.

Bitcoin Core has discovered 3 new vulnerabilities, one of which allows attackers to remotely crash nodes. This vulnerability can affect nodes running Windows, macOS, or BSD by exhausting memory, while Linux nodes are not affected by this attack.Another vulnerability can gradually deplete node memory, and the third may corrupt blockchain rollback data.

According to CoinDesk, XRP Ledger developers are testing a new feature that aims to allow the creation of blockchain accounts with an initial balance of zero, with existing accounts bearing the reserve required for new accounts, thereby lowering the financial threshold for payment applications and automated software to create wallets on a large scale. This proposal was submitted on October 15 in the form of a SponsoredAccountCreate transaction proposal.According to current XRP Ledger rules, each account must reserve at least 1 XRP as a reserve, meaning that creating 100,000 independent accounts would require locking up 100,000 XRP. The new proposal intends for sponsored accounts to bear this reserve requirement, and a broader fee sponsorship mechanism in the future could also allow applications to pay transaction fees on behalf of users, but the overall reserve requirement for the network will not be eliminated. This feature is expected to lower the usage threshold for scenarios such as embedded wallets, RLUSD stablecoin payments, and AI agent automated payments.However, the related code is still under review, and the sponsorship mechanism it relies on has not yet gone live on the mainnet. As of October 19, the mechanism has only received 11 votes out of the 35 required validator votes, still falling short of the 29 votes needed for approval.

Bitcoin security expert Jameson Lopp stated that cyber attacks are growing along an "exponential" path. He pointed out that the number of vulnerabilities discovered in the past two and a half months has increased exponentially, with attackers being the first to adopt unreviewed AI models, and security researchers "failing to get adequate rest."Lopp explained that Bitcoin Core has adjusted its security policies because AI can discover vulnerabilities through simple prompts; security measures need to shift from annual audits to real-time defenses and be embedded in the development process. He also analyzed a PHP remote code execution vulnerability, believing the actual impact to be less than expected.Additionally, Lopp mentioned that Google's estimate of 500,000 quantum bits involves the difference between physical quantum bits and logical quantum bits; if the quantum threat time window is less than ten years, the industry will be at a disadvantage. Currently, there are only a few hundred available quantum bits, and quantum upgrades will take years due to Taproot, consensus rules, and untested cryptography. About 30% of addresses have exposed public keys, and attackers will prioritize targeting these addresses; unpatchable hardware issues and "wrench attacks" have exceeded 700 cases.

The Ethereum institutional privacy technology organization EthSystems announced the completion of formal verification for its privacy pool (shielded pool), ranging from written specifications to the bytecode running on the Sepolia test network. The verification used different tools in layers: models, circuits, and hashes with Lean; contracts with Halmos and Kontrol; wallets with Aeneas and Verus; and validators and deployment verified through byte-by-byte reconstruction.Double spending and value conservation have been verified by the Lean theorem prover. During the verification, a total of 6 issues were discovered, 3 of which were found in the verification tools themselves. The team also listed the assumptions that still rely on: hash collision resistance, validators rejecting forged proofs, and contract behavior being consistent with the model.

Balancer's official statement indicates that the team, while reviewing the DAO's own assets, also examined the historical asset positions of external users. They have currently identified over $500,000 in related assets and have notified the owners.Balancer pointed out that these assets mainly involve two types of situations that are easily overlooked by asset management dashboards: first, the buffered liquidity shares of Balancer v3 use an internal accounting mechanism within the Vault, which may not be displayed on blockchain explorers or platforms like DeBank; second, there may still be collectible partner rewards in the old v2 liquidity mining contracts, even if users have previously withdrawn their liquidity.

The International Criminal Police Organization stated that Operation Serengeti III took place from June 29 to August 31, 2026, across 21 countries, resulting in the arrest of 1,462 suspects, the dismantling of 10,909 malicious networks, and the recovery of over 105 million dollars in illegal funds. The investigation also confirmed that 65,929 victims were attacked by cybercrime gangs, with related losses exceeding 385 million dollars.This operation focused on combating online fraud, ransomware, business email compromise, online scams, and digital extortion. In specific cases, the Ugandan police dismantled two transnational fraud gangs and arrested 365 foreign nationals; Angola seized two illegal cryptocurrency mining centers, arrested 9 individuals, and confiscated over 2,000 mining machines; in Nigeria, another case involved over 2.4 million dollars in suspected criminal proceeds, a significant portion of which was laundered through cryptocurrency transactions.

Slow Fog released a threat intelligence report stating that they recently received user feedback about a GitHub repository named sol-live, which disguises itself as a Solidity interview practice project. However, it hides commands in the .vscode/settings.json file to download and execute remote scripts, which may trigger malicious payloads when users start the project with custom terminal configurations.Slow Fog's analysis shows that the related malicious payloads can collect browser login databases, wallet extension storage, and macOS Keychain files. They also have the capability to scan and upload local files, execute remote commands, provide interactive Shell access, and monitor the clipboard. In macOS and Linux environments, the malicious terminal configuration must be actively initiated by the user to execute; the attack chain on Windows has not been confirmed due to issues with quote handling.

Blockchain security company Socket discovered 16 counterfeit Rabby and OKX wallet extensions on the Firefox browser. According to Socket, Mozilla removed these extensions before October 5.Socket pointed out that removing these malicious extensions does not ensure the safety of wallet users whose mnemonic phrases have already been compromised.