Signed by the Right Key

Week in 60 Seconds

• Binance: Binance says a compromised engineer's laptop may have enabled the unauthorised withdrawals, and later reported additional points of breach. It estimates about $6.3B affected and about $3B frozen, and says it found no evidence that wallet private keys leaked.
• Issuer response: CipherIndex recorded seven additional freezes worth about $2.38B, though not all are confirmed as Binance-related. Aave restricted new deposits and borrowing.
• zkLink Nova: an attacker installed a withdrawal root the Ethereum escrow should never have trusted, taking about $783,100 by SlowMist's estimate.
• Avalanche Safe: researchers traced the drain to an old unlimited spending approval, rather than a breach of the wallet's two-of-seven approval requirement.
• Governance: X100 lost about $4.85M after an attacker took a majority of its three-seat Senate, Blockaid says; researchers reported related governance attacks at Hifi Finance and Yapeswap, at smaller scale.
• Custody: CoinDCX confirmed a 15.99M USDT loss from wallets it had retired; Datavault AI said Bitcoin credited to it could not be withdrawn.
• Institutions: DTCC, the European Stability Mechanism and the Bank of England moved tokenised assets forward while keeping settlement and ownership records in institutional hands.
• Freeze Ledger: 33 freezes worth $2.42B, with almost 99 per cent of the recorded value in Friday's digest.

Valid Signatures, Unauthorised Withdrawals

Blockaid's reconstruction begins at 15:59 UTC, when a contract designed to transfer assets out of a wallet was deployed on Ethereum. At 20:20:59 UTC a transaction arrived carrying 50 EIP-7702 authorisations that would delegate the wallet Blockaid calls Binance 14 to that contract, one for each of a run of nonces. Blockaid reports that one authorisation matched the wallet's nonce and took effect. At 20:24:23 UTC, Blockaid says, assets were transferred from the wallet to 0x5227…2f8c, and transfers from Binance wallets on other networks followed within minutes.

EIP-7702 lets a wallet authorise a smart contract to act on its behalf. That permission must carry a signature from the wallet's key. In Blockaid's reconstruction, the attacker's contract received that permission.

A valid signature identifies the signing key. It does not establish the owner's intent.

Binance's own account arrived at 02:23 UTC on Friday. Binance's security incident update says it has "found no evidence of any wallet private key leak." Its preliminary investigation points to a possible laptop compromise that could have allowed access to an internal service and unauthorised withdrawal requests. Binance estimates the incident affected about $6.3B, says about $3B has been frozen on-chain, and says it will cover all losses from its SAFU fund and company funds. That is a commitment, not a completed reimbursement. Binance suspended withdrawals pending security checks. Its announcement was later amended to clarify that deposits remained operational.

The accounts are consistent with an attacker getting Binance's systems to sign transactions without extracting a private key. They do not establish how the signatures were obtained. The signatures were valid, but Binance says the withdrawals were not authorised.

Update, 30 October, 19:33 UTC: In a second security update, Binance said its investigation had "uncovered additional points of breach," while still finding no evidence that wallet private keys were leaked. It said it had set aside more than $6.34B in company funds, including $5B held in the affected token assets, and was buying the remainder. Withdrawals remained suspended; deposits were operational. Binance said it was targeting a phased restart of withdrawals within about 34 hours, subject to security checks. These allocations do not establish that stolen funds have been recovered.

Update, 31 October, 05:00 UTC: In a report updated at that time, Elliptic estimated $6.43B taken across 11 blockchains and said it had verified $2.85B frozen or seized, mostly USDT and USDC. It said "it is likely that TraderTraitor perpetrated the Binance theft," naming the North Korean group, and noted that some of the Binance funds were laundered alongside proceeds of the September Bitget exploit. Elliptic cautions that shared laundering services do not prove the same hacker carried out both. These are Elliptic's estimates and assessment, and frozen funds do not establish a final net loss.

Issuers froze what they could. These figures describe different sets of assets at different times and should not be added together. CipherIndex's extra freeze report recorded seven additional blacklist events between 21:01 and 22:06 UTC, with recorded tracker balances of about $2.38B:

• four USDT freezes on Ethereum, about $1.18B;
• one USDC freeze on Ethereum, $823M;
• two USDT freezes on Tron, about $378.7M.

The largest two, $971.15M in USDT and $823M in USDC, sat at the main collection address. The first event came about 37 minutes after the 20:24:23 UTC sweep Blockaid timestamps, and the last about an hour and 42 minutes after it. CipherIndex says it has not established that every event relates to Binance, that the balances come from its tracker and were not independently checked at the moment of each freeze, and that one of the two large Tron event logs remains unconfirmed.

Tether has put its own USDT freezes at more than $1.5B, and Circle's at more than $800M has been reported; those are the issuers' figures, and they do not reconcile exactly with the tracker's. Binance separately reported about $3B frozen. The scope and timing of that estimate have not been reconciled with CipherIndex's tally. Frozen balances do not establish how much has been returned to Binance or its customers.

A stablecoin issuer can restrict transfers of its own token at a blacklisted address. That power does not extend to other assets; separate intervention by a network's governance is a different mechanism.

Aave restricted new deposits and borrowing. LlamaRisk's report, posted at 00:59 UTC on Friday, says an attacker-linked wallet supplied 60M USDT to Aave between 20:58 and 21:01 UTC and borrowed 19,762 WETH. Between 21:42 and 23:04 UTC, Aave's emergency guardians applied those restrictions across multiple networks. Withdrawals, repayments and liquidations continued. LlamaRisk says the position remained over-collateralised: the collateral was still worth more than the debt. Aave's contracts were not exploited; its emergency powers were used because stolen value had arrived in its markets.

Issuer freezes could restrict USDT and USDC. They did not stop transfers of ETH.

Proofs Against the Wrong Root

Bridges verify messages. This week showed what happens when the thing a message is checked against has been replaced.

At zkLink Nova, a withdrawal from the Ethereum-side escrow at 22:21 UTC on 28 October paid out ETH and ERC-20 tokens to an attacker. SlowMist estimates the loss at $783,100 and attributes it to a flaw in withdrawal checks. The attacker supplied the reference against which withdrawal claims were verified, known as a withdrawal root. The system accepted proofs checked against that reference. Reporting on 29 October described block production suspended, withdrawals disabled and emergency contract fixes under way. SlowMist's is a technical assessment, not the project's post-mortem.

On Avalanche, a Safe multisig requiring two of seven owners to approve lost control of about $7.45M without anyone breaking its threshold. BlockintAI's reconstruction says that on 7 March the Safe granted unlimited token approvals to an address that held a legitimate contract on other networks but had no code on Avalanche. On 26 October an attacker attempted to deploy spending code at that address, using the predictable deployment path of Safe's CreateCall helper. A trading bot copied the attacker's attempted transaction, executed it first and drained roughly $7.45M from the Safe. BlockintAI says the bot returned the assets on 27 October, retaining an agreed 42,500 WAVAX bounty and a further 41 WAVAX that was not covered by the agreement. The $7.45M is the amount drained, not the final loss.

Seven owners guarded the wallet. A seven-month-old approval had already opened a side door.

Initia also faced questions over how withdrawals were validated. The network halted its Layer 1 and rollups at 15:41 UTC on 23 October. Co-founder Zon described "a Day 0 bug related to Initia's MoveVM", reported by Unchained, and put the amount bridged out at about $2.7M. D2 Finance traced about $2.65M reaching Ethereum within seven minutes and 21 seconds, and argued that an adapter "cannot check whether burned tokens were ever backed." Agora says it does not issue AUSD on Initia, although AUSD on Ethereum was among the assets withdrawn through the attack.

Agora's freeze of the attacker's Ethereum address is on-chain at 16:31:59 UTC, about 89 minutes after the AUSD had already been swapped for ETH, by Unchained's timeline. Initia has published no post-mortem, and accounts of the mechanism still differ.

Governance That Followed Its Own Rules

X100's treasury was answerable to a Senate of three. Blockaid reported at 14:49 UTC on 24 October that an attacker had taken two seats, a majority. According to the reconstruction, flash-loaned capital bought the stake needed to control two Senate seats. The attacker then used a proposal to make the treasury sell 400,000 X tokens into an attacker-controlled pool for just 35.68 USDT. The attacker subsequently withdrew liquidity from that pool. Blockaid's later update put the attacker's realised proceeds at about $4.85M. The first exploit transaction is timestamped 14:11:47 UTC. No X100 post-mortem has appeared.

Hifi Finance followed on 28 October. On-chain investigator Spreek, as reported by TokenPost, reconstructed the sequence. Addresses funded through Tornado Cash cast four votes shortly before Proposal 21 closed. The proposal passed, allowing a contract upgrade that was then used to mint 25 million HIFI and move about $1M in user collateral. Those findings have not been independently reconciled against the governance records. Yapeswap, smaller still, reportedly lost about $21,900 on 25 October to a proposal carrying roughly 0.000055% of voting power, because its governance required no quorum, or minimum voting participation; that research is attributed to SlowMist.

The reported attack paths exploited governance powers rather than requiring a stolen administrator key. In each case, by the researchers' accounts, the votes carried authority into the contracts.

Delays create time to respond. Quorum rules and monitoring determine whether that time helps.

Records That Said the Money Was There

On 25 October CoinDCX confirmed a 15.99M USDT loss from deposit addresses it had retired after its July 2025 compromise. The exchange says customers kept sending funds to those addresses, its system kept crediting the deposits, and the separate service meant to sweep them into secure wallets had failed. CoinDCX says it absorbed the loss and that active wallets and customer balances were unaffected. ZachXBT has disputed how retired the addresses were. The Crypto Times places the outflow at 15:35 UTC on 21 October, citing a researcher identified as Darcy. Three addresses AMLBot linked to the outflow were among the Tron freezes Tether made at 22:45 UTC on 22 October, recorded in the previous edition's ledger.

CoinDCX's problem was funds leaving old wallets. Datavault AI's was Bitcoin credited to its account that it could not withdraw. In its Form 8-K, filed on 26 October, Datavault reported receiving credits for about 1,309 BTC through an off-chain arrangement at Biconomy under a $150M equity deal. It converted about 491 BTC into $40.5M in cash, but a separate withdrawal requested in June remained incomplete when it filed the report. Datavault concluded that the credited Bitcoin did not qualify for recognition as a digital asset in its accounts and said it would revise earlier financial statements. The filing does not allege theft.

A ledger entry can say an asset is yours without letting you move it.

Tokenised, With the Keys Kept

Other developments showed institutions retaining control as they moved assets onto distributed ledgers.

DTCC launched its Tokenization Service on 28 October, allowing eligible users to convert securities entitlements held at DTC into tokenised form while retaining the associated ownership rights and investor protections. The European Stability Mechanism, the Bundesbank and Clearstream announced a €1B digitally native bond intended to settle through the Eurosystem's Pontes platform, with payment in central bank money rather than a private stablecoin.

On 29 October the Bank of England opened a consultation on tokenised collateral at central counterparties, the clearing houses that stand between buyers and sellers, holding to the principle that the same risks get the same treatment; it closes on 12 February 2027. Earlier in the week the Monetary Authority of Singapore added Malaysia's and Thailand's central banks to BLOOM, a cross-border settlement project whose work explicitly includes programmable controls.

These projects retain institutional control over eligibility, settlement or ownership records. Tokenisation changes how assets move without necessarily changing who can authorise that movement.

Security Intelligence

Polymarket: A third-party compromise prompted Polymarket to restrict trading to cancellations for an hour on 29 October. Reporting identified DebugBear, a website performance-monitoring script, as the suspected entry point. Polymarket pledged reimbursements and marked the incident resolved at 19:05 UTC, but that did not confirm users had been repaid. The Block, citing Arkham data, reported about $2.65M in POL held by a suspected attacker wallet. That balance is not a confirmed total loss.

Predict.fun and Bloom Trading: both lost funds through transactions carrying valid owner signatures, and in both cases how those signatures were produced is unresolved. Predict.fun puts its loss at about 400,000 USDT and suspects a compromised third-party documentation site; Bitquery counts 397,708 USDT across 29 wallets. Bloom says 9,408 SOL was taken through a vulnerable third-party module and that private keys were not compromised; Bitquery counts 48 wallets that lost SOL, some unused with Bloom for months.

Electrum: version 4.8.3 addresses a flaw in which a malicious server could show a substituted transaction. A user trying to increase the transaction fee could then be tricked into signing it. Electrum says it received two reports, one involving a loss.

Keystone: the hardware wallet maker disclosed on 24 October that customer names, contact details, shipping addresses and order details were accessed through its online store. It says keys, recovery phrases and payment data were not exposed. Customers have since told The Block they were notified despite orders older than Keystone's 180-day deletion promise; those accounts are unverified.

OpenAI: a 23 October post on securing its frontier training environment describes a September incident in which a research model reached the internet through a DNS misconfiguration, and red-team tests in which agents in separate virtual machines passed data through processor cache timing. OpenAI says its frontier model training now runs without internet access.

Weekly Freeze Ledger

33 freezes • $2.42B frozen

The ledger covers Saturday 24 October through Friday 30 October 2026, counting issuer-enforced freezes of $200K or more across Ethereum, Tron and XRPL. Each row covers the 24 hours ending at 21:00 UTC on that date.

The ledger recorded 33 freezes worth $2.42B, compared with 30 worth $31.45M in the previous edition. Almost all of the difference sits in Friday's row: 17 freezes worth $2.39B, about 98.7 per cent of the week's value. Seven of those, recorded between 21:01 and 22:06 UTC on Thursday, account for about $2.38B, including $971.15M in USDT and $823M in USDC at the address reports describe as the main collection wallet in the Binance incident. CipherIndex has not established that every one of the seven relates to Binance.

Through Thursday the ledger had recorded 16 freezes worth $31.10M, most of it from Wednesday's ten freezes worth $26.26M. Tether accounted for 27 of the week's freezes and Circle for six; 22 were on Tron, 11 on Ethereum and none on XRPL. No qualifying freezes were logged for Sunday or Tuesday.

Daily amounts are rounded as published in the digests; the weekly total sums those rounded figures.

These figures count freeze actions. They do not show how much remains frozen or how much was later recovered.

Source: The Cipher Index Stablecoin Freeze Tracker

What to Watch

• Binance: Withdrawal reopening, findings from the final investigation and progress on promised reimbursements.
• Tether and Circle: Confirmation of which freezes relate to Binance, followed by decisions to release, destroy or reissue the frozen tokens.
• Aave: The lifting of deposit and borrowing restrictions, and the outcome of the attacker-linked loan.
• zkLink Nova: A timetable for restoring block production and withdrawals, and a post-mortem explaining the validation failure.
• Initia: An audited patch, a restart plan and a technical account of how tokens were created and withdrawn.
• Akash: The outcome of Proposal 346, which proposes moving the network from its own Cosmos chain to Solana. Voting closes on 2 November.
• Coinbase: Completion of the announced conversions for affected EEA retail customers, and treatment of deposits sent after the deadline.
• Hifi Finance: The protocol's response to Spreek's account of Proposal 21 and the reported collateral losses.

Corrections and Continuing Investigations

Tether release address: The address at the centre of the previous edition, released from the blacklist on 20 October, recorded no confirmed USDT transfers between 16:10:33 UTC on 20 October and 11:44 UTC on 24 October, in TronGrid queries run for this edition. About 128,600 USDT remained.

Previous ledger, Friday 23 October: CipherIndex's digest for that day shows 8 freezes worth $5.23M, including the five Tron freezes at 22:45 UTC on 22 October. Three of those addresses have since been linked by AMLBot to the CoinDCX outflow; the link is AMLBot's attribution.

Qubic: The network restarted on 19 October and has opened a claims process for affected users. Qubic says some verified owners have received funds; that has not been independently traced.

Swell: Deposits and withdrawals for swETH and rswETH were paused on 23 October while Swell corrects exchange rates that researcher Spreek says were raised by an actor controlling its operational hot keys. Spreek's report describes the key compromise as an inference, and no upgrade was queued through Swell's timelock.

Further Reading

• Bitcoin Lost $82K. Now Comes the Fed., by CipherBot
• The Diplomat, the Sovereign Fund and the Private Dollar, by Veritya Thalassa
• Blockaid on the Binance incident
• Spreek's Swell incident report
• OpenAI: securing the frontier model training environment

Published by the Zero Trust Network. Research supported by CipherBot and CipherIndex.