Category: Markets

Binance co-CEO Richard Teng said Friday the exchange hopes to resume customer withdrawals by Sunday, Nov. 1, and will publish a full proof-of-reserves report by Monday, Nov. 2, with an initial view possibly sooner.

In a video statement posted on X at about 10:30 a.m. ET, Teng said the withdrawal service is being rebuilt and will not be switched back on until it “passes rigorous testing,” which he said is on track to finish within about 40 hours. That is a target, not a confirmed reopening time. Deposits are operating normally, according to Binance’s updated incident notice.

Teng also gave new detail on how the attack worked. He said the attacker used Ethereum’s EIP-7702 account-delegation feature to gain execution approval over a Binance hot wallet without going through the company’s normal approval controls, and used a “self-destruct” mechanism to erase tools and traces. He said more than one person was involved and that investigators have found additional points of breach but have not yet pieced together the full sequence. A formal technical post-mortem has not been published.

The headline figures are unchanged. Binance says it has reserved more than $6.34 billion of company funds, $5 billion of it already in the same tokens that were taken, and is buying the rest through market and over-the-counter channels. About $3 billion has been frozen on-chain, and Binance said it has “begun recovering” assets.

U.S. authorities are now involved. The FBI said it is “aware of the incident,” and the Secret Service said it is working with the U.S. Attorney’s Office for the District of Columbia to trace and recover funds, BBC News reported. No agency has publicly named a culprit; Chainalysis has attributed the attack to North Korea’s TraderTraitor group.

Bitcoin was near $77,180 at 1:53 p.m. ET, down about 4% over 24 hours, per CoinGecko. Ether was near $2,240, and BNB near $701, down about 6%.

Sources: Binance, BBC News, CoinDesk, Chainalysis, CoinGecko

Binance, the world’s biggest crypto exchange, says it was hit by a security breach on Thursday afternoon and has set aside more than $6.3 billion to cover it. If that figure holds, it would be the largest crypto theft on record, roughly four times the $1.5 billion taken from Bybit in February 2025.

According to Binance’s incident notice, the attack may have started with a compromised laptop belonging to a DevOps engineer. That access let the attacker reach an internal service and submit withdrawals Binance did not authorize. The exchange said it found no evidence that wallet private keys leaked. In an update early Friday, it said further investigation had “uncovered additional points of breach,” without giving details.

What Binance has committed to. Binance says it will cover all losses from its SAFU emergency fund and company money, and that user funds are safe. In a post on X Friday morning, it said it has reserved more than $6.34 billion for the incident. About $5 billion of that is already held in the same tokens that were taken, and it is buying the rest through market and over-the-counter channels. Binance also says about $3 billion has been frozen with help from stablecoin issuers and other partners. Tether’s chief executive, Paolo Ardoino, said Tether alone froze more than 1.567 billion USDT.

What customers can do now. Withdrawals are suspended. Binance said Friday it is on track to resume them in about 45 hours. Deposits remain unaffected, the company said, though an earlier Binance post had said both deposits and withdrawals were paused. Binance has promised a technical post-mortem and an updated proof of reserves once the fix is done. Neither has been published yet.

Who is behind it. Chainalysis puts the theft at about $6.4 billion and attributes it to TraderTraitor, a North Korean hacking group. Binance dates the start of the compromise to about 4:05 p.m. ET Thursday. TRM Labs said the attack resembles past North Korea-linked incidents. Binance has not named a culprit.

Market reaction. Bitcoin traded near $77,450 at 8:15 a.m. ET Friday, down about 3% over 24 hours, according to CoinGecko. Ether was near $2,238, down about 3.6%, and Binance’s own BNB token was near $700, down about 5%. U.S. spot bitcoin ETFs took in a net $17.2 million on Thursday, while ether ETFs lost $105.5 million, according to Farside Investors. That trading closed before the breach began.

For cautious holders, the practical points are simple. Binance’s pledge is a company promise, not an insured guarantee, and the proof will come when withdrawals reopen and new reserve data is posted. Use only official Binance channels, since fake “refund” and support accounts often follow incidents like this.

Sources: Binance, Binance on X, Paolo Ardoino on X, Chainalysis, BBC News, CoinGecko, Farside Investors.

Polymarket put its international exchange into cancel-only mode on Thursday afternoon after users reported funds leaving their accounts without their permission. The company later said one of its outside providers had been compromised.

Polymarket’s status page posted its first notice at 2:05 p.m. ET: “The exchange is currently in cancel-only mode and relayer actions paused while we investigate an incident.” In cancel-only mode, traders can pull open orders but can’t place new ones. Relayers are the services that submit users’ signed transactions to the blockchain.

At 2:33 p.m. ET, the company’s Polymarket Traders account on X said: “We’ve identified & fixed an issue impacting our international platform, Polymarket.com. One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement. Anyone who has been impacted will be made whole.” The status page carried the same statement and added that “out of an abundance of caution, we have temporarily halted trading and are working to bring the platform back online.”

At 2:54 p.m. ET it said trading would resume at about 3 p.m. Six minutes later it posted: “Trading is now fully back online. We’ll make this right and are fully reimbursing all affected traders.” The status page marked the incident resolved at 3:05 p.m. ET, about an hour after the first notice.

What hasn’t been confirmed

• The amount. Polymarket hasn’t published a loss figure, and a representative declined to comment on one to NBC News. The Block and Decrypt, citing Arkham data, reported that a wallet identified as the suspected attacker’s held about $2.65 million in POL after a series of swaps out of USDC.e. That is a wallet balance, not a confirmed tally of losses. The Wall Street Journal, as cited by Quartz, counted more than $2.5 million taken from user accounts in over 900 transactions. Two analytics firms, Betting Intelligence and Polysights, told CNBC that at least $2.7 million was withdrawn across 710 wallets.
• The provider. Polymarket hasn’t named it.
• Who was affected. The company hasn’t said how many traders were hit. Its statements refer only to Polymarket.com, its international platform, and CNBC reported that the U.S. platform was not compromised.

Polymarket hasn’t said when reimbursements will be paid or how they will be calculated.

This isn’t the platform’s first vendor-related incident. In June, Polymarket said a third-party vendor had been compromised and promised to refund affected users, according to CNBC and Decrypt.

The outage came five days before the U.S. midterm elections on Nov. 3, when Polymarket’s international and U.S. exchanges are both expected to see heavier trading.

Sources: Polymarket status page; Polymarket Traders on X; The Block; Decrypt; CNBC; NBC News; Quartz

Bitcoin traded near $80,000 on Thursday morning, down about 1% over 24 hours, after the Federal Reserve left rates unchanged but showed a split over whether to raise them.

The Fed held its federal funds target range at 3.75% to 4.00% on Wednesday. The vote was 10–2. According to the Fed’s statement, Governor Lisa D. Cook and Cleveland Fed President Beth M. Hammack dissented. Both wanted a quarter-point increase at this meeting.

The statement said economic activity “is expanding at a strong pace” and that inflation “remains elevated.” It did not commit to a next move. “The accumulation of more information will help the Committee determine the policy stance appropriate,” it said.

Chair Kevin Warsh echoed that at his press conference. “The information we receive over the coming period will help us determine where we want policy to be,” he said, according to the Fed’s preliminary transcript.

What markets are pricing. Futures still point to a December hike. Investing.com, citing CME FedWatch, put the chance of a quarter-point increase at 79.8% on Thursday, up from 73.4% a week earlier. These readings move through the day and are not forecasts. The next meeting is Dec. 8–9, per the Fed’s calendar.

The 10-year Treasury yield was about 5.01% early Thursday, CoinDesk reported, after briefly pushing above 5% following the meeting.

Crypto reaction. CoinGecko showed BTC at $80,049 at 8:13 a.m. ET, down 1.1% over 24 hours, and ether at $2,321, down 1.1%. CoinDesk said bitcoin dipped to about $79,600 overnight. It tied the move partly to a slide in tech stocks after Alphabet and Samsung earnings, with Nasdaq-100 futures down about 1.1%.

Fund flows were steadier. U.S. spot bitcoin ETFs took in a net $137.3 million on Wednesday, the third straight day of inflows, according to Farside Investors. Almost all of it went to BlackRock’s IBIT. Spot ether ETFs saw net outflows of $21.4 million.

What’s next. The Commerce Department’s September PCE report, the Fed’s preferred inflation gauge, is due Thursday. The October jobs report follows Nov. 6, then October consumer prices on Nov. 10, Decrypt reported. With policy now tied to incoming data, those releases may matter more for crypto than anything said on Wednesday.

Sources: Federal Reserve, Federal Reserve press conference transcript, CoinDesk, Investing.com, Farside Investors, CoinGecko, Decrypt.

Ripple’s dollar stablecoin, RLUSD, is now on Coinbase, the largest U.S. crypto exchange. Ripple and Coinbase announced the partnership on Wednesday, Oct. 28, the main day of Ripple’s Swell conference in New York.

According to Ripple’s announcement, retail and institutional customers can trade and manage RLUSD starting today through the Coinbase app, Coinbase Exchange and Coinbase Prime. Customers can convert U.S. dollars and other supported dollar stablecoins into RLUSD at a 1:1 rate. Deposits and withdrawals work on three networks: the XRP Ledger, Base and Ethereum. Ripple says it will provide liquidity on Base. Coinbase and Coinbase Institutional confirmed the listing.

Not everything is live yet. Ripple says access for Coinbase’s international exchange customers, including using RLUSD as collateral, “will follow.” No date was given.

The listing came hours after a credit rating. On Tuesday, Moody’s Ratings assigned RLUSD an A2 long-term and P-1 short-term deposit rating, both investment grade, as The Block and Decrypt reported and Ripple’s Jack McDonald confirmed. Moody’s pointed to reserves held mostly in Treasury bills, other short-term U.S. government assets and cash, largely with custodian BNY, and a 103% reserve coverage target. The ratings were requested by the issuer.

Moody’s also flagged limits. Per Decrypt, the issuer, Standard Custody & Trust Company, is not bankruptcy-remote, and RLUSD holders don’t currently have a direct ownership interest in the reserves. Moody’s said the GENIUS Act, due to take effect in 2027, will shield required reserves from an issuer’s bankruptcy estate.

Ripple says RLUSD has passed $2.4 billion in market value since it launched in December 2024. Ripple’s McDonald and Coinbase Institutional co-CEO Brett Tejpaul are scheduled to discuss the deal on the Swell stage at 4:45 p.m. ET today.

XRP was about $1.31 on Wednesday afternoon, down about 0.7% over 24 hours, per CoinGecko.

The Depository Trust & Clearing Corporation says its Tokenization Service is now live. As of Wednesday morning, DTCC’s product page lists 34 securities available to tokenize at launch.

What it does. The service lets eligible DTC participants convert certain securities they already hold at DTC into tokens. According to DTCC, each token is backed one-for-one by the security held at DTC, keeps the same CUSIP identifier, and carries the same legal rights and economic interests as the underlying security. Tokens can move between DTC-registered wallets around the clock, but only within the same network.

What it doesn’t do. This is not a new market open to retail investors, and it is not a public token sale. DTCC describes it as a voluntary service for DTC participants. It operates under a Securities and Exchange Commission no-action letter issued in December 2025, which covers a three-year authorization period. DTCC also says built-in token controls support compliance and near real-time ownership tracking.

Scale, in context. DTCC’s page puts assets under custody at DTC at about $30 trillion. That is the pool the service draws from, not the amount tokenized. The launch list of 34 securities is a small starting set, and DTCC has not published usage figures.

Which networks. DTCC’s Day 1 tear sheet, dated Oct. 23, lists Canton and DTCC’s private Besu network as live at launch. It shows Stellar and Circle’s Arc as “anticipated in 2027” and calls the roadmap “indicative and subject to change.” Wallet providers shown on DTCC’s page include BitGo, Blockdaemon, Fireblocks, HashKey, Kaleido, Talos and Tradeweb.

Stellar’s week. Separately, Securitize said Wednesday it plans to integrate the Stellar network, which it called its 17th supported network. It gave no timeline and named no first products. On Tuesday, Janus Henderson and Centrifuge launched JQQQ, a Nasdaq-100 fund issued on Stellar for non-U.S. professional investors; as of Tuesday afternoon, Centrifuge’s fund page said it was still “seeding” and not yet open for investment. Neither announcement is connected to DTCC’s service.

What to watch. How quickly the list grows beyond 34 securities, how much participants actually tokenize, and whether the 2027 network additions hold to schedule.

Sources: DTCC, DTCC tear sheet, Securitize (PR Newswire), Janus Henderson, Centrifuge, CoinDesk.

Ripple opened its Swell conference in New York on Tuesday, Oct. 27, with two expanded partnerships announced the same morning: one with BNY, and one with Robinhood. Both rest on Ripple’s dollar stablecoin, RLUSD, and on the XRP Ledger. Neither release discloses a deal size.

The news follows Monday’s final OCC approval for Ripple National Trust Bank, which will manage RLUSD’s reserves. That trust charter takes no deposits, makes no loans, has no FDIC insurance, and has no opening date yet.

BNY: custody for XRP and RLUSD

• BNY’s Digital Asset Custody platform now supports XRP and RLUSD for eligible institutional clients, the companies said in a Business Wire release.
• BNY was already the primary reserve custodian for RLUSD and holds assets for Ripple Prime. The expansion adds client custody of the tokens themselves, not only of the dollar reserves behind the stablecoin.
• BNY and Ripple say they intend to let BNY clients mint and redeem RLUSD directly through BNY. The release marks that step with an asterisk as a future plan. It is not live, and no launch date was given.
• BNY also intends to broaden support for tokenized assets issued on the XRP Ledger as use cases develop.

“We’re moving past the initial issuance of assets onchain – now, it’s all about making these tokenized assets usable for payments and collateral across financial markets,” Ripple President Monica Long said.

Trade finance: exploratory with BNY, waitlist with C2FO

Ripple and BNY also said they intend to advance tokenized trade finance on the XRP Ledger, “subject to client requirements.” As a first step, they are exploring a supply-chain finance initiative with C2FO, a working-capital platform. That work is exploratory, not a live book of business.

Separately, C2FO plans to settle Instant Pay supplier payments on the XRP Ledger in RLUSD, in seconds rather than days, and is taking sign-ups through a waitlist. The release does not say Instant Pay is live.

Robinhood: RLUSD, treasury and prime brokerage

• RLUSD is live now on Robinhood Chain and on Bitstamp by Robinhood. It is expected in the main Robinhood app later this year, according to a Ripple–Robinhood release. The releases do not say XRP is being added to the Robinhood app.
• Robinhood plans to use RLUSD on the XRP Ledger to settle institutional trades through Bitstamp by Robinhood.
• Robinhood will integrate Ripple Treasury to run its own cash, liquidity, forecasting, payments, risk management and intercompany netting.
• Ripple Prime already provides Bitstamp with lending and margin financing across about 20 digital assets and gives Ripple Prime clients access to trade spot on Bitstamp. Support for perpetual futures on Bitstamp is planned for later in the year.

“Utility is what moves stablecoins forward,” said Johann Kerbrat, SVP and general manager of Robinhood Crypto and International.

What it is not

None of these releases says BNY clients can mint or redeem RLUSD today, that tokenized trade-finance volume is live on the XRP Ledger, or that XRP is coming to the Robinhood app. No dollar amounts were disclosed for either partnership. Figures for RLUSD’s market size vary slightly across the same day’s releases, so this piece does not treat any single number as settled fact.

Sources: Business Wire, Ripple, Robinhood, C2FO, BNY, Office of the Comptroller of the Currency.

The company that settles almost every U.S. stock trade is about to let some of those stocks move as tokens. Its newest launch sheet also answers the question crypto timelines keep asking: which blockchains are actually on the list.

The Depository Trust & Clearing Corporation (DTCC) has said its Tokenization Service will open in October 2026. A one-page “Day 1” tear sheet and roadmap, dated Oct. 23 and posted on DTCC’s learning site, lays out what the service does at launch and what comes later.

What is on the Day 1 list

• 34 securities available to tokenize at launch. An overview DTCC published on Oct. 16 put that number at 25, as CantonNews and TokenPost reported at the time. The tear sheet does not name the 34.
• About $30 trillion of assets eligible to be tokenized over time. DTC holds more than $114 trillion in total, according to DTCC.
• Three asset types: select large-cap Russell 1000 stocks, select ETFs, and a select set of U.S. Treasury bills, notes and bonds.
• Two networks live at launch: the Canton Network (CIP-56 token standard) and Besu, DTCC’s own private network (ERC-20).
• Two networks “anticipated in 2027”: Stellar (SEP-41) and Circle’s Arc (ERC-20), plus “additional L1s and L2s aligned with client and market demand.”

How it works

Each token is backed one-for-one by a security held at DTC and keeps the same CUSIP, the same rights and the same investor protections as the regular, book-entry version. DTC keeps the official books and records.

DTC participants place conversion orders through a web interface or an API from 2 a.m. to 6 p.m. ET on business days, with a target of 15 minutes or less. After that, tokens can move peer-to-peer 24/7, but only between DTC-registered wallets on the same network. Wallet registration opens at launch for “select third-party wallets.”

The tokens are “compliance-enabled” with transfer restrictions. DTCC’s product page says DTC-issued tokens include mint, burn, pause and clawback functions. For Treasuries, interest payments and maturities are handled on-chain from day one, with the cash paid in regular dollars to participants’ traditional accounts.

The roadmap for 2027 and beyond lists more eligible securities, single sign-on and maker-checker controls, corporate-action servicing for stocks and ETFs, one combined stock record across book-entry and on-chain positions, and “settlement and collateral, including on-chain netting and digital cash.” DTCC says the roadmap is “indicative and subject to change” and tied to the SEC no-action letter.

The date

DTCC itself has said October. The most specific date in public comes from John Hallahan, a Fireblocks director, who said in an Oct. 17 video interview: “DTCC’s tokenization service is launching at the end of the month. I believe it’s on the 28th.” Hardwire did not find a DTCC announcement confirming Oct. 28.

The service runs under an SEC staff no-action letter from December 2025 that lets DTC operate a defined tokenization service for three years. In July, more than 30 firms took part in limited production trades on Canton and Besu, according to DTCC.

What is not on the list

Posts circulating on X say XRP, XLM and HBAR are “already inside” the launch. The tear sheet does not say that. The XRP Ledger and Hedera are not named anywhere on it. Stellar is named, but for 2027, not Day 1. Some of the claims point to Fireblocks, which supports many blockchains, but Fireblocks’ own chain support is not DTCC’s network list.

For Canton, Day 1 is the headline: it is one of only two networks at launch, and the only one not run by DTCC.

Sources: DTCC (Tokenization Service tear sheet and roadmap, Oct. 23, 2026; Tokenization Service product page; May 4, 2026 press release); DTCC Learning Center; CantonNews; TokenPost; Crypto Briefing; CoinTurk News.

Bitcoin traded at about $80,460 early Sunday, roughly flat over 24 hours, according to CoinGecko data at 8:08 a.m. ET. That followed a Saturday-morning slide below $80,000, to its weakest level in more than a month, according to CoinDesk. The Block’s price data put Saturday’s low at about $79,280 around 11:20 a.m. ET before a rebound to roughly $80,140 by 1 p.m.

Ether was about 1% lower over 24 hours early Sunday at roughly $2,336, and solana was little changed near $101, while XRP was up about 1.5% at $1.30, CoinGecko data showed. On Saturday morning, all three had been down between 3% and 4% over 24 hours, CoinDesk reported.

Most of the damage landed on traders betting on higher prices. In the four hours to 1 p.m. ET Saturday, $436.4 million of crypto futures positions were liquidated, and $404.2 million of that came from longs, according to CoinGlass data cited by The Block. Two 15-minute bursts, starting at 10:15 a.m. and 11:15 a.m., accounted for about $339 million of long liquidations. Ether positions made up $136.7 million of the four-hour total, close to bitcoin’s $158.5 million. The pace has since slowed. CoinGlass’s 24-hour count for the 20 most-liquidated coins stood at $452.9 million as of about 3 a.m. ET Sunday, with $391.1 million from longs, TokenPost reported.

Fund flows had already turned. U.S. spot bitcoin exchange-traded funds recorded net outflows of $635.6 million on Thursday and $137.9 million on Friday, according to Farside Investors, about $773 million over the two days. SoSoValue data reported by The Block show nearly identical figures. Farside’s Friday total is still provisional, with one fund yet to report. Even after the two down days, the funds were still net positive for the week, by about $305 million on SoSoValue’s count.

The selling came as markets digested reports about U.S. staffing in the Middle East. The Wall Street Journal reported Saturday that the U.S. is evacuating personnel from embassies and bases in the region, CoinDesk said. The State Department’s own Saudi Arabia travel advisory, dated Oct. 23, says it ordered non-emergency government employees and their families to leave that country. The Associated Press reported that the department is also reducing staff at embassies in Jordan, Lebanon, Qatar and the United Arab Emirates, which remain open. Hardwire Crypto has not established a direct link between those reports and the price move.

BitMEX co-founder Arthur Hayes posted “I dumped it all” on X at about 2:18 a.m. ET Saturday, The Block reported.

Sources: CoinGecko, CoinDesk, The Block, TokenPost, Farside Investors, U.S. Department of State, Associated Press

Hardware wallet maker Keystone said Saturday that a third party obtained customer shipping information from its official website, and it apologized to affected buyers.

“On October 20, we detected unauthorized access to our official website,” the company wrote in a notice posted on its verified X account on Oct. 24. “After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information.”

According to the notice, the exposed data were “names, contact details, shipping addresses, and order details (items and prices).” Keystone said payment card or bank details, recovery phrases, private keys and wallet passwords were not exposed.

“We’ve blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers,” the company said. It has not said how many customers were affected or what period of orders the data covers. Customers asked on X how far back the affected orders go. Keystone did not give a range, and said in replies that it is “still conducting a thorough investigation and will publish a detailed report in the coming days.”

The bigger risk now is impersonation. Keystone warned that “scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or ‘fixes’ for your order or address. None of it is from us.”

The company’s guidance to customers, in its own words:

• “NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn’t order. We will never ask for them.”
• “Don’t click links in unexpected messages.” Type the company’s web address, keyst.one, directly.
• “Trust only our official channels. If anything feels off, email support@keyst.one.” (The notice says this applies until its detailed report is out.)

Hours before the notice, at about 1 a.m. ET Saturday, Keystone said on X that it had opened an urgent investigation after a customer reported a scam call that used details from a 2024 order. Hardwire Crypto has not independently verified the customer’s account.

“A detailed report is coming soon,” the notice said. “Again, we’re truly sorry to everyone affected.”

Sources: Keystone Hardware Wallet on X