Security
Hacks, exploits and scams, traced through public data and official statements.
US moves to seize $1.2 billion of the Binance hack haul and shuts down North Korea's deepfake call trap
The Justice Department says it won court approval to seize or restrain more than $1.2 billion stolen from Binance on October 29. It also took down servers behind "FaceStealer," a fake video call scheme it ties to more than $400 million in thefts.
Rumor vs record: is a hacker really selling 335.9 million Binance user records?
A "pay or leak" ad offering 335.9 million Binance records, private keys included, has been reshared online. We checked each claim against Binance's own pages and a threat intelligence firm's review. Nothing confirms it, and its headline number is close to a counter anyone can read on Binance's homepage.
Rumor vs record: 128 Japanese banks went dark on November 6. Notices blame broken equipment
A viral reel says 128 banks in Japan were taken down all at once. The outage was real. The official notices we could read point to a failed piece of communications equipment, and none of them mention an attack.
Rumor vs record: did hackers pay $15 to drain $2.5 billion from Binance in 20 minutes?
Headlines about the Binance hack keep spreading. We checked the most shared claims against Binance's own report, DeepSea's hack tracker and CoinGecko prices. The single-transaction part holds up. The "$15" and "20 minutes" framing misses the story.
Rumor vs record: was Chainalysis hit by AI, and did attackers see case files?
Claims about the Chainalysis breach kept spreading as the company posted its November 6 update. We checked eight of them against Chainalysis's own incident page: two are wrong or out of date, and two have no evidence behind them yet.
Chainalysis now says login tokens for every user were exposed. All must reset passwords
The crypto tracing firm first said only names and emails were reached. Its latest update says live tokens for every user and password hashes were exposed, and its Reactor and Data Solutions products are still offline.
Brazil's Mercado Bitcoin lost about $49 million on 17 chains. It says customers lose nothing
Mercado Bitcoin says it contained a security incident on November 2, 2026, and that no customer will lose assets. Chainalysis puts the theft at about $49 million and says close to $9 million has been frozen.
Hackers drained French bank Arkéa's own account. It calls a $133 million estimate about right
Crédit Mutuel Arkéa confirmed a cyberattack that sent fraudulent transfers out of the bank's own account, possibly into crypto. It denies the attackers came in through Fortuneo and says customer savings are safe.
32,175 crypto addresses are on DeepSea's risk list. Ransomware is the biggest category
DeepSea's database of scam, fraud and sanctioned addresses grew by 1,178 last week. Most new entries were hack-tainted, and Bitcoin holds more flagged addresses than Ethereum.
$307 million in hack-linked bitcoin hit exchanges in one week. OKX got the biggest share
DeepSea counted 680 deposits of tainted funds into exchanges from October 26 to November 1, nearly all in BTC. OKX took $139.96 million in just 55 of them, including a run of near-identical $15.47 million transfers.
A fake job interview opened the door to Binance's $6.34 billion hack, its own report says
Binance's first incident report traces the October 29 theft to a staged hiring process, a poisoned coding test and a developer tool swapped for malware. Then nine minutes of hot-wallet transfers did the rest.
One address, two exchange hacks: DeepSea traces where this fall's stolen crypto went
DeepSea says funds from the Bitget and Binance thefts landed at the same address. Its tracker also shows how little of the loot has reached exchanges, and how much is simply sitting still.
A 100/100 token with bundlers among its top holders: how to read DeepSea's risk flags
DeepSea checks every tracked token for holder concentration, thin liquidity, team selling and bundled supply. After October's run of drains and fake apps, here is what those signals mean, with real examples, and why one score is never the whole story.
Beyond Binance: 19 more crypto hacks in October's last 11 days, about $24.6 million lost
Binance's $6.3 billion breach dominated October, but SlowMist logged 19 other attacks from October 21 to 31, close to two a day. They range from a $7.45 million multisig mistake to supply chain and DNS attacks.
How 99 requests to withdraw zero drained 97 million CORE ($1.47 million) from b14g
A new wallet asked b14g, a Bitcoin staking app on Core, to withdraw zero tokens 99 times. Core's staking code read each one as "withdraw everything." About 70% of the coins had still not moved by that evening.
Polymarket repaid $3.9 million after a vendor's script turned on its users. What broke?
A hijacked performance-monitoring script on polymarket.com used logged-in sessions to sell positions and pull funds. Polymarket's postmortem says 95% of affected wallets are now fully refunded, and it paid $1.2 million more for losses during its trading pause.
Four years after the Nomad Bridge hack, a man is extradited to the US over $2.89 million
Prosecutors say Alexander Gurevich ran four exploit transactions against the Nomad Bridge on August 1, 2022, taking 103 WBTC and 300 WETH. It is the second old DeFi exploit case to reach a US courtroom this month, three weeks after the Uranium Finance hacker's conviction was announced.
Binance lost a record $6.3 billion. Who froze $2.7 billion of it?
Attackers emptied Binance's hot wallets on October 29 in the biggest crypto theft on record. Stablecoin issuers froze about $2.7 billion, the FBI blames North Korea, and Binance says users will not pay.
A spy chip in the box: $86.96 million drained from Ledgers sold by one reseller
Ledger says an implant hidden inside devices sold by Southeast Asian reseller CryptoBilis read the 24-word recovery phrase off the screen and sent it out over a mobile network. DeepSea puts the losses at $86.96 million. Ledger has confirmed no total.
$771 million stolen in September, and two hacks were 92% of it
September 2026 was the worst month of the year for crypto hacks until October, CertiK's data show. Bitget and the Liquid Network caused almost all of it, and a returned bitcoin haul cut the real loss to about $488 million.
Duelbits lost $7 million from its hot wallets. Five weeks later, still no explanation
The crypto casino went offline on September 24, said user funds were safe and has since relaunched. On-chain data show the stolen value was swapped into ETH, which can't be frozen, and moved on.
Bitget lost $388 million with no keys stolen. How did fake withdrawals get through?
Attackers used an unpatched flaw in a third-party security tool, took real staff logins and wrote fake withdrawal orders into Bitget's wallet servers. Bitget says its Protection Fund covers the loss and user balances were not touched.
12.7 million XRP drained from D'CENT app wallets. Why updating the app will not save you
Since mid-September, thousands of software wallets made with D'CENT's mobile app have been emptied in waves. The Korean wallet maker says users must move everything to a brand-new recovery phrase, and it is keeping the cause private.
A Liquid bug minted 4,000 unbacked L-BTC. Eight weeks on, the reserve is 550 BTC short
An attacker used a flaw in Liquid's software to create unbacked tokens and redeem them for about $319 million in real bitcoin, then sent 85% back. The reserve is still 550 BTC short and direct redemptions stay paused.
Cronos halted its whole chain to undo a $120 million Tectonic drain. $9 million got away
An attacker pumped the TONIC token about 195 times and borrowed $120.4 million against it from Tectonic, the biggest lender on Crypto.com's Cronos chain. Validators stopped the network and rewound it, but about $9.19 million had already left.