Issue #018 · Week of November 01, 2026

This Week’s Verdict

The largest crypto hack in history ran on a stolen laptop and an Ethereum feature barely six months old. Everyone spent the week arguing about decentralization while Tether, Circle, and Ripple quietly froze over $2.7 billion using the centralized controls this industry claims it doesn’t need. If the lesson surprises you, you have not been reading.

The Breaches

Binance lost roughly $6.3 billion (some count it at $6.4 billion), making this the largest exchange heist on record, dwarfing Bybit’s $1.46 billion from early 2025. The entry point, per co-CEO Richard Teng, was a compromised developer laptop that gave attackers access to hot-wallet signing infrastructure. From there they used an EIP-7702 delegation to bypass Binance’s normal approval controls, then deployed a self-destruct mechanism to destroy tools and traces on the way out. Binance set aside $6.34 billion of company funds, moved 7,499 BTC from its SAFU fund, claims roughly 90-95% replenishment, and began phased withdrawals November 1 starting with bitcoin. A full Proof of Reserves report was promised by November 3.

The attacker’s laundering race was the real story onchain. They converted stablecoins to ETH on Uniswap and other DEXs to escape freezes, and posted stablecoins as collateral to borrow Ether. Chainalysis flagged a JustLend receipt-token route (USDT in, jUSDT out, redeemed elsewhere) and a Tron protocol used to dodge stablecoin freezes. Tether and Circle froze more than $2 billion between them (Circle alone froze $823 million), and Arbitrum’s Security Council used emergency powers to move funds.

Elsewhere, the collateral damage spread. An attacker drained about $437,000 from Premia vaults, routing collateral through option pools before withdrawing it as liquidity. b14g, a Bitcoin staking protocol on Core, reported 97 million CORE drained and paused contracts (exchanges froze about 9 million CORE; staked BTC was unaffected). And a dozen DeFi front ends registered through Name.com were hijacked, stealing about $138,000 via a suspected registrar compromise.

Vulnerabilities Worth Your Attention

  • EIP-7702 is now a known attack surface. The same upgrade that enables batched and sponsored transactions let Binance’s attacker route around wallet controls. An Ethereum draft would let wallets permanently disable EIP-7702 delegation, though it explicitly does not protect funds from a stolen private key.
  • Polymarket’s supply chain cracked. Hackers hijacked a DebugBear page-speed script loaded from an outside vendor, sold signed-in traders’ positions, and moved roughly $2.7 million (about $2.64 million reached attacker wallets). Polymarket is refunding 726 affected wallets.
  • Critical Linux kernel flaw in MPTCP, exploited by Anthropic researchers for unauthenticated remote root. Intersect urged Cardano operators to patch; fixes were mid-rollout. A CVSS 10.0 flaw in Canonical’s LXD and MicroCloud lets attackers impersonate trusted clients without a private key.
  • A ChatGPT bug-bounty save: a malicious share link could run attacker code in a victim’s logged-in session and read private chats. OpenAI rated it P1 and fixed it in eight days.
  • Hardware wallet supply chain, again. Trezor warned of a suspected crypto-theft implant in a Trezor Safe 5 sold through reseller CryptoBilis in Southeast Asia.

Threat Actors & Campaigns

The FBI, Secret Service, and IRS-CI officially attributed the Binance heist to TraderTraitor, the North Korea-aligned crew also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The bureau is asking the DeFi community to block known BTC, ETH, and SOL addresses and is seeking private-sector help to choke the laundering trail. DPRK’s playbook here is unchanged: compromise a developer, reach signing infrastructure, move fast before the freezes land.

Chainalysis, the firm tracking the Binance funds, disclosed its own breach the same week. An external actor used “offensive agentic techniques” to access internal tools and exposed customer names, emails, user IDs, and roles, though the firm says investigation content, credentials, and session tokens were untouched. Agentic tooling also showed up elsewhere: China-based Vapor Panda deployed an AI-powered pentest framework called ARTEX against 200-plus organizations, and a malicious Claude Code extension on Cursor’s marketplace planted SSH backdoors for roughly 11 hours, exposing up to 5,000 developers.

The Bigger Picture

The centralization paradox is now impossible to ignore: the same controls that made a single-laptop breach catastrophic also clawed back roughly $3 billion. CertiK puts 2026 crypto losses at a record $9.2 billion, with $3.03 billion frozen or returned in October alone. Markets took it in stride, which is the part worth noting. Bitcoin fell about 3% against the 11% it dropped during Binance’s 2018 breach, hovering near $77,000 amid a broader tech selloff. Wall Street shops (Cantor Fitzgerald, TD Cowen, Compass Point) called it a Binance failure, not a crypto-wide one, and told clients to buy proxies like Coinbase, Robinhood, and Strategy on weakness. One Nasdaq-listed holder may sell $450 million in bitcoin, citing the hack and quantum fears.

On regulation, the hack became an instant talking point. CFTC chair Michael Selig argued offshore exchanges should register with the CFTC and adopt US-grade cybersecurity standards; Trump said the administration is “looking into” it as calls for legislation grew. All of this lands days before the November 3 election, where crypto PACs made a late Republican push and Sherrod Brown’s Ohio edge threatens a rougher 2027. Meanwhile Tether reported a $1.5 billion Q3 operating profit on a nearly $8 billion reserve buffer, a reminder that the freeze button and the balance sheet increasingly belong to the same few players. By the time it is news, it is already priced in.

Resources

  • https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html
  • https://decrypt.co/382237/binance-sets-aside-6-34b-to-cover-hack-losses-ceo-says-your-assets-are-safe
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.