ole

According to the improvement proposal (PIP) disclosed by the Polygon community forum, a member proposed to zero out approximately 70.49 million native POL (approximately 6.5 million USD at about 0.0924 USD on October 29) from the addresses on the blacklist through a hard fork of the Polygon PoS mainnet and transfer it to a designated recovery address. Among these, approximately 23.86 million are related to Polymarket, and approximately 46.63 million are related to Binance, with the total supply remaining unchanged.The proposal is scheduled to be introduced at the protocol governance meeting on November 5 at 22:30 Beijing time, with the activation block and client version to be determined.

Binance released an update on the progress of the security incident recovery, stating that approximately 98% of the affected assets have been replenished. Binance will continue to purchase the remaining token assets through market and over-the-counter trading channels. Due to the low liquidity of the remaining 2% of tokens, the purchase is expected to take some time.Binance stated that it will bear the full loss of the stolen funds from this incident and has reserved more than 100% of the total required assets from its own funds.Additionally, Binance completed a new round of reserve proof snapshots on November 4 at 8:00, expanding the number of tokens covered from 10 in the previous round to 44. The complete zero-knowledge proof is expected to take about 50 to 60 hours to generate, at which point users holding tokens within the coverage range can independently verify whether their account balances have at least 1:1 sufficient reserve support.

According to CoinDesk, the North Korean hacker group TraderTraitor is transferring the stolen funds from the $6.3 billion Binance hack through the decentralized cross-chain protocol THORChain, exchanging Ethereum for Bitcoin, which has driven the native token RUNE of THORChain to rise nearly 10% in the past 24 hours.The attackers first dispersed the stolen SOL across multiple wallets, exchanged it for USDC, and transferred it to the Ethereum network, then purchased ETH, and subsequently exchanged it for BTC through THORChain. Previously, the attackers had transferred some funds from the Tron network to THORChain. On-chain investigator SomaXBT estimates that as of November 1, the attackers have exchanged approximately $48.3 million through the protocol, ultimately receiving about $42.7 million, with fees and slippage losses of around 12%.The U.S. FBI has attributed the October 29 attack on Binance to TraderTraitor and has called on THORChain node operators and other crypto service providers to intercept related addresses and funds. Since BTC and ETH cannot be frozen by the issuer like USDT and USDC, cross-chain exchanges have increased the difficulty of recovering the stolen funds.Binance stated on Tuesday that it has frozen approximately $2.85 billion of the stolen funds and has covered about 98% of the affected tokens with company funds. On-chain analytics firm Elliptic believes that the stolen funds are currently still being transferred between different addresses and may not have been largely cashed out yet, with the attackers possibly planning to cash out in batches through over-the-counter trading channels.

On November 4, the head of the Binance Chinese community, Sisi, responded to the security incident at the end of October, stating that approximately $6.3 billion was transferred out of the Binance system, and the responsibility lies with Binance, not with any individual engineer or technical standard. She stated that the related losses would be compensated by the platform, and users could verify themselves on the reserve proof page; the frozen and intercepted portions would be recovered one by one in cooperation with law enforcement and on-chain institutions.Sisi mentioned that after the withdrawal was reopened, the platform focused on ensuring that every withdrawal was processed. She stated that the scale of withdrawals in the past two days was on the same level as the stolen amount, and every transaction had been fulfilled, with user assets remaining intact; the platform did not misappropriate user assets. She also stated that the company's decision-making body requested that the investigation report be unembellished and truthfully disclosed, with timelines, attack paths, malicious script operations, and internal shortcomings all included in the report.Sisi cited an FBI report stating that the adversary was a nation-state actor, and since the beginning of this year, Binance had intercepted 57 suspected attacks from the same source. She indicated that all intrusion points mentioned in the report had been blocked; as of November 3, the affected wallet system had been rebuilt in a new environment, internal AI tools had been rebuilt and permissions tightened, affected devices had been replaced, relevant credentials and tokens had been invalidated, and a comprehensive device security scan and wallet risk control upgrade had been completed. She also mentioned that some defensive lines would not be made public and that an independent third-party security agency had been hired for review, with the conclusions to be announced externally. Binance's preliminary investigation previously indicated that the incident involved assets of approximately $6.34 billion, with about $2.85 billion frozen or intercepted, and the losses would be borne by the platform.

The founder of the blockchain security company Slow Mist, Yu Xian, posted on the X platform stating that many people, after watching the disclosure of the theft process by Binance, believe that the involved engineer made basic mistakes and had excessive permissions.Yu Xian indicated that such incidents belong to Advanced Persistent Threats (APT), involving human exploitation, intelligence reconnaissance, evasion of malicious code, trust chain exploitation, targeted lateral poisoning, cloud environment penetration, risk control bypass, and 0-day vulnerabilities, among other aspects. One cannot only focus on the initial social engineering phase.

The cryptocurrency exchange platform Binance released a preliminary investigation report on a security incident, disclosing the attack process in which approximately $6.3 billion in assets were stolen. The report states that an engineer, referred to as Little A, from the wallet operations team, searched for and installed an AI programming tool in June 2026, downloading a tampered Homebrew installation package from the search results. After the security team discovered the anomaly, they replaced the relevant equipment, but Little A still exposed the wallet infrastructure permissions.The report indicates that the attacker continued to lurk thereafter. In September, the attacker contacted a software engineer, referred to as Little B, through a recruitment platform, posing as a project director, and conducted video interviews and social media interviews, sending a code repository as an assignment. Little B downloaded the repository to their work computer and set it up according to the instructions. One file of 3,414 bytes bypassed terminal security protections and used internal AI tools to find traces related to Little A.The report states that on October 30, the attacker logged into another employee, referred to as Little C's, computer and transferred $6.3 billion. Binance stated that approximately $6.34 billion in assets were affected, with about $2.85 billion frozen or intercepted, and the losses covered by the SAFU fund and company funds. As of October 31, 98% of the affected tokens have been replenished.

According to security company Salus, approximately 3,600 stolen Binance SOL flowed into the HitBTC hot wallet on November 3 at 16:51 Beijing time after being transferred through automated scripts and a peeling chain model via multiple paths.Salus stated that HitBTC had previously appeared in the fund transfer paths of major cryptocurrency theft cases; hackers often use nested services such as instant exchange services, small exchanges, and over-the-counter trading desks to transfer stolen funds.

According to Catcher Predict monitoring, the predicted market on Polymarket for the event "Rolex Paris Masters: Novak Djokovic vs. Valentin Vacherot" shows that the option "Novak Djokovic" in the sub-market "Rolex Paris Masters: Novak Djokovic vs. Valentin Vacherot" has experienced a dramatic fluctuation in winning probability, soaring from 32.5% an hour ago to the current 84.6% (a fluctuation of 52.1%). Please note the impact of relevant breaking news.

According to Cointelegraph, Kraken has restricted accounts related to a suspected theft of over $133 million in cryptocurrency assets involving an unnamed institution in Europe, and is cooperating with law enforcement to recover the funds. Kraken stated that this incident did not originate from its platform, its security systems were not breached, and customer accounts were not compromised.Previously, on-chain investigator ZachXBT discovered that the suspected stolen amount increased by an additional $27 million from the previously disclosed $106 million. Bitquery data shows that approximately $62.98 million in stablecoins was exchanged for 27,553 ETH within about 4 hours. Kraken, Crypto.com, and OKX have all been reported to be involved in the related fund flows, with Crypto.com taking measures to prevent the related funds from being transferred through its platform, while OKX stated that it is investigating.As of the reporting time, approximately $78.3 million remains in wallets associated with the attackers, while about $30.5 million has been transferred out. The identity of the victims and ZachXBT's speculation about a large financial institution in Western Europe being attacked and attempting to cover up the incident have not been confirmed.

According to Bloomberg, citing informed sources, Binance holds Directors and Officers (D&O) liability insurance to address claims against executives from regulatory investigations or lawsuits, but like most cryptocurrency companies, Binance has been unable to obtain cyber insurance. Cyber insurance in the cryptocurrency sector is considered nearly impossible to acquire.Additionally, Binance's Secure Asset Fund for Users (SAFU) has no external insurance or reinsurance support. Even if some companies seek compensation through crypto, crime, or D&O policies, these policies typically contain numerous denial clauses.

Binance founder Zhao Changpeng added regarding the platform's recovery progress that there is one point that has not been mentioned before, which people might not even think of. Binance did not borrow money, did not sell assets, and did not raise funds; it completely used its own balance sheet to cover the stolen losses, which is different from other events that people have been trying to compare it to.

According to Bloomberg, after Binance experienced a record $6.3 billion hack, it has increased incentives for some market makers trading on the platform to boost trading activity. Sources familiar with the matter revealed that shortly after the security breach, the company reached out to smaller trading firms to offer higher commissions in the spot and futures markets.Sources indicated that during this week-long initiative, so-called level 2 and level 3 market makers would receive the same commission rates as level 4 participants, which is the highest tier on the platform. The sources added that these changes are aimed at providing greater financial incentives for smaller liquidity providers to quote on the trading platform and maintain a deeper order book.According to information on its website, Binance primarily categorizes market makers into different tiers based on the liquidity they provide, with companies offering larger trading volumes qualifying for higher tiers, typically receiving larger commissions, thereby reducing their trading costs. A Binance spokesperson stated that the latest measures following the security breach help to calm the market and noted that, just as prioritizing clear communication is important, the company took immediate action to maintain its core competitive advantage in liquidity. According to data from Talos, within 24 hours after the hack, the depth of the Bitcoin order book on Binance dropped by about 30%, with the depth within a 1% price range falling from $45 million to $32 million.

On November 2, stablecoin issuer Tether announced that it froze over 1.5 billion USDT within 30 minutes after Binance was attacked on October 29, preventing the related funds from being transferred, exchanged, or laundered. Tether stated that the FBI has identified North Korea as responsible for this attack. The FBI reported on October 31 that North Korea stole over 6 billion dollars in virtual assets from Binance around October 29, referring to the activity as TraderTraitor.Tether CEO Paolo Ardoino stated that the team froze over 1.5 billion dollars within minutes of the attack and claimed that USDT is not suitable for hiding stolen funds. Tether USA₮ CEO Bo Hines stated that the company acted immediately to prevent over 1.5 billion dollars from flowing to the attackers and said that this move contributes to safety in the U.S. and globally. Tether claimed that it collaborates with U.S. and international law enforcement agencies and industry partners to track illegal funds and assist in accountability.Tether also disclosed that as of October 31, it has assisted the U.S. Department of Justice, Secret Service, and FBI in freezing over 3,590 wallets, approximately 1.6 billion dollars in USDT, and has collaborated with over 360 law enforcement agencies in 73 countries. Including the freezes related to this Binance incident, Tether has cumulatively frozen over 7 billion dollars in USDT across secondary market addresses, of which approximately 1.2 billion dollars has been returned to rightful owners or law enforcement agencies through reissuance.

According to Onchain Lens monitoring, one of the oldest arbitrage bots on Solana, King, has accumulated a PnL of 7.2 million dollars, with approximately 786,000 dollars in assets stolen, including 4,260 WSOL, 191 SOL, and 366,000 dollars in stablecoins.The draining address is BHRayETPjvgg3BCr9H82V1D6NRwxu5v44JAaVuaod3jU, the forwarding address is Ddmy5oM8xtTs1EBC6eF2SZwQfBreewQpFgtUDm51Hkqj, and the victim address is 7dGrdJRYtsNR8UYxZ3TnifXGjGc9eRYLq9sELwYpuuUu.

According to official news, to prevent stolen funds from Binance from flowing through its protocol, Relay has taken measures that have resulted in some transactions and routing being paused or delayed, and users do not need to take action.Relay stated that the team is using multi-layer risk and compliance screening measures to block addresses related to hackers and is collaborating with Binance, law enforcement agencies, and ecosystem security teams. Due to ongoing work, the information that can be disclosed is limited.

OKX founder Star stated that following the recent security incident at Binance, the OKX team is tracking the stolen funds, identifying suspicious addresses and transactions, and taking available measures to prevent money laundering through the OKX exchange or Web3 DEX aggregators.He mentioned that the team is also assessing the potential impact of the incident on the market, strengthening risk control if necessary, and preparing for liquidity shocks or chain liquidations; at the same time, they are studying attack methods, software development supply chain, and AI programming agent-related risks, and reviewing internal controls, access management, wallet infrastructure, and security architecture.Star emphasized that OKX has not been breached due to this incident and cannot guarantee absolute security or immunity from attacks.

According to monitoring by Lookonchain, a certain entity in the European Union is suspected of having over $106 million in cryptocurrency assets stolen. The related address previously spent $62.97 million on purchasing 27,553 ETH, with an average purchase price of $2,286.On-chain investigator ZachXBT previously stated that the entity is suspected of losing assets from multiple centralized exchange accounts, with the involved funds withdrawn in the form of USDC and USDT. The fund flow chart disclosed by Lookonchain connects the aforementioned purchase address with addresses related to this incident.

On-chain detective ZachXBT issued a community alert based on personal judgment, stating that a certain EU entity was suspected to have been attacked on November 1, with multiple centralized exchange accounts being hacked, resulting in losses exceeding $106 million. The attacker withdrew the stolen funds in the form of USDC and USDT.Monitoring has shown that in the past 24 hours, the attacker has continuously exchanged USDC for ETH and transferred it to instant exchange platforms such as WellWallet and Kyrrex, then converted the funds into Monero (XMR) through Wagyu, while also utilizing cross-chain bridges to transfer funds across multiple blockchain networks. ZachXBT disclosed 11 involved addresses and reminded the community to pay attention to the relevant flow of funds.

Blockchain analysis firm Elliptic reported that as of November 2, 15:30 Beijing time, approximately $3.24 billion of the stolen assets from Binance remain in related addresses, primarily in ETH and BTC; about $2.85 billion has been frozen or seized.Elliptic stated that money laundering activities involved approximately 12,000 wallets across 11 blockchains and over 40,000 transactions in less than four days.As of 14:02 on the same day, approximately 28 BTC had been mixed through 18 CoinJoin transactions. The firm believes that only a very small amount of funds may have been liquidated so far, and on-chain indicators show that the fund transfers used conventional automation, but there is no evidence that AI agents were involved in decision-making.

Bitcoin dual-staking protocol b14g announced recovery progress, stating that the Core network executed a hard fork today, transferring and recovering 68,146,177.22 CORE from three addresses controlled by attackers through a one-time on-chain state adjustment, which accounts for 70.2% of the 97,045,563 affected CORE from the incident on October 31.This operation did not roll back transactions, mint new tokens, or change the total supply of CORE. The recovered tokens have not yet been allocated to affected users, and the related funds held or frozen by exchanges have not been returned. b14g stated that they are still verifying balances and formulating a distribution plan, and there is currently no official claims process.