Category: Markets

Two banks on opposite sides of the Pacific moved tokenized money a step closer to everyday use this week, one with deposits that now settle around the clock and one with loans that would be born on a public blockchain.

Hong Kong goes 24/7. On Monday, the Hong Kong Monetary Authority said EnsembleTX, the live pilot phase of its Project Ensemble, now supports interbank settlement of tokenized deposit transactions in tokenized central bank money on a 24/7 basis. Until now, that settlement depended on the operating hours of Hong Kong’s regular interbank payment system. The pilot now has 12 participating banks, including HSBC, Standard Chartered, Bank of China (Hong Kong) and ICBC (Asia), plus 20 other firms the HKMA calls industry pioneers, such as Ant International, BlackRock and China Asset Management (Hong Kong).

“In just two years, Project Ensemble has transitioned from experimentation and piloting to a new phase focused on promoting the commercialisation of tokenisation applications in Hong Kong,” HKMA Chief Executive Eddie Yue said. The HKMA also said it completed trial secondary-market trades of tokenized Exchange Fund Bills and plans to expand the trials to include regulated stablecoins.

Standard Chartered is first to sell it. The same day, Standard Chartered launched a tokenized deposits service for corporate clients in Hong Kong, the first market in its group to offer it. The bank says eligible clients can move regular bank deposits in real time across participating banks through EnsembleTX, with interbank settlement in central bank money, including wholesale central bank digital currency, around the clock. It named China AMC, Finloop and PantherTrade as having already run live tokenized deposit transactions and settled tokenized money market funds. It is also working with Fireblocks to connect digital asset clients.

A tokenized deposit is not a stablecoin. It is still money a regulated bank owes its customer, recorded and moved on the bank’s blockchain system. Only eligible clients can use it. CoinDesk reported that the bank did not disclose transaction values or how many institutions will have access at first. Standard Chartered says it plans to expand to more markets over time but has given no timeline.

A U.S. bank plans tokenized loans from day one. In New Jersey, Cross River Bank said Tuesday it is working with Offchain, the developer of Arbitrum, to build tokenization into its lending platform. Loans made through the platform could be funded, owned, transferred and serviced on Arbitrum One from the moment they are created, instead of being moved onto a blockchain later. Borrowers would apply and repay through the same apps they use today, with Offchain’s ZeroDev wallet technology running underneath.

Cross River says it stays the regulated bank and lender of record, and that tokenization does not change its underwriting, risk or compliance standards. What changes is how loans can be sold to investors, such as funds that agree in advance to buy a share of new loans as they are made. The two companies say they have finished a proof of concept and are targeting production in early 2027.

Why it matters. Both projects keep the bank in the middle. Hong Kong is fixing the settlement side, so tokenized money can actually clear between banks after hours. Cross River is working on the asset side, so a loan has one shared record from day one. Neither is open to the public, and neither has published volume yet.

What to watch: transaction volumes on EnsembleTX, which markets Standard Chartered adds next, when stablecoins join the HKMA’s trials, and whether Cross River’s first tokenized loans reach investors on schedule in 2027.

Sources: HKMA, Standard Chartered, CoinDesk, Cross River.

Binance on Tuesday morning published its first account of how attackers took about $6.34 billion from its hot wallets on Oct. 29. The exchange calls the report initial and says independent security firms will review its findings.

How it happened. Binance describes a multi-stage campaign. In June, a wallet DevOps engineer installed a tampered copy of the Homebrew package manager while looking for an AI coding tool. Binance caught it, replaced the device and rotated credentials, but says the engineer’s role and his teammates had been exposed. In September, a second engineer was approached on a legitimate job platform. After two fake interviews, he ran a code “assignment” on his work computer that hid malware Binance’s endpoint tools missed.

On Oct. 20, the attacker used that machine and an internal AI tool to gain control over two wallet engineers, one of whom held a container deployment token. On Oct. 29, the attacker used those credentials to deploy a container and reach an internal wallet signing service. From there it could start transfers outside the normal withdrawal process.

The drain. From 4:05 to 4:09 p.m. ET, five hot wallets sent 233.46 million XRP to the attacker. SOL, OP and 18,270 BTC followed. On Ethereum, the attacker used the signing service to set up EIP-7702 delegations over a hot wallet, and they kept working after withdrawals were paused. Because the wallet used multi-party computation, there was no single key to cancel them, and Binance had to build a revocation procedure. The last unauthorized transfer settled at 7:56 p.m. ET. The delegation was cleared at 8:10 p.m.

Attribution and funds. Binance cites the FBI’s finding that North Korea is responsible. It says about $2.85 billion has been frozen or intercepted, and that it set aside more than 100% of the loss. It says 98% of affected tokens were replenished as of Oct. 31 and it is buying the less liquid remainder. Binance repeats that users will not bear the loss.

Next steps. Binance says it has rebuilt the wallet system and the AI tool, replaced devices and revoked credentials. It plans an independent review and a security research fund.

What it doesn’t answer. The report doesn’t explain why the signing service would sign transfers outside the withdrawal process, or how the AI tool gave the attacker control. It doesn’t say whether the June breach prompted a wider review. It gives no time zone for the Oct. 29 access window, and it has no chain-by-chain loss tally. It also doesn’t say how the 98% figure squares with the 95% Binance cited Sunday, or how frozen funds will be returned. It names no review firm and sets no date for a final report.

Sources: Binance Blog, FBI, Reuters

Binance says customers can now check for themselves that their holdings in ten major tokens were fully backed as of Oct. 31.

In its fifth recovery update, published on X Monday morning, the exchange said the zero-knowledge proof for its Oct. 31 proof-of-reserves snapshot is complete. Users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can run Binance’s open-source verifier on their own computer to confirm that their balance is included and that reserves were at least 1:1 at that moment.

What it shows, and what it doesn’t. A proof of reserves is a snapshot. It covers one point in time, midnight UTC on Oct. 31, and does not guarantee balances today or tomorrow. It tests assets against customer balances in those ten tokens, not the exchange’s full set of obligations. Binance did not name an independent auditor for this snapshot; it pointed to a 2023 third-party audit of its verifier code.

Binance says it has now covered about 95% of the roughly $6.3 billion taken in last Thursday’s breach, using its own funds. The remaining 5% is in less liquid tokens outside the top ten, which the company says take longer to buy at the scale it needs. A second snapshot covering more tokens is planned for Wednesday, Nov. 4, with the proof expected to take about 40 to 50 hours to build.

Withdrawals: the real test. Withdrawals reopened Sunday. Binance reported $4.65 billion out and $1.01 billion in during the first nine and a half hours, a net outflow of $3.64 billion, or 2.1% of its $171 billion in assets. A Binance spokesperson later told Reuters the net figure since Sunday had reached $4.72 billion, about 2.8% of assets. The exchange restored U.S. dollar withdrawals Monday and says the next phase of network reopenings is planned for Tuesday.

The fallout is reaching regulators. South Korea’s Financial Services Commission called an emergency meeting Monday with the country’s major crypto exchanges, urging them to raise cold-wallet holdings, monitor deposits and withdrawals around the clock, report and share suspicious access attempts quickly, and set aside extra reserves.

What to watch: Tuesday’s network reopenings, Wednesday’s broader snapshot, the list of tokens in the missing 5%, and whether Binance publishes a full post-incident report.

Sources: Binance on X, Binance, Reuters, CNBC, Financial Services Commission (Korea).

The U.S. Secret Service said Sunday afternoon that it continues to investigate the theft of more than $6 billion in cryptocurrency from Binance Global.

In a post on its official X account early Sunday afternoon ET, the agency said that within minutes of the incident on Thursday afternoon, its investigators worked with industry partners to identify and freeze a significant portion of the stolen funds. An accompanying graphic said the Secret Service and federal partners are working to recover the funds. The agency did not give a dollar figure for the amount it froze.

Binance founder Changpeng Zhao thanked the Secret Service and “all the agencies and industry partners involved” in a post Sunday afternoon, saying the work “continues.”

The statement adds a second federal agency to the public response. The FBI said Saturday evening that it attributes the attack to the North Korea-linked group known as TraderTraitor.

Binance’s own figures are unchanged. The exchange puts the loss at about $6.3 billion, says it has set aside more than $6.34 billion, and says about $3 billion is frozen on-chain. It is not clear how much of that frozen total the Secret Service’s work accounts for.

Withdrawals reopened in phases early Sunday on 15 networks. By late Sunday morning, Binance reported about $4.65 billion in withdrawals against about $1.01 billion in deposits. Remaining networks are still in testing. Binance says an updated proof-of-reserves report is expected Monday, and a post-incident report will follow its investigation.

Blockchain analytics firm Chainalysis said Sunday that the attackers have begun a new phase of laundering, moving funds off the Tron network to fresh Ethereum and Bitcoin wallets.

Prices were steady. At 3:52 PM ET, CoinGecko showed Bitcoin at $77,836, Ether at $2,261 and BNB at $707.95.

Sources: U.S. Secret Service, Binance, FBI, Chainalysis, CoinGecko

Binance said Sunday that it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 1:00 AM and 10:30 AM ET, leaving a net outflow of about $3.64 billion in the first hours after it reopened withdrawals following last week’s hack.

In a post late Sunday morning, the exchange said that figure equals 2.1% of its $171 billion in total assets under management, based on its latest published proof-of-reserves data, dated Oct. 28. It said withdrawal volumes spiked at first, then declined and were stabilizing, while deposits stayed “substantial.”

All 15 networks in the first phase were live by 7:36 AM ET, Binance said, covering assets including BTC, ETH, BNB, XRP, SOL, USDT and USDC. Remaining networks are still being tested, and the exchange said it would share details of the next phase when ready. Its help desk said prediction-market withdrawals and new VIP and flexible-rate loan borrowing remain paused.

On reserves, Binance said the new snapshot was taken at 8:00 PM ET Friday and that the updated report is expected on its proof-of-reserves website on Monday. That is earlier than Saturday’s estimate, which pointed to Tuesday.

The core figures are unchanged. Binance puts the theft at about $6.3 billion, says more than $6.34 billion has been set aside, and reported coverage of about 95% in its latest recovery update. Roughly $3 billion is frozen on-chain. The FBI attributed the theft to North Korea on Saturday.

There is still no post-incident report, no regulator action and no new freeze figure. On-chain trackers report the hacker moving stolen SOL into bitcoin; Hardwire has not independently confirmed those flows.

Prices were steady. As of 11:54 AM ET, CoinGecko showed BTC at $78,043 (+0.7% over 24 hours), ETH at $2,267 (+0.8%) and BNB at $711.61 (+0.9%).

Sources: Binance, Binance Customer Support, FBI, CoinGecko

Update, Nov. 1: Binance now says the updated proof-of-reserves report is expected Monday, Nov. 2, not Tuesday. Read the latest.

Binance began reopening crypto withdrawals early Sunday, about three days after the Oct. 29 breach that the exchange puts at roughly $6.3 billion.

In its Recovery Update #4, posted just after midnight ET, Binance said phase one would roll out between 1 AM and 4 AM ET, with networks prioritized by the past week’s user demand. The Bitcoin network opened first, at about 1:20 AM ET. Ethereum and BNB Smart Chain (ETH, BNB, USDT and USDC) followed before 3 AM, then XRP and Base. By 7:36 AM ET, Binance listed 15 networks as live, also including Dogecoin, Optimism, Arbitrum, Tron, Solana, Polygon, Avalanche C-Chain, ZEC, TON and Sui. More assets will be added “in phases as security checks are completed,” it said, and users may see delays during the initial rollout.

The exchange also said it has now covered about 95% of the impacted amount, up from about 90% on Saturday. The remaining 5% is in less-liquid tokens outside its top ten, which it is still buying through market and OTC channels. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, it said. Deposits were not affected.

Withdrawals now come from newly generated hot wallets, which Binance said it has added to its proof-of-reserves page. That explains Sunday’s large on-chain transfers to unfamiliar addresses, which the company described as internal.

What is still pending: the full zero-knowledge proof for the Oct. 31 reserves snapshot, which Binance expects around Tuesday, and a post-incident report once the investigation ends. The FBI attributed the theft to North Korea’s TraderTraitor group on Saturday. Binance has not changed its figures of more than $6.34 billion set aside and about $3 billion frozen. It has said users will not bear the loss.

Markets were steady. At 7:47 AM ET, CoinGecko showed Bitcoin at $77,821 (+0.4% over 24 hours), Ether at $2,261 (+0.5%) and BNB at $712 (+1.0%).

Sources: Binance, FBI, CoinGecko

The FBI said Saturday evening that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct. 29. The statement, posted by the FBI’s Cyber Branch at about 6:37 PM ET and shared by the bureau’s main account, is the first official government attribution of the attack.

Per Reuters and the AP, the FBI tied the theft to TraderTraitor, the North Korean state-sponsored group it previously linked to the roughly $1.5 billion Bybit hack. The bureau said it had observed the group converting stolen assets into Ether and expects further laundering. That matches the private-sector read: Chainalysis and TRM had already attributed the hack to TraderTraitor, but until now there was no government confirmation.

On-chain tracing continues. Elliptic said Saturday that the main Tron distribution wallet linked to the stolen funds has paid out roughly every hour for 31 hours, with repeated swap amounts into THORChain, a pattern it described as automated laundering.

Binance’s own figures are unchanged since Update #3 on Saturday morning: about $6.3 billion affected, more than $6.34 billion set aside, about 90% of stolen assets replenished, and about $3 billion frozen on-chain. Crypto withdrawals are still paused. Binance’s support account said Saturday evening that security checks are being completed, with P2P and fiat withdrawals available where supported. The company has said it is on track to restart withdrawals Sunday, Nov. 1, but has not confirmed a time.

Still pending: a confirmed withdrawal restart, the zero-knowledge proof-of-reserves results (estimated by Tuesday, Nov. 3, UTC), and Binance’s technical findings and post-mortem. No regulator action has been announced.

Markets were steady. At 7:47 PM ET, CoinGecko showed Bitcoin at $77,433 (+0.3% over 24 hours), Ether at $2,253 (+0.5%) and BNB at $702.60 (−0.2%).

Sources: FBI, Reuters, AP, Binance, Elliptic, Chainalysis, CoinGecko

Update, Nov. 1: Binance now says the updated proof-of-reserves report is expected Monday, Nov. 2, not Tuesday. Read the latest.

Binance said Saturday morning that it has now replaced about 90% of the assets stolen in Thursday’s hack, up from roughly 80% in its previous update on Friday afternoon.

In “Security Incident Update #3,” posted on X at 10:30 AM ET, the exchange said user balances in ten tokens are fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% is in less liquid tokens outside that list, which Binance said it is still buying through market and over-the-counter channels and “may take longer to source.”

Binance said the money came from three places: a partial draw on its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund, and its own corporate treasury. It said it will refill SAFU to about $1 billion, and that the insurance fund remains above the level its risk framework requires.

The headline figures did not change. Binance still puts the loss at about $6.3 billion and says it has set aside more than $6.34 billion in company funds. About $3 billion remains frozen on-chain; co-founder Yi He wrote on X that recovering it will take a formal process.

The exchange also said it took a new proof-of-reserves snapshot at 00:00 UTC on Oct. 31 (8 PM ET Friday) and posted it to its reserves page. The zero-knowledge proof that lets users check their own balances will take 40 to 50 hours to generate, with completion estimated by Tuesday, Nov. 3 (UTC). Friday’s update had pointed to results by Monday.

Crypto withdrawals remain paused. Binance said it is “on track” to reopen them on Sunday, Nov. 1, and will confirm details later. Co-CEO Richard Teng wrote that users “will not bear the financial impact.”

Still pending: the actual reopening, technical findings and a post-mortem, and any official government attribution. Blockchain analytics firms Chainalysis and TRM attribute the attack to North Korea’s TraderTraitor group; no government has said so.

At 11:47 AM ET, CoinGecko showed BTC at $77,483 (+0.2% over 24 hours), ETH at $2,249 (+1.2%) and BNB at $706 (+1.2%).

Sources: Binance, Binance co-CEO Richard Teng (X), Binance co-founder Yi He (X), CoinGecko

The hackers who took about $6.3 billion from Binance on Thursday are now in a race against the companies that can freeze stolen money, according to blockchain tracking firm Chainalysis.

Some stolen coins are easy to freeze. Stablecoins like USDT and USDC are issued by companies, Tether and Circle, which can lock tokens at a flagged address. Bitcoin and ether have no company in charge, so no one can freeze them that way. That difference is shaping how the attackers move the money.

What Chainalysis says the hackers are doing. In a post on X Saturday morning, Chainalysis said the attackers have been parking stablecoins on the Tron blockchain in DeFi lending apps. In return they get a “receipt” token, a claim on the coins in the pool. Unlike the stablecoins themselves, those receipt tokens can’t be frozen. The attackers send the receipts to fresh wallets with no link to the hack, trade them back for stablecoins, and then bridge the money to Ethereum as ether. Chainalysis walked through one $500,000 example step by step. It said Circle and Tether have contributed to $2.8 billion in freezes so far.

In its write-up of the hack, Chainalysis also said the attackers swapped $325 million in stablecoins for $285 million in ether in about 20 minutes on Thursday, before freezes started at 5:14 p.m. ET. It said the laundering shows signs of automation, with thousands of transactions in a short time. Chainalysis attributes the theft to North Korea’s TraderTraitor group, and TRM Labs and Elliptic have also pointed to North Korea. No government agency has made an official attribution, and Binance has not named a culprit.

Tools for everyone else. Elliptic said Saturday that its public blocklist of addresses tied to the hack now holds more than 2,800 addresses and is free to check. It warned that the attacker is still moving funds.

Where Binance stands. Withdrawals are still paused. Binance’s second incident update, posted Friday afternoon, said it has set aside more than $6.34 billion and already holds about $5 billion of it in the same tokens that were taken, roughly 80% of the loss. It is buying the rest. About $3 billion has been frozen on-chain with partners, Binance said. The exchange is targeting a phased restart of withdrawals in about 34 hours from that update, which works out to the early hours of Sunday, ET, subject to security checks. It also planned a first proof-of-reserves snapshot within 12 hours, with results due by Monday, Nov. 2. As of Saturday morning, Binance had not said publicly whether that snapshot was taken. Its support account is still telling customers that withdrawals will resume “as soon as the security issue is fully resolved.”

Market check. U.S. spot bitcoin ETFs saw a net $643.2 million in outflows on Friday, the first full trading day after the hack, according to Farside Investors. BlackRock’s IBIT lost $233.7 million and Fidelity’s FBTC lost $201 million. Prices were calm Saturday morning. At about 8:20 a.m. ET, CoinGecko showed bitcoin near $77,500, ether near $2,246, XRP near $1.25 and BNB near $704, each within about 1% of where they were a day earlier.

The next checks are clear: whether withdrawals actually reopen this weekend, what the reserve report shows on Monday, and when Binance publishes its technical post-mortem.

Sources: Chainalysis on X, Chainalysis, Elliptic on X, Binance, Binance on X, CoinDesk, Farside Investors, CoinGecko.

Update, Oct. 31: Binance now says the full proof-of-reserves results are expected by Tuesday, Nov. 3, not Monday, and that about 90% of stolen assets have been replaced. Read the latest.

Binance said Friday afternoon it has already covered about 80% of the roughly $6.3 billion lost in Thursday’s hot-wallet compromise, and set out a timetable for reopening withdrawals in stages.

In “Security Incident Update #2,” posted at about 4 PM ET and signed by co-CEOs Yi He and Richard Teng, the exchange said it has set aside more than $6.34 billion in company funds, including $5 billion held in the exact tokens that were taken, such as USDC, USDT, BTC, ETH and BNB. It is buying the remaining assets through market and OTC channels. The loss estimate is unchanged, and about $3 billion has been frozen on-chain with partners.

The update dates the compromise to about 20:05 UTC on Oct. 29, or 4:05 PM ET.

Key timelines Binance gave:

• Withdrawals: a phased restart targeted to begin within about 34 hours, which would be early Sunday ET, subject to security checks.
• Proof of reserves: an initial snapshot in about 12 hours, with results ready by Monday, Nov. 2.
• Technical findings: further detail expected within about 48 hours, with a full post-mortem to follow.

Binance repeated that early findings pointed to a compromised laptop but said later work had “uncovered additional points of breach.” It said it has found no evidence that wallet private keys were leaked.

Binance still hasn’t named the attacker. Chainalysis has attributed the theft to North Korea’s TraderTraitor, but no government agency has made an official attribution.

Washington is also weighing in. CFTC Chairman Michael Selig said Friday on CNBC’s “Squawk on the Street” that the hack “proves our exact point” and that he wants a voluntary federal registration option for offshore exchanges, with U.S.-style cybersecurity safeguards; making it mandatory would require Congress. He said the CFTC will assist law enforcement. His remarks were commentary on the agency’s Oct. 5 advance notice of proposed rulemaking, which has a Dec. 14 comment deadline, not action against Binance.

Markets were steady into the evening. At about 5:50 PM ET CoinGecko showed BTC at $76,725 (down 3.1% over 24 hours), ETH at $2,237 (down 1.7%) and BNB at $697 (down 1.2%).

All of these are company targets, not confirmed outcomes. Binance’s own support account says withdrawals resume only “as soon as the security issue is fully resolved.”

Sources: Binance, Binance co-CEO Richard Teng (X), Chainalysis, CNBC, CFTC, Federal Register, CoinGecko