Author: Westen

Update, Oct. 31: Binance now says the full proof-of-reserves results are expected by Tuesday, Nov. 3, not Monday, and that about 90% of stolen assets have been replaced. Read the latest.

Binance said Friday afternoon it has already covered about 80% of the roughly $6.3 billion lost in Thursday’s hot-wallet compromise, and set out a timetable for reopening withdrawals in stages.

In “Security Incident Update #2,” posted at about 4 PM ET and signed by co-CEOs Yi He and Richard Teng, the exchange said it has set aside more than $6.34 billion in company funds, including $5 billion held in the exact tokens that were taken, such as USDC, USDT, BTC, ETH and BNB. It is buying the remaining assets through market and OTC channels. The loss estimate is unchanged, and about $3 billion has been frozen on-chain with partners.

The update dates the compromise to about 20:05 UTC on Oct. 29, or 4:05 PM ET.

Key timelines Binance gave:

• Withdrawals: a phased restart targeted to begin within about 34 hours, which would be early Sunday ET, subject to security checks.
• Proof of reserves: an initial snapshot in about 12 hours, with results ready by Monday, Nov. 2.
• Technical findings: further detail expected within about 48 hours, with a full post-mortem to follow.

Binance repeated that early findings pointed to a compromised laptop but said later work had “uncovered additional points of breach.” It said it has found no evidence that wallet private keys were leaked.

Binance still hasn’t named the attacker. Chainalysis has attributed the theft to North Korea’s TraderTraitor, but no government agency has made an official attribution.

Washington is also weighing in. CFTC Chairman Michael Selig said Friday on CNBC’s “Squawk on the Street” that the hack “proves our exact point” and that he wants a voluntary federal registration option for offshore exchanges, with U.S.-style cybersecurity safeguards; making it mandatory would require Congress. He said the CFTC will assist law enforcement. His remarks were commentary on the agency’s Oct. 5 advance notice of proposed rulemaking, which has a Dec. 14 comment deadline, not action against Binance.

Markets were steady into the evening. At about 5:50 PM ET CoinGecko showed BTC at $76,725 (down 3.1% over 24 hours), ETH at $2,237 (down 1.7%) and BNB at $697 (down 1.2%).

All of these are company targets, not confirmed outcomes. Binance’s own support account says withdrawals resume only “as soon as the security issue is fully resolved.”

Sources: Binance, Binance co-CEO Richard Teng (X), Chainalysis, CNBC, CFTC, Federal Register, CoinGecko

Binance co-CEO Richard Teng said Friday the exchange hopes to resume customer withdrawals by Sunday, Nov. 1, and will publish a full proof-of-reserves report by Monday, Nov. 2, with an initial view possibly sooner.

In a video statement posted on X at about 10:30 a.m. ET, Teng said the withdrawal service is being rebuilt and will not be switched back on until it “passes rigorous testing,” which he said is on track to finish within about 40 hours. That is a target, not a confirmed reopening time. Deposits are operating normally, according to Binance’s updated incident notice.

Teng also gave new detail on how the attack worked. He said the attacker used Ethereum’s EIP-7702 account-delegation feature to gain execution approval over a Binance hot wallet without going through the company’s normal approval controls, and used a “self-destruct” mechanism to erase tools and traces. He said more than one person was involved and that investigators have found additional points of breach but have not yet pieced together the full sequence. A formal technical post-mortem has not been published.

The headline figures are unchanged. Binance says it has reserved more than $6.34 billion of company funds, $5 billion of it already in the same tokens that were taken, and is buying the rest through market and over-the-counter channels. About $3 billion has been frozen on-chain, and Binance said it has “begun recovering” assets.

U.S. authorities are now involved. The FBI said it is “aware of the incident,” and the Secret Service said it is working with the U.S. Attorney’s Office for the District of Columbia to trace and recover funds, BBC News reported. No agency has publicly named a culprit; Chainalysis has attributed the attack to North Korea’s TraderTraitor group.

Bitcoin was near $77,180 at 1:53 p.m. ET, down about 4% over 24 hours, per CoinGecko. Ether was near $2,240, and BNB near $701, down about 6%.

Sources: Binance, BBC News, CoinDesk, Chainalysis, CoinGecko

Binance, the world’s biggest crypto exchange, says it was hit by a security breach on Thursday afternoon and has set aside more than $6.3 billion to cover it. If that figure holds, it would be the largest crypto theft on record, roughly four times the $1.5 billion taken from Bybit in February 2025.

According to Binance’s incident notice, the attack may have started with a compromised laptop belonging to a DevOps engineer. That access let the attacker reach an internal service and submit withdrawals Binance did not authorize. The exchange said it found no evidence that wallet private keys leaked. In an update early Friday, it said further investigation had “uncovered additional points of breach,” without giving details.

What Binance has committed to. Binance says it will cover all losses from its SAFU emergency fund and company money, and that user funds are safe. In a post on X Friday morning, it said it has reserved more than $6.34 billion for the incident. About $5 billion of that is already held in the same tokens that were taken, and it is buying the rest through market and over-the-counter channels. Binance also says about $3 billion has been frozen with help from stablecoin issuers and other partners. Tether’s chief executive, Paolo Ardoino, said Tether alone froze more than 1.567 billion USDT.

What customers can do now. Withdrawals are suspended. Binance said Friday it is on track to resume them in about 45 hours. Deposits remain unaffected, the company said, though an earlier Binance post had said both deposits and withdrawals were paused. Binance has promised a technical post-mortem and an updated proof of reserves once the fix is done. Neither has been published yet.

Who is behind it. Chainalysis puts the theft at about $6.4 billion and attributes it to TraderTraitor, a North Korean hacking group. Binance dates the start of the compromise to about 4:05 p.m. ET Thursday. TRM Labs said the attack resembles past North Korea-linked incidents. Binance has not named a culprit.

Market reaction. Bitcoin traded near $77,450 at 8:15 a.m. ET Friday, down about 3% over 24 hours, according to CoinGecko. Ether was near $2,238, down about 3.6%, and Binance’s own BNB token was near $700, down about 5%. U.S. spot bitcoin ETFs took in a net $17.2 million on Thursday, while ether ETFs lost $105.5 million, according to Farside Investors. That trading closed before the breach began.

For cautious holders, the practical points are simple. Binance’s pledge is a company promise, not an insured guarantee, and the proof will come when withdrawals reopen and new reserve data is posted. Use only official Binance channels, since fake “refund” and support accounts often follow incidents like this.

Sources: Binance, Binance on X, Paolo Ardoino on X, Chainalysis, BBC News, CoinGecko, Farside Investors.

Polymarket put its international exchange into cancel-only mode on Thursday afternoon after users reported funds leaving their accounts without their permission. The company later said one of its outside providers had been compromised.

Polymarket’s status page posted its first notice at 2:05 p.m. ET: “The exchange is currently in cancel-only mode and relayer actions paused while we investigate an incident.” In cancel-only mode, traders can pull open orders but can’t place new ones. Relayers are the services that submit users’ signed transactions to the blockchain.

At 2:33 p.m. ET, the company’s Polymarket Traders account on X said: “We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole.” The status page carried the same statement and added that “out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online.”

At 2:54 p.m. ET it said trading would resume at about 3 p.m. Six minutes later it posted: “Trading is now fully back online. We’ll make this right and are fully reimbursing all affected traders.” The status page marked the incident resolved at 3:05 p.m. ET, about an hour after the first notice.

What hasn’t been confirmed

• The amount. Polymarket hasn’t published a loss figure, and a representative declined to comment on one to NBC News. The Block and Decrypt, citing Arkham data, reported that a wallet identified as the suspected attacker’s held about $2.65 million in POL after a series of swaps out of USDC.e. That is a wallet balance, not a confirmed tally of losses. The Wall Street Journal, as cited by Quartz, counted more than $2.5 million taken from user accounts in over 900 transactions. Two analytics firms, Betting Intelligence and Polysights, told CNBC that at least $2.7 million was withdrawn across 710 wallets.
• The provider. Polymarket hasn’t named it.
• Who was affected. The company hasn’t said how many traders were hit. Its statements refer only to Polymarket.com, its international platform, and CNBC reported that the U.S. platform was not compromised.

Polymarket hasn’t said when reimbursements will be paid or how they will be calculated.

This isn’t the platform’s first vendor-related incident. In June, Polymarket said a third-party vendor had been compromised and promised to refund affected users, according to CNBC and Decrypt.

The outage came five days before the U.S. midterm elections on Nov. 3, when Polymarket’s international and U.S. exchanges are both expected to see heavier trading.

Sources: Polymarket status page; Polymarket Traders on X; The Block; Decrypt; CNBC; NBC News; Quartz

Bitcoin traded near $80,000 on Thursday morning, down about 1% over 24 hours, after the Federal Reserve left rates unchanged but showed a split over whether to raise them.

The Fed held its federal funds target range at 3.75% to 4.00% on Wednesday. The vote was 10–2. According to the Fed’s statement, Governor Lisa D. Cook and Cleveland Fed President Beth M. Hammack dissented. Both wanted a quarter-point increase at this meeting.

The statement said economic activity “is expanding at a strong pace” and that inflation “remains elevated.” It did not commit to a next move. “The accumulation of more information will help the Committee determine the policy stance appropriate,” it said.

Chair Kevin Warsh echoed that at his press conference. “The information we receive over the coming period will help us determine where we want policy to be,” he said, according to the Fed’s preliminary transcript.

What markets are pricing. Futures still point to a December hike. Investing.com, citing CME FedWatch, put the chance of a quarter-point increase at 79.8% on Thursday, up from 73.4% a week earlier. These readings move through the day and are not forecasts. The next meeting is Dec. 8–9, per the Fed’s calendar.

The 10-year Treasury yield was about 5.01% early Thursday, CoinDesk reported, after briefly pushing above 5% following the meeting.

Crypto reaction. CoinGecko showed BTC at $80,049 at 8:13 a.m. ET, down 1.1% over 24 hours, and ether at $2,321, down 1.1%. CoinDesk said bitcoin dipped to about $79,600 overnight. It tied the move partly to a slide in tech stocks after Alphabet and Samsung earnings, with Nasdaq-100 futures down about 1.1%.

Fund flows were steadier. U.S. spot bitcoin ETFs took in a net $137.3 million on Wednesday, the third straight day of inflows, according to Farside Investors. Almost all of it went to BlackRock’s IBIT. Spot ether ETFs saw net outflows of $21.4 million.

What’s next. The Commerce Department’s September PCE report, the Fed’s preferred inflation gauge, is due Thursday. The October jobs report follows Nov. 6, then October consumer prices on Nov. 10, Decrypt reported. With policy now tied to incoming data, those releases may matter more for crypto than anything said on Wednesday.

Sources: Federal Reserve, Federal Reserve press conference transcript, CoinDesk, Investing.com, Farside Investors, CoinGecko, Decrypt.

Ripple’s dollar stablecoin, RLUSD, is now on Coinbase, the largest U.S. crypto exchange. Ripple and Coinbase announced the partnership on Wednesday, Oct. 28, the main day of Ripple’s Swell conference in New York.

According to Ripple’s announcement, retail and institutional customers can trade and manage RLUSD starting today through the Coinbase app, Coinbase Exchange and Coinbase Prime. Customers can convert U.S. dollars and other supported dollar stablecoins into RLUSD at a 1:1 rate. Deposits and withdrawals work on three networks: the XRP Ledger, Base and Ethereum. Ripple says it will provide liquidity on Base. Coinbase and Coinbase Institutional confirmed the listing.

Not everything is live yet. Ripple says access for Coinbase’s international exchange customers, including using RLUSD as collateral, “will follow.” No date was given.

The listing came hours after a credit rating. On Tuesday, Moody’s Ratings assigned RLUSD an A2 long-term and P-1 short-term deposit rating, both investment grade, as The Block and Decrypt reported and Ripple’s Jack McDonald confirmed. Moody’s pointed to reserves held mostly in Treasury bills, other short-term U.S. government assets and cash, largely with custodian BNY, and a 103% reserve coverage target. The ratings were requested by the issuer.

Moody’s also flagged limits. Per Decrypt, the issuer, Standard Custody & Trust Company, is not bankruptcy-remote, and RLUSD holders don’t currently have a direct ownership interest in the reserves. Moody’s said the GENIUS Act, due to take effect in 2027, will shield required reserves from an issuer’s bankruptcy estate.

Ripple says RLUSD has passed $2.4 billion in market value since it launched in December 2024. Ripple’s McDonald and Coinbase Institutional co-CEO Brett Tejpaul are scheduled to discuss the deal on the Swell stage at 4:45 p.m. ET today.

XRP was about $1.31 on Wednesday afternoon, down about 0.7% over 24 hours, per CoinGecko.

The Depository Trust & Clearing Corporation says its Tokenization Service is now live. As of Wednesday morning, DTCC’s product page lists 34 securities available to tokenize at launch.

What it does. The service lets eligible DTC participants convert certain securities they already hold at DTC into tokens. According to DTCC, each token is backed one-for-one by the security held at DTC, keeps the same CUSIP identifier, and carries the same legal rights and economic interests as the underlying security. Tokens can move between DTC-registered wallets around the clock, but only within the same network.

What it doesn’t do. This is not a new market open to retail investors, and it is not a public token sale. DTCC describes it as a voluntary service for DTC participants. It operates under a Securities and Exchange Commission no-action letter issued in December 2025, which covers a three-year authorization period. DTCC also says built-in token controls support compliance and near real-time ownership tracking.

Scale, in context. DTCC’s page puts assets under custody at DTC at about $30 trillion. That is the pool the service draws from, not the amount tokenized. The launch list of 34 securities is a small starting set, and DTCC has not published usage figures.

Which networks. DTCC’s Day 1 tear sheet, dated Oct. 23, lists Canton and DTCC’s private Besu network as live at launch. It shows Stellar and Circle’s Arc as “anticipated in 2027” and calls the roadmap “indicative and subject to change.” Wallet providers shown on DTCC’s page include BitGo, Blockdaemon, Fireblocks, HashKey, Kaleido, Talos and Tradeweb.

Stellar’s week. Separately, Securitize said Wednesday it plans to integrate the Stellar network, which it called its 17th supported network. It gave no timeline and named no first products. On Tuesday, Janus Henderson and Centrifuge launched JQQQ, a Nasdaq-100 fund issued on Stellar for non-U.S. professional investors; as of Tuesday afternoon, Centrifuge’s fund page said it was still “seeding” and not yet open for investment. Neither announcement is connected to DTCC’s service.

What to watch. How quickly the list grows beyond 34 securities, how much participants actually tokenize, and whether the 2027 network additions hold to schedule.

Sources: DTCC, DTCC tear sheet, Securitize (PR Newswire), Janus Henderson, Centrifuge, CoinDesk.

Ripple opened its Swell conference in New York on Tuesday, Oct. 27, with two expanded partnerships announced the same morning: one with BNY, and one with Robinhood. Both rest on Ripple’s dollar stablecoin, RLUSD, and on the XRP Ledger. Neither release discloses a deal size.

The news follows Monday’s final OCC approval for Ripple National Trust Bank, which will manage RLUSD’s reserves. That trust charter takes no deposits, makes no loans, has no FDIC insurance, and has no opening date yet.

BNY: custody for XRP and RLUSD

• BNY’s Digital Asset Custody platform now supports XRP and RLUSD for eligible institutional clients, the companies said in a Business Wire release.
• BNY was already the primary reserve custodian for RLUSD and holds assets for Ripple Prime. The expansion adds client custody of the tokens themselves, not only of the dollar reserves behind the stablecoin.
• BNY and Ripple say they intend to let BNY clients mint and redeem RLUSD directly through BNY. The release marks that step with an asterisk as a future plan. It is not live, and no launch date was given.
• BNY also intends to broaden support for tokenized assets issued on the XRP Ledger as use cases develop.

“We’re moving past the initial issuance of assets onchain – now, it’s all about making these tokenized assets usable for payments and collateral across financial markets,” Ripple President Monica Long said.

Trade finance: exploratory with BNY, waitlist with C2FO

Ripple and BNY also said they intend to advance tokenized trade finance on the XRP Ledger, “subject to client requirements.” As a first step, they are exploring a supply-chain finance initiative with C2FO, a working-capital platform. That work is exploratory, not a live book of business.

Separately, C2FO plans to settle Instant Pay supplier payments on the XRP Ledger in RLUSD, in seconds rather than days, and is taking sign-ups through a waitlist. The release does not say Instant Pay is live.

Robinhood: RLUSD, treasury and prime brokerage

• RLUSD is live now on Robinhood Chain and on Bitstamp by Robinhood. It is expected in the main Robinhood app later this year, according to a Ripple–Robinhood release. The releases do not say XRP is being added to the Robinhood app.
• Robinhood plans to use RLUSD on the XRP Ledger to settle institutional trades through Bitstamp by Robinhood.
• Robinhood will integrate Ripple Treasury to run its own cash, liquidity, forecasting, payments, risk management and intercompany netting.
• Ripple Prime already provides Bitstamp with lending and margin financing across about 20 digital assets and gives Ripple Prime clients access to trade spot on Bitstamp. Support for perpetual futures on Bitstamp is planned for later in the year.

“Utility is what moves stablecoins forward,” said Johann Kerbrat, SVP and general manager of Robinhood Crypto and International.

What it is not

None of these releases says BNY clients can mint or redeem RLUSD today, that tokenized trade-finance volume is live on the XRP Ledger, or that XRP is coming to the Robinhood app. No dollar amounts were disclosed for either partnership. Figures for RLUSD’s market size vary slightly across the same day’s releases, so this piece does not treat any single number as settled fact.

Sources: Business Wire, Ripple, Robinhood, C2FO, BNY, Office of the Comptroller of the Currency.

The company that settles almost every U.S. stock trade is about to let some of those stocks move as tokens. Its newest launch sheet also answers the question crypto timelines keep asking: which blockchains are actually on the list.

The Depository Trust & Clearing Corporation (DTCC) has said its Tokenization Service will open in October 2026. A one-page “Day 1” tear sheet and roadmap, dated Oct. 23 and posted on DTCC’s learning site, lays out what the service does at launch and what comes later.

What is on the Day 1 list

• 34 securities available to tokenize at launch. An overview DTCC published on Oct. 16 put that number at 25, as CantonNews and TokenPost reported at the time. The tear sheet does not name the 34.
• About $30 trillion of assets eligible to be tokenized over time. DTC holds more than $114 trillion in total, according to DTCC.
• Three asset types: select large-cap Russell 1000 stocks, select ETFs, and a select set of U.S. Treasury bills, notes and bonds.
• Two networks live at launch: the Canton Network (CIP-56 token standard) and Besu, DTCC’s own private network (ERC-20).
• Two networks “anticipated in 2027”: Stellar (SEP-41) and Circle’s Arc (ERC-20), plus “additional L1s and L2s aligned with client and market demand.”

How it works

Each token is backed one-for-one by a security held at DTC and keeps the same CUSIP, the same rights and the same investor protections as the regular, book-entry version. DTC keeps the official books and records.

DTC participants place conversion orders through a web interface or an API from 2 a.m. to 6 p.m. ET on business days, with a target of 15 minutes or less. After that, tokens can move peer-to-peer 24/7, but only between DTC-registered wallets on the same network. Wallet registration opens at launch for “select third-party wallets.”

The tokens are “compliance-enabled” with transfer restrictions. DTCC’s product page says DTC-issued tokens include mint, burn, pause and clawback functions. For Treasuries, interest payments and maturities are handled on-chain from day one, with the cash paid in regular dollars to participants’ traditional accounts.

The roadmap for 2027 and beyond lists more eligible securities, single sign-on and maker-checker controls, corporate-action servicing for stocks and ETFs, one combined stock record across book-entry and on-chain positions, and “settlement and collateral, including on-chain netting and digital cash.” DTCC says the roadmap is “indicative and subject to change” and tied to the SEC no-action letter.

The date

DTCC itself has said October. The most specific date in public comes from John Hallahan, a Fireblocks director, who said in an Oct. 17 video interview: “DTCC’s tokenization service is launching at the end of the month. I believe it’s on the 28th.” Hardwire did not find a DTCC announcement confirming Oct. 28.

The service runs under an SEC staff no-action letter from December 2025 that lets DTC operate a defined tokenization service for three years. In July, more than 30 firms took part in limited production trades on Canton and Besu, according to DTCC.

What is not on the list

Posts circulating on X say XRP, XLM and HBAR are “already inside” the launch. The tear sheet does not say that. The XRP Ledger and Hedera are not named anywhere on it. Stellar is named, but for 2027, not Day 1. Some of the claims point to Fireblocks, which supports many blockchains, but Fireblocks’ own chain support is not DTCC’s network list.

For Canton, Day 1 is the headline: it is one of only two networks at launch, and the only one not run by DTCC.

Sources: DTCC (Tokenization Service tear sheet and roadmap, Oct. 23, 2026; Tokenization Service product page; May 4, 2026 press release); DTCC Learning Center; CantonNews; TokenPost; Crypto Briefing; CoinTurk News.