Binance reports $6.34 billion hack recovery

Binance said it has replenished 98% of digital assets affected by an attack that it estimates involved about $6.34 billion in unauthorized transfers, while freezing or intercepting roughly $2.85 billion. The exchange said it had reserved more than the full amount needed to reimburse users as of Nov. 3, leaving purchases of lower-liquidity tokens as the main remaining task.

The reported breach places renewed focus on the operational risk surrounding exchange hot wallets: internet-connected wallets used to process deposits, withdrawals and trading activity. Binance said the attacker gained access to an internal wallet-signing service and initiated transfers outside normal withdrawal procedures.

According to Binance's incident report, the attacker also used Ethereum's EIP-7702 authorization mechanism to obtain limited execution rights over hot wallets. EIP-7702 is designed to let externally owned Ethereum accounts temporarily delegate certain functions to smart-contract code. Binance said the authorization feature was misused as part of the attack chain.

The final unauthorized transaction involved 2,961.9 ETH and was confirmed on-chain at 23:56 UTC on Oct. 29, Binance said. Earlier transfers included 233.46 million XRP, approximately 970,500 SOL, 44.2 million OP and 18,270 BTC from Binance hot wallets.

Fake job interview led to internal access

Binance attributed the intrusion to several linked failures rather than a single vulnerability. The exchange said an attacker used a fake job interview to persuade an employee to download malicious code, creating an entry point into devices and internal tools connected to wallet infrastructure.

The reported chain also included a supply-chain compromise, social engineering, malware, misuse of transaction authorization features and exploitation of internal artificial-intelligence tools. The combination illustrates how a security breach can move from an employee endpoint into systems with authority over wallet operations, even where direct controls around withdrawals are in place.

Binance said it has rebuilt affected wallet systems and internal AI tools, replaced devices connected to the breach, revoked credentials and access tokens, and strengthened wallet-risk controls. It also said it will commission an independent cybersecurity review while withholding some technical details during the continuing investigation.

The scale of the incident could intensify scrutiny of the division between hot-wallet balances and cold storage, where private keys are kept offline. South Korea's Financial Services Commission convened an emergency security meeting with major exchanges and custodians on Nov. 2 to discuss raising required cold-wallet custody levels.

South Korea's Virtual Asset User Protection Act currently requires platforms to hold at least 80% of customer assets in cold wallets. The meeting considered a level closer to 99%, a ratio already reported by some major domestic platforms. Upbit reportedly keeps more than 99% in cold storage, compared with about 94% at Bithumb, roughly 85% at Coinone and slightly above 80% at GOPAX.

Stablecoin balances declined during market stress

CryptoQuant analyst Darkfost reported that total stablecoin market capitalization fell from about $280 billion in April to about $263 billion over the past six months, a decline of approximately $17 billion, or 6%. The figures point to a reduction in stablecoin liquidity across the market rather than fresh issuance offsetting redemptions.

Darkfost also estimated that Binance represented roughly 70% of stablecoins held on centralized exchanges. The analyst said Binance's 90-day moving average stablecoin balance fell from $51 billion to $34 billion, while around $3 billion in stablecoins left the platform following the hack.

DeFiLlama data cited for Nov. 3 showed Binance recording about $1.6 billion in 24-hour net inflows after an earlier peak outflow of roughly $7 billion. Total assets on the platform stood near $127.7 billion, according to the data. The reversal suggests that at least some funds returned after the initial wave of withdrawals, though it does not settle questions about how customers will respond once the incident review is complete.

Bitcoin traded near $76,990, about 5.2% above its 200-day moving average of approximately $73,169. The level has become a closely watched technical reference after Bitcoin traded materially below its 200-day average during prior U.S. midterm election years, by about 35% in 2014, 9% in 2018 and 22% in 2022.

CFTC opens regulated route for stock perpetuals

In the United States, the Commodity Futures Trading Commission approved perpetual futures contracts tied to individual U.S. stocks, allowing the products to list on regulated domestic exchanges for the first time.

Perpetual futures differ from conventional futures because they do not have an expiry date. Single-stock versions would give market participants a regulated venue to take leveraged long or short positions on individual listed companies, while adding a product structure more commonly associated with offshore crypto derivatives markets to U.S. stock-linked trading.

Elsewhere, Justin Sun said his lawyers asked a U.S. federal court to sanction World Liberty Financial and its attorneys over disclosures involving citizenship and ownership information that emerged months into litigation. Sun said he had accumulated $45 million in WLFI tokens before filing a fraud lawsuit in April and seeking a freeze on the tokens.

Hong Kong advances tokenized fund plans

Hong Kong's Securities and Futures Commission said it plans to create an Innovation Pathway and is considering tokenized gold ETFs as a future pilot. The initiative follows the start of secondary trading in tokenized money-market funds on licensed platforms.

The regulator said Hong Kong now has 17 approved tokenized retail products with combined assets under management of $1.3 billion. A tokenized gold ETF could extend the program from cash-like fund products into an asset class that attracts demand during periods of market uncertainty, while keeping issuance and trading within licensed channels.

Bullish, meanwhile, said it selected Solana, Aptos and Ethereum as its initial networks for tokenized stock issuance, with Solana scheduled to launch first. The company and Equiniti demonstrated a transfer of 61 million tokenized Bullish reserved shares on Solana at the New York Stock Exchange on Oct. 27.

The demonstration was linked to Bullish's planned acquisition of Equiniti, which is expected to close in January 2027 subject to regulatory approval. The test signals an effort to connect established share-administration infrastructure with public blockchain settlement rather than treating tokenized shares as a separate, crypto-only market.