US moves to seize $1.2 billion of the Binance hack haul and shuts down North Korea's deepfake call trap
The Justice Department says it won court approval to seize or restrain more than $1.2 billion stolen from Binance on October 29. It also took down servers behind "FaceStealer," a fake video call scheme it ties to more than $400 million in thefts.
Rumor vs record: did hackers pay $15 to drain $2.5 billion from Binance in 20 minutes?
Headlines about the Binance hack keep spreading. We checked the most shared claims against Binance's own report, DeepSea's hack tracker and CoinGecko prices. The single-transaction part holds up. The "$15" and "20 minutes" framing misses the story.
Rumor vs record: was Chainalysis hit by AI, and did attackers see case files?
Claims about the Chainalysis breach kept spreading as the company posted its November 6 update. We checked eight of them against Chainalysis's own incident page: two are wrong or out of date, and two have no evidence behind them yet.
Chainalysis now says login tokens for every user were exposed. All must reset passwords
The crypto tracing firm first said only names and emails were reached. Its latest update says live tokens for every user and password hashes were exposed, and its Reactor and Data Solutions products are still offline.
Brazil's Mercado Bitcoin lost about $49 million on 17 chains. It says customers lose nothing
Mercado Bitcoin says it contained a security incident on November 2, 2026, and that no customer will lose assets. Chainalysis puts the theft at about $49 million and says close to $9 million has been frozen.
Hackers drained French bank Arkéa's own account. It calls a $133 million estimate about right
Crédit Mutuel Arkéa confirmed a cyberattack that sent fraudulent transfers out of the bank's own account, possibly into crypto. It denies the attackers came in through Fortuneo and says customer savings are safe.
32,175 crypto addresses are on DeepSea's risk list. Ransomware is the biggest category
DeepSea's database of scam, fraud and sanctioned addresses grew by 1,178 last week. Most new entries were hack-tainted, and Bitcoin holds more flagged addresses than Ethereum.
$307 million in hack-linked bitcoin hit exchanges in one week. OKX got the biggest share
DeepSea counted 680 deposits of tainted funds into exchanges from October 26 to November 1, nearly all in BTC. OKX took $139.96 million in just 55 of them, including a run of near-identical $15.47 million transfers.
A fake job interview opened the door to Binance's $6.34 billion hack, its own report says
Binance's first incident report traces the October 29 theft to a staged hiring process, a poisoned coding test and a developer tool swapped for malware. Then nine minutes of hot-wallet transfers did the rest.
How stolen crypto is traced and frozen, and why thieves dump stablecoins fast
Every blockchain transfer is public, so investigators can follow stolen funds hop by hop. Money can be stopped in two places: stablecoin issuers like Tether and Circle can freeze tokens on-chain, and exchanges can lock accounts when stolen funds arrive.
What is DeepSea (desea.io)? The onchain app that labels wallets and tracks flows
DeepSea (desea.io) is a web app that labels crypto wallets and tracks what smart money, influencers, whales, exchanges and hackers do onchain. It is run by DeepTek Ltd, and its own terms say the data is information only, not financial advice.
What is address poisoning? The copy-paste scam hiding in your wallet history
Address poisoning is a scam where an attacker plants a lookalike address in your transaction history and waits for you to copy it. No hacking is needed, only a tiny or fake transfer and a hurried user, and the payment cannot be reversed.
How to check and revoke token approvals before an old one drains your wallet
Look up your wallet address in an approval checker such as Etherscan's Token Approvals page or Revoke.cash, find spenders you no longer use or do not recognize, and revoke them. Each revoke is an on-chain transaction, so it costs a small network fee.
One address, two exchange hacks: DeepSea traces where this fall's stolen crypto went
DeepSea says funds from the Bitget and Binance thefts landed at the same address. Its tracker also shows how little of the loot has reached exchanges, and how much is simply sitting still.
What is a wallet drainer? How one signature can empty your crypto wallet
A wallet drainer is a scam kit that tricks you into signing an approval or permit that lets the attacker move your tokens. Your seed phrase never leaves your hands: your own signature does the damage, sometimes days later.
How crypto exchange hacks happen: the weak spot is rarely the key itself
Most exchange hacks start in hot wallets, the online wallets that pay out withdrawals. Attackers rarely break the cryptography. They get into the systems and people that approve transactions, then rush to swap stablecoins before issuers can freeze them.
How crypto airdrops work, and how to spot the scams that copy them
An airdrop is a free drop of tokens to wallets, usually as a reward for early users. Real airdrops never ask for your seed phrase. Most scams instead trick you into signing a transaction on a fake claim site.
Beyond Binance: 19 more crypto hacks in October's last 11 days, about $24.6 million lost
Binance's $6.3 billion breach dominated October, but SlowMist logged 19 other attacks from October 21 to 31, close to two a day. They range from a $7.45 million multisig mistake to supply chain and DNS attacks.
How 99 requests to withdraw zero drained 97 million CORE ($1.47 million) from b14g
A new wallet asked b14g, a Bitcoin staking app on Core, to withdraw zero tokens 99 times. Core's staking code read each one as "withdraw everything." About 70% of the coins had still not moved by that evening.
Polymarket repaid $3.9 million after a vendor's script turned on its users. What broke?
A hijacked performance-monitoring script on polymarket.com used logged-in sessions to sell positions and pull funds. Polymarket's postmortem says 95% of affected wallets are now fully refunded, and it paid $1.2 million more for losses during its trading pause.
Four years after the Nomad Bridge hack, a man is extradited to the US over $2.89 million
Prosecutors say Alexander Gurevich ran four exploit transactions against the Nomad Bridge on August 1, 2022, taking 103 WBTC and 300 WETH. It is the second old DeFi exploit case to reach a US courtroom this month, three weeks after the Uranium Finance hacker's conviction was announced.
Binance lost a record $6.3 billion. Who froze $2.7 billion of it?
Attackers emptied Binance's hot wallets on October 29 in the biggest crypto theft on record. Stablecoin issuers froze about $2.7 billion, the FBI blames North Korea, and Binance says users will not pay.
A spy chip in the box: $86.96 million drained from Ledgers sold by one reseller
Ledger says an implant hidden inside devices sold by Southeast Asian reseller CryptoBilis read the 24-word recovery phrase off the screen and sent it out over a mobile network. DeepSea puts the losses at $86.96 million. Ledger has confirmed no total.
$771 million stolen in September, and two hacks were 92% of it
September 2026 was the worst month of the year for crypto hacks until October, CertiK's data show. Bitget and the Liquid Network caused almost all of it, and a returned bitcoin haul cut the real loss to about $488 million.
Duelbits lost $7 million from its hot wallets. Five weeks later, still no explanation
The crypto casino went offline on September 24, said user funds were safe and has since relaunched. On-chain data show the stolen value was swapped into ETH, which can't be frozen, and moved on.
Bitget lost $388 million with no keys stolen. How did fake withdrawals get through?
Attackers used an unpatched flaw in a third-party security tool, took real staff logins and wrote fake withdrawal orders into Bitget's wallet servers. Bitget says its Protection Fund covers the loss and user balances were not touched.
12.7 million XRP drained from D'CENT app wallets. Why updating the app will not save you
Since mid-September, thousands of software wallets made with D'CENT's mobile app have been emptied in waves. The Korean wallet maker says users must move everything to a brand-new recovery phrase, and it is keeping the cause private.
A Liquid bug minted 4,000 unbacked L-BTC. Eight weeks on, the reserve is 550 BTC short
An attacker used a flaw in Liquid's software to create unbacked tokens and redeem them for about $319 million in real bitcoin, then sent 85% back. The reserve is still 550 BTC short and direct redemptions stay paused.
Cronos halted its whole chain to undo a $120 million Tectonic drain. $9 million got away
An attacker pumped the TONIC token about 195 times and borrowed $120.4 million against it from Tectonic, the biggest lender on Crypto.com's Cronos chain. Validators stopped the network and rewound it, but about $9.19 million had already left.